History / API Overview

Document X-Panopticon-Token fallback and supergateway for header-stripping hosts [gh-1010] Some shared hosts (cgi-fcgi / LSPHP with restricted AllowOverride) strip the Authorization header before PHP starts, where no server-side workaround can recover it. Document the X-Panopticon-Token header as the reliable fallback, with a working supergateway MCP configuration, and add missing_token / no_secret troubleshooting guidance (the latter fixed in Panopticon 2.2.1; re-mint tokens).

nikosdion committed Jul 5, 2026

Document token-auth transport for MCP server and JSON API [gh-1010] Make /index.php/mcp the canonical MCP endpoint (works on every server); the short /mcp form requires a rewrite rule (added to htaccess.txt in 2.2.1). Document Authorization-header forwarding for Apache, Nginx, and IIS, add a minimal self-managed .htaccess snippet, correct the IIS claim (not automatic), require URL-encoding for the _panopticon_token query parameter, and expand MCP troubleshooting to distinguish a plain 404 (routing) from a JSON 404 (disabled) and a 401 caused by header stripping. Signed-off-by: Nicholas K. Dionysopoulos <nicholas@akeeba.com>

nikosdion committed Jul 4, 2026

Document the JSON API

nikosdion committed Jun 4, 2026