> ## Documentation Index
> Fetch the complete documentation index at: https://ayakaleaf-pro.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# web

Private API of web, the main Overleaf app. Other services (real-time, document-updater, project-history, third-party-datastore, git-bridge) and the cron scripts of the Server CE image call it. These routes need HTTP basic auth only, no CSRF token: the private router is mounted before the web router, and only the web router runs the CSRF check. With `BLOCK_CROSS_ORIGIN_REQUESTS=true` (off by default) web returns 403 for any request whose `Origin` header is not in `ALLOWED_ORIGINS` (default: the site URL). Browsers send `Origin` on POST, so with that switch on, POSTs sent from Hoppscotch in the browser get 403 unless they go through the Hoppscotch proxy.

* **Address:** `http://web:3000`, inside the Docker network
* **Authentication:** HTTP basic auth with `WEB_API_USER` and `WEB_API_PASSWORD`, except for status, health and metrics. The git-bridge routes take a personal access token instead.
* **OpenAPI file:** [`develop/hoppscotch/openapi/web.yaml`](https://github.com/ayaka-notes/ayakaleaf-pro/blob/server-pro/develop/hoppscotch/openapi/web.yaml)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.