How does Apiflow compare to Postman?

Apiflow is open source and free forever, with API testing, documentation, and collaboration built in.

Can I import my existing Postman collections?

Yes! We provide easy import tools to migrate your collections from Postman, Insomnia, and other popular API tools seamlessly.

Is Apiflow really free?

Yes. Apiflow is open source, and all core features are free to use—forever.

Deployment Guide

Step-by-step instructions to launch Apiflow in your stack.

Prerequisites

Make sure the basics are in place before you begin.

Server requirements: >=2 CPU cores, 4 GB RAM, with 80/443 open.
Tooling: Docker 24+, Docker Compose, Git, and a Node.js runtime.
Domain & TLS: prepare a reachable domain and plan for Let's Encrypt certificates.

Deployment Workflow

We recommend Docker Compose for the fastest rollout.

Clone the repository and switch to the deployment directory.
Configure variables: copy the env template and fill database or storage values.
Start services: run docker compose up -d and confirm with container logs.

Environment Variables Configuration

Detailed configuration guide to ensure all services run properly.

Required Configuration

Variable Name	Description	Default Value
MONGO_ROOT_USERNAME	MongoDB root username	admin
MONGO_ROOT_PASSWORD	MongoDB root password	Must be changed
MONGO_DATABASE	MongoDB database name	apiflow

AI Features Configuration (Optional)

Variable Name	Description	Default Value
DEEPSEEK_API_KEY	DeepSeek AI API key	-
DEEPSEEK_BASE_URL	AI service endpoint URL	https://api.deepseek.com/v1/chat/completions
DEEPSEEK_MODEL	AI model name to use	deepseek-chat

Email Service Configuration (Optional)

Variable Name	Description	Default Value
EMAIL_REGISTER_ENABLE	Enable email registration feature	false
ALI_ACCESS_KEY_ID	Alibaba Cloud AccessKey ID	-
ALI_ACCESS_KEY_SECRET	Alibaba Cloud AccessKey Secret	-
ALI_ACCOUNT_NAME	Sender email address	-

Security Best Practices

Essential security hardening measures for production environments.

JWT Secret: Modify jwtConfig.secretOrPrivateKey in packages/server/src/config/config.default.ts, replace default 'apiflow' with a complex random string.
MongoDB Security: Set strong passwords, enable authentication, restrict network access, rotate passwords regularly. Use passwords with uppercase, lowercase, numbers and special characters.
File Upload Limits: Configure file size limits (default 5MB) and allowed file types, clean expired files regularly, set proper directory permissions.
HTTPS Configuration: Use Let's Encrypt free certificates or purchase commercial certificates, configure nginx SSL, enable HSTS and security headers.

Data Backup and Recovery

Regular backups to prevent data loss.

MongoDB Backup: docker exec apiflow-mongo mongodump --username=admin --password=your_password --authenticationDatabase=admin --out=/backup
File Backup: Backup /data/apiflow_upload directory and Docker volumes (mongo_data, server_logs).
Scheduled Backups: Use cron jobs to run backup scripts daily at midnight, retain last 7 days backups, store backups off-site.

Logging and Monitoring

Detect and resolve issues promptly.

View Logs: docker logs -f apiflow-server for real-time logs, log files located in server_logs volume with daily rotation.
Health Check: Visit http://your-domain/api/health to check service status, returns {"status":"ok"} when healthy.
Resource Monitoring: Use docker stats to view container resource usage, recommend Prometheus + Grafana for visualization and alerting.

Operations & Updates

Keep the platform stable with these routines.

Backups: export databases and object storage snapshots regularly.
Upgrades: pull new images, validate in staging, then roll out to production.
Monitoring: alert on traffic, response time, and resource usage thresholds.

Troubleshooting

Check these tips first when something goes wrong.

Container Start Failed

Check docker logs for error messages, verify ports 80/443 are not occupied, confirm .env file is configured correctly, ensure Docker version >= 24.

Service Unreachable

Check firewall rules (open ports 80/443), verify nginx container is running, check DNS resolution for domain, review nginx logs for proxy issues.

Database Connection Failed

Confirm MongoDB container passes health check, verify MONGO_ROOT_USERNAME and MONGO_ROOT_PASSWORD configuration, check server logs for connection errors.

API Returns 502 Error

Check if server and website containers are running, review nginx error logs, confirm inter-service network connectivity, try restarting related containers.

Static Assets Load Failed

Check if web container is running, clear browser cache and retry, review nginx access logs for request paths, verify file permissions and nginx configuration.

Loading Apiflow…

Environment Variables Configuration

Detailed configuration guide to ensure all services run properly.

Required Configuration

Variable Name	Description	Default Value
MONGO_ROOT_USERNAME	MongoDB root username	admin
MONGO_ROOT_PASSWORD	MongoDB root password	Must be changed
MONGO_DATABASE	MongoDB database name	apiflow

AI Features Configuration (Optional)

Variable Name	Description	Default Value
DEEPSEEK_API_KEY	DeepSeek AI API key	-
DEEPSEEK_BASE_URL	AI service endpoint URL	https://api.deepseek.com/v1/chat/completions
DEEPSEEK_MODEL	AI model name to use	deepseek-chat

Email Service Configuration (Optional)

Variable Name	Description	Default Value
EMAIL_REGISTER_ENABLE	Enable email registration feature	false
ALI_ACCESS_KEY_ID	Alibaba Cloud AccessKey ID	-
ALI_ACCESS_KEY_SECRET	Alibaba Cloud AccessKey Secret	-
ALI_ACCOUNT_NAME	Sender email address	-

Security Best Practices

Essential security hardening measures for production environments.

JWT Secret: Modify jwtConfig.secretOrPrivateKey in packages/server/src/config/config.default.ts, replace default 'apiflow' with a complex random string.

MongoDB Security: Set strong passwords, enable authentication, restrict network access, rotate passwords regularly. Use passwords with uppercase, lowercase, numbers and special characters.

File Upload Limits: Configure file size limits (default 5MB) and allowed file types, clean expired files regularly, set proper directory permissions.

HTTPS Configuration: Use Let's Encrypt free certificates or purchase commercial certificates, configure nginx SSL, enable HSTS and security headers.

Data Backup and Recovery

Regular backups to prevent data loss.

MongoDB Backup: docker exec apiflow-mongo mongodump --username=admin --password=your_password --authenticationDatabase=admin --out=/backup

File Backup: Backup /data/apiflow_upload directory and Docker volumes (mongo_data, server_logs).

Scheduled Backups: Use cron jobs to run backup scripts daily at midnight, retain last 7 days backups, store backups off-site.

Logging and Monitoring

Detect and resolve issues promptly.

View Logs: docker logs -f apiflow-server for real-time logs, log files located in server_logs volume with daily rotation.

Health Check: Visit http://your-domain/api/health to check service status, returns {"status":"ok"} when healthy.

Resource Monitoring: Use docker stats to view container resource usage, recommend Prometheus + Grafana for visualization and alerting.

Troubleshooting

Check these tips first when something goes wrong.

Container Start Failed

Check docker logs for error messages, verify ports 80/443 are not occupied, confirm .env file is configured correctly, ensure Docker version >= 24.

Service Unreachable

Check firewall rules (open ports 80/443), verify nginx container is running, check DNS resolution for domain, review nginx logs for proxy issues.

Database Connection Failed

Confirm MongoDB container passes health check, verify MONGO_ROOT_USERNAME and MONGO_ROOT_PASSWORD configuration, check server logs for connection errors.

API Returns 502 Error

Check if server and website containers are running, review nginx error logs, confirm inter-service network connectivity, try restarting related containers.

Static Assets Load Failed

Check if web container is running, clear browser cache and retry, review nginx access logs for request paths, verify file permissions and nginx configuration.