Flexweg account setup

Flexweg is the static hosting service that holds both your public site (visitors browse this) and your admin SPA (you log in here). The CMS interacts with Flexweg through its Files API — every publish, every theme sync, every plugin/theme install pushes files via this API.

This page walks through the Flexweg-side configuration: getting an API key, allowing the right file extensions, and noting your site URL.

Prerequisites

You need:

• A Flexweg account with at least one site provisioned. If you don't have one, sign up at flexweg.com.
• Access to the API tab in your Flexweg dashboard (typically all admin accounts have this).

Generate a permanent API key

The API key authorises every file upload / delete the admin makes on your behalf.

1. Open your Flexweg dashboard.
2. Navigate to Account → API (top right menu).
3. Click Generate permanent API key (or similar button — the exact wording may vary).
4. Copy the key and store it securely — you'll paste it in the first-run setup form. You can also re-generate later if compromised.

Keep this key private

Anyone with this key can upload, modify and delete files on your Flexweg site. The key is stored in your Firestore (encrypted at rest by Google) — but since any admin / editor in your Firebase project can read it, only grant editor access to people you trust.

For a multi-tenant scenario (clients, freelancers), use temporary keys (generated per session via Flexweg's /api/keys/generate-temp). The CMS doesn't currently surface this UI, but you can rotate the permanent key periodically.

Note your URLs

You'll need three URLs in the setup form:

Field	Where to find it
Site URL	Your Flexweg site's public URL — e.g. https://mysite.flexweg.com or https://www.yourdomain.com if you've set up a custom domain. No trailing slash.
API base URL	https://www.flexweg.com/api/v1 for the standard Flexweg endpoint. The setup form pre-fills this; only change it if Flexweg has provisioned you a different region or staging environment.
Admin URL	https://<your-site-url>/admin/ — where the admin SPA will live after you upload dist/admin/ there. Not entered in the form; it's just where you point your browser.

Configure allowed file extensions

Flexweg accounts have a per-account allowlist of file extensions that can be uploaded via the Files API. The default list covers most static-site needs but may exclude a few extensions the CMS uses.

1. Open Settings → Allowed extensions in your Flexweg dashboard.
2. Make sure ALL of these are present:

html, js, css, json, xml, txt, md, svg, png, jpg, jpeg, webp, gif, ico, woff, woff2

Optional but recommended:

ttf, otf  ← additional font formats some external themes use

If any are missing, the admin will fail to upload certain files (you'll see the error in the publish log or as a toast). The most common culprits:

Missing extension	What breaks
json	external.json upload, menu.json, posts.json (search index)
js	Theme runtime loaders, plugin bundles
md	Plugin / theme README files inside upload ZIPs
svg	Some plugin/theme icons, hand-drawn assets
webp	Auto-generated image variants (the default media format)
ico	Generated favicons
xml	Sitemaps, RSS feeds
woff, woff2	Custom theme fonts

Site quotas — what to expect

Flexweg plans typically include a fixed file count + total storage. The CMS produces a manageable number of files per site:

Component	Typical count
Admin SPA	~20-30 files (HTML, JS, CSS, assets)
Per-plugin bundles	2 files per plugin (bundle.js + manifest.json)
Per-theme bundles	3 files per theme (bundle.js + manifest.json + theme.css)
Theme assets (public CSS)	1 file per theme (/theme-assets/<id>.css)
Theme JS loaders	0-2 per theme (-menu.js, -posts.js)
Per-post HTML	1 file per published post
Per-category archive	1 file per category
Per-image variants	4-7 files per uploaded image (theme depends)
Misc generated	sitemap-*.xml, rss.xml, menu.json, posts.json, search-index.json, robots.txt, 404.html, favicon files

Storage is mostly images. A typical 100-post blog with 200 images uses ~50-200 MB depending on image sizes. Text content is negligible. The admin SPA itself is ~5 MB on disk (cached aggressively by browsers).

The flexweg-metrics plugin (must-use, always-on) shows a live storage usage card on the dashboard so you know when you're approaching limits.

CORS and security headers

Flexweg serves files with sensible defaults — no extra CORS configuration needed for the public site. The admin's external bundle loader uses same-origin imports (/admin/plugins/<id>/bundle.js) so no cross-origin issues.

If you've put Cloudflare or another CDN in front of your Flexweg site, make sure:

• It doesn't add caching headers that would conflict with the admin's ?_t=<timestamp> cache-busting on config.js and external.json-equivalents
• It doesn't strip the Cache-Control: no-store instructions from JSON file requests

Continue

• First-run setup form — combine Firebase + Flexweg credentials in the in-admin wizard
• Deployment — upload dist/admin/ and dist/theme-assets/