Skip to main content
As mentioned in the Local Server Applications documentation the Core server runs by default on port 3002 allowing remote access over the LAN by all NIC’s via host 0.0.0.0 The Advanced Core Settings do allow you to set custom ports and hostnames to have more gradual control over the Core API network access. Check out all the required steps to access the API over HTTPS via the advanced local installation steps:

​
Base URLs

Replace 3002 when you set a custom port in the Advanced Core Settings. The TCP and OSC ports are set under Studio settings → Core API → TCP and OSC, see TCP and OSC. See Routes and Legacy routes.

​
Authentication

Most endpoints of the Local API are secured with authentication. Who may call the API is set per studio in VRA Cloud under Studio settings → Core API:
  • Device tokens: each Stream Deck, Companion instance, panel or script gets its own token.
  • Access without a token: off, listed addresses, or the whole LAN.
  • Legacy authorization: the shared EXTERNAL_APP header below, on by default. It opens the legacy /api/... routes only, not /api/v2.
Calls from the Core machine itself need no authentication. See Authentication and LAN access for the details.

​
Legacy authorization

Click on the Generate Authorization button in the Cloud Core Settings to generate a username and password for accessing the API. The username is EXTERNAL_APP, the password is the base64 of the Core’s server id. The authentication method is “Basic Authentication” and you authorize yourself with the Authorization header:
The button also shows this full header, ready to copy. It works while Allow legacy authorization is on in Studio settings → Core API, and only on the legacy routes: a /api/v2 route answers 403 forbidden to it. Use a device token for new devices.