Skip to main content
The web app reads two variables, both at runtime. Nothing about the API address is baked into the image, so the same image can point at a different API by changing an environment variable and restarting.

​
Variables

Compose sets API_INTERNAL_URL to http://api:4000, which resolves on the Docker network rather than on your machine.

​
How the proxy works

The browser only ever talks to the web origin. A call to /api/backend/apps is handled by a Next.js route handler, which forwards the request, the session cookie and any bearer header to API_INTERNAL_URL and streams the answer back. Two consequences follow from that, and both are the reason it works this way.
  • There is no CORS configuration and no cross site cookie handling, because the browser never makes a cross origin request.
  • The API never needs to be published. In the Compose stack it stays on a private network and only port 3000 is exposed.
See How asobeast works.

​
What a timeout looks like

When the API does not answer within API_PROXY_TIMEOUT_MS, the proxy returns a 504 in the standard error envelope rather than leaving the request open. Raise the value if you run a slow upstream, but a proxy timeout usually points at a saturated API rather than at a bound that is too tight.

Configuration reference

Every API variable with its default.

Hosting behind TLS and a reverse proxy

What to set before exposing port 3000.
Last modified on July 31, 2026