Docs
Reference for developers building on Basehim: themes, apps, the REST API and AI agents.
35 articles
-
Media and uploads for apps
How an app takes files through the AJAX gateway, keeps private files, adds to and changes the media library, and extends every upload with hooks, filters and browser events, all without touching core. New in Basehim 1.2.87.
-
App development best practices
The complete best-practice guide for building Basehim apps: structure, manifest, boot(), lifecycle and migrations, permissions, data, security, admin UI, AJAX, public routes, uploads and media, scheduled work, widgets, tables, hooks, MCP tools, performance, testing, packaging and a pre-release checklist.
-
Dashboard widgets
Add cards to the admin dashboard from your app: stats, lists, tables, charts, feeds and status checks drawn by core from the data you return, with settings, actions, caching, per-user layouts and permission checks on the server.
-
When an app fails: fault isolation and recovery
How Basehim keeps one broken app from taking a site down: code checked before it is loaded, failures contained while it starts, the app switched off with a report for the administrator, and a validated way to turn it back on.
-
Public routes for apps
Give your app public pages and endpoints with $this->router()->site(): every HTTP method, parameters, named URLs, per-route sign-in, permissions, CSRF and rate limits, and pages rendered inside the active theme, without ever overriding core's own URLs.
-
Contributing and running the tests
Set up a development checkout, run the dependency-free test suite with and without a database, write unit and integration tests, follow the code conventions, and send a pull request.
-
Security for developers
Roles and capabilities, per-user permissions, filtered HTML, CSRF, escaping, SQL, uploads, rate limits and tokens - what Basehim does for you, what your theme or app must still do, and how to report a vulnerability.
-
AI discovery: llms.txt, robots.txt and WebMCP
What Basehim publishes so AI crawlers and agents can find and use a site - robots.txt rules per crawler class, llms.txt, the agent resource catalog and in-browser WebMCP tools - and how themes and apps extend each one.
-
MCP and AI agents
Basehim's built-in Model Context Protocol server - how assistants connect over OAuth 2.1 or with an API key, what each tool does and which scope it needs, how roles limit agents, raw JSON-RPC examples, and how apps add tools.
-
Content types, blocks and widgets
Register your own content types, with admin screens and, since 1.2.94, public pages, taxonomies and custom fields; add custom blocks to the editor with a PHP renderer for the public site; and provide widgets for widget areas, the editor and the dashboard.