ActiveManage Docs ← Back to activemanage.co.uk

API Server

Hosting the API Server

The API server is the HTTP service that handles every API request. In most ActiveManage deployments it runs in the same PHP-FPM process pool as the web UI. For very high-load deployments you can split it onto dedicated infrastructure.

Topology diagram showing load balancer fronting two PHP-FPM pools — one for web UI, one for /api/* requests — both reading/writing the shared MySQL cluster and Redis cache

Default Setup

A single PHP-FPM pool serves both / (web UI) and /api (REST). Nginx routes by path. This is the simplest topology and fine up to roughly 500 requests/second.

Splitting the API onto a Dedicated Pool

  1. Provision a second PHP-FPM pool with its own worker count, memory limit and timeout.
  2. Update Nginx to send location /api to the new pool.
  3. Optionally use a separate FPM config with tighter PHP memory limits — API requests are usually smaller than full-page renders.
  4. Health-check both pools independently; the platform exposes /healthz on each.

Why Split?

  • Different resource profiles: Web requests render full pages; API requests are typically smaller and faster. Different worker counts make sense.
  • Stability isolation: A surge of API traffic doesn't crowd out interactive users.
  • Independent scaling: Add API capacity without doubling web capacity.
  • Auditing and logging: Separate log files make analysis cleaner.

Worked Examples

  • Small SaaS: Single combined pool, 16 workers, 2GB total memory. Sufficient until ~200 concurrent users.
  • Growing mid-market: Split into web (24 workers) and api (16 workers). Each scaled independently per usage.
  • Marketplace at scale: Dedicated API hosts, autoscaled by Kubernetes based on request rate. Web tier separately scaled by page-views.

Authentication Modes

The API supports several authentication modes. Each is appropriate for different callers — interactive users, server-to-server, mobile apps.

Comparison table of auth modes: Cookie/session (browser UI), Bearer user token (mobile/SPA), API key (service), OAuth (third-party), mTLS (very high security)

Cookie / Session

When a user signs in via the web UI, a session cookie is set. The same cookie authenticates API calls from the browser. This is the default mode for browser-based traffic.

Bearer User Token

Mobile apps or single-page applications obtain a JWT from POST /auth/login and present it as Authorization: Bearer …. Tokens are short-lived (1 hour); refresh tokens last 30 days.

API Key

For service-to-service calls (no human in the loop). See the “Authenticating with API Keys” article.

OAuth 2.0 / OpenID Connect

For third-party integrations where users grant access to your platform on behalf of another service. Standard OAuth flows are supported.

mTLS

For very high security (banking, government), enable mutual TLS — both server and client present certificates. Configure trusted CAs and require client certificate verification at the reverse proxy.

Worked Examples

  • Browser SPA: Session cookie for the web app; same cookie used for fetch() calls.
  • iOS app: Bearer token, refresh on 401, sign in via the OS keychain-backed refresh token.
  • CRM integration: Service API key, scope read+write on customers and orders.
  • Customer-facing OAuth: Customer can authorise their Slack to receive notifications; standard OAuth flow grants the platform a Slack token while granting Slack scoped access back.
  • Government tenant: mTLS for all admin API endpoints; client cert held in the tenant's HSM.
Note: Mix modes as you need to. The same endpoint will accept any valid authentication; the platform identifies the caller and applies the corresponding permission set.