Create and Secure Custom REST APIs in Joomla

Create custom REST API endpoints in Joomla with full control over data exposure and authentication. Secure both custom and core Joomla APIs using API keys, JWT, Bearer tokens, or Basic Authentication, without writing complex plugins or custom code.
Built for developers and integrators who need more flexibility, stronger authentication, and real control beyond Joomla’s default Web Services APIs.

Download Pricing Plan Documentation

Request A Demo Trial

Our Trusted Customers

Build Secure Joomla REST APIs in Minutes

Step 01

Define Custom API Endpoints

Create REST API routes with your own paths and parameters. Each endpoint can fetch, update, or delete Joomla data using standard HTTP methods like GET, POST, PUT, and DELETE.

Step 02

Control Exactly What Data Is Exposed

Use SQL-based filters such as WHERE, ORDER BY, and LIMIT to control responses precisely. Fetch only the fields you need from users, articles, custom tables, or Joomla core data.

Step 03

Secure Each API with the Right Authentication

Protect every endpoint using API Key authentication, JWT, Bearer Tokens, Basic Auth, or external authentication providers. Each API can have its own security rules.

What You Can Build with our Custom API Extension

Unlimited Custom REST APIs

Create and manage unlimited REST API endpoints, each with its own path, logic, and security configuration.

Authenticate Joomla Core APIs

Apply JWT and API key authentication to Joomla’s built-in REST APIs, enabling secure, user-based and token-based access beyond Joomla’s default authentication methods.

External API Integrations

Connect Joomla with CRMs, ERPs, marketing tools, and third-party platforms. Trigger API calls from Joomla events for real-time synchronization.

Custom SQL Query Builder

Build custom SQL-based REST APIs for direct database interactions, offering maximum flexibility and performance.

Per-API Authentication Rules

Securely restrict access to your Joomla files, directories, and subfolder based on user login status, group, or custom requirements.

Full CRUD Support

Use GET, POST, PUT, and DELETE methods to enable complete create, read, update, and delete operations.

PHP Script Generator

Auto-generate PHP scripts to call your APIs from forms, buttons, or backend events without manual coding.

Display External API Data in Joomla

Fetch data from any external API and display it on Joomla pages using shortcodes or custom modules.

Compatible with Joomla 6

The Joomla Custom REST API Authentication plugin is compatible with the latest Joomla versions - 3,4,5 & 6.

Authentication methods for Rest APIs

Basic Authentication Method

Basic Authentication allows you to authenticate the Joomla REST API endpoints access using a basic token obtained in an encoded format using the user’s Joomla login credentials or client credentials provided by the plugin.

Setup Guides →

OAuth 2.0 Authentication

It involves the security token generated using the most secure OAuth 2.0 Authentication protocol. The plugin both as an OAuth/Identity Provider to provide a Bearer token (access token/JWT token) on successful validation and an API Authenticator for allowing API access accordingly based on the token validation.

Setup Guides →

JWT Authentication

JWT authentication allows you to authenticate the Joomla REST API endpoint access using a valid JWT token (JSON Web Token). The plugin provides an endpoint to generate a Bearer JWT using the valid user’s Joomla login credentials. The generated token can be used to authenticate the Joomla REST API endpoints.

Setup Guide →

API Key Authentication

API Key Authentication allows you to authenticate the Joomla REST API endpoint access using an API key provided by the plugin. This method eliminates the need for using the user’s Joomla login credentials for generating the Bearer API key (secret token).

Setup Guides →

Securly Connect To All Your Integrations

Our plugin offers the flexibility to integrate the aforementioned plugin through developer hooks or by contacting us for complete end-to-end integration.

Pricing Plans for Everyone

Transparent, Simple Pricing

Extension supports Joomla 3, Joomla 4, Joomla 5 and Joomla 6.

Get in touch with us a joomlasupport@xecurify.com if you have a custom requirement and we can provide a quote for your requirement ensuring 100% satisfaction.

We offer attractive discounts on bulk license purchases and pre-production environment licenses. The more licenses you purchase, the higher the discount you receive. For more details, contact us at joomlasupport@xecurify.com.

Free

$0/Year

Try out the features

Limited Custom API's (endpoints) can be made.
Fetch data from any table.
Fetch operation available with single WHERE condition.
Create limited Custom API endpoints with custom SQL Query
Support for limited External APIs Connection.

Premium

Popular Use Cases for our Custom API Extension

Secure Mobile App Integration with Joomla JWT

Seamless CRM and ERP Synchronization via Joomla API

Internal Admin Tools and Custom Reporting Endpoints

Powering Headless Joomla with JavaScript Frameworks

Enterprise User Data Sync with Identity Providers

Secure Mobile App Integration with Joomla JWT

Enable your native iOS or Android applications to communicate seamlessly with your backend using our Joomla REST API capabilities. By leveraging JWT (JSON Web Token) authentication, users receive time-bound, secure access to content, user profiles, and custom dashboard data, ensuring that access tokens expire and refresh according to your specific security policies. This modern authentication layer provides a high-performance data retrieval experience while protecting sensitive information from unauthorized access, making it the ideal solution for developers building professional mobile experiences powered by Joomla.

Seamless CRM and ERP Synchronization via Joomla API

Streamline your business operations by connecting external systems like Salesforce, HubSpot, or enterprise ERPs directly to your website. Utilizing API Key authentication, our extension allows for a secure, dedicated handshake between Joomla and your third-party software, ensuring that user records and transactional data stay synchronized in real-time. This automated data exchange eliminates manual entry errors and ensures that only authorized external systems can interact with your Joomla custom API endpoints, maintaining a secure and efficient digital ecosystem.

Internal Admin Tools and Custom Reporting Endpoints

Empower your team with specialized management tools and reporting dashboards that pull live data directly from your Joomla database. By implementing Basic Authentication, you can provide secure, streamlined access for internal admin panels in controlled environments. This setup is perfect for management teams needing to generate custom reports or perform bulk data updates via a simplified interface, ensuring that internal administrative tasks are handled efficiently while keeping the primary backend access restricted to authorized personnel only.

Powering Headless Joomla with JavaScript Frameworks

Transform your CMS into a high-performance content engine for decoupled architectures using Headless Joomla strategies. Our extension allows frontend applications built with frameworks like React, Angular, or Vue.js to fetch content dynamically via secure Custom APIs. With JWT authentication baked in, your JavaScript-based frontend can securely handle user-specific data and interactive features, providing the speed and flexibility of a modern development environment while retaining the robust content management power of the Joomla backend.

Enterprise User Data Sync with Identity Providers

Ensure consistent user management across your entire organization by synchronizing profile details, roles, and groups between Joomla and major identity providers like Keycloak, Azure AD, or Okta. By utilizing either JWT or API Key authentication, you can establish a secure bridge for data transfer, ensuring that permissions and user status remain identical across all platforms. This integration is essential for enterprise environments requiring Single Sign-On (SSO) capabilities and automated user provisioning through a secure Joomla API.

Frequently Asked Questions

What is the primary purpose of the Joomla Custom API extension?

The extension allows you to create custom REST API endpoints for your Joomla site without needing to write complex code. It enables external applications, mobile apps, or other websites to communicate with your Joomla site to fetch, create, update, or delete data (CRUD operations) securely.

Do I need advanced coding or SQL knowledge to use this plugin?

No. The plugin features an intuitive Graphical User Interface (GUI) that allows you to build API endpoints through a "point-and-click" method. While advanced users can use the Custom SQL Query Builder for complex logic, most users can define routes, select database tables, and apply filters (like WHERE or LIMIT) directly through the interface.

How does the plugin handle API security and authentication?

Security is a core feature of the extension. You can secure both your custom endpoints and Joomla’s core APIs using several industry-standard methods, including:

JWT (JSON Web Tokens)
API Keys (Universal or User-based)
Bearer Tokens
Basic Authentication (Username/Password)
Role-based Access Control (restricting access based on Joomla user groups)

Can I perform full CRUD operations on my Joomla database?

Yes. The plugin supports all standard HTTP methods: GET, POST, PUT, and DELETE. This means you can not only retrieve data (like articles or user profiles) but also create new records, update existing entries, and remove data from your Joomla database tables through secure API calls.

Which versions of Joomla are supported by the extension?

The miniOrange Custom API extension is highly compatible and supports Joomla 3.x, 4.x, 5.x, and 6.x. It is designed to work seamlessly with the latest Joomla architectural changes.

Where is my data stored, and is it shared with miniOrange?

Privacy is prioritized as the extension is a fully on-premise solution. All data processing happens on your own server, and miniOrange does not store, transfer, or have access to any of your website's data or Personal Identifiable Information (PII). Your API configurations and database remain entirely within your own infrastructure.

Want to Schedule a Demo?

Thank you for your response. We will get back to you soon.

Something went wrong. Please submit your query again