***
title: "ApiOptions"
generated: true
---------------
The ApiOptions define how the Vendure GraphQL APIs are exposed, as well as allowing the API layer
to be extended with middleware.
```ts title="Signature"
interface ApiOptions {
hostname?: string;
port: number;
adminApiPath?: string;
shopApiPath?: string;
adminApiPlayground?: boolean | RenderPageOptions;
shopApiPlayground?: boolean | RenderPageOptions;
adminApiDebug?: boolean;
shopApiDebug?: boolean;
shopListQueryLimit?: number;
adminListQueryLimit?: number;
adminApiValidationRules?: Array<(context: ValidationContext) => any>;
shopApiValidationRules?: Array<(context: ValidationContext) => any>;
channelTokenKey?: string;
cors?: boolean | CorsOptions;
middleware?: Middleware[];
trustProxy?: TrustProxyOptions;
apolloServerPlugins?: ApolloServerPlugin[];
introspection?: boolean;
}
```
### hostname
\
Set the hostname of the server. If not set, the server will be available on localhost.
### port
\
Which port the Vendure server should listen on.
### adminApiPath
\
The path to the admin GraphQL API.
### shopApiPath
\
The path to the shop GraphQL API.
### adminApiPlayground
\
The playground config to the admin GraphQL API
[ApolloServer playground](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#constructoroptions-apolloserver).
### shopApiPlayground
\
The playground config to the shop GraphQL API
[ApolloServer playground](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#constructoroptions-apolloserver).
### adminApiDebug
\
The debug config to the admin GraphQL API
[ApolloServer playground](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#constructoroptions-apolloserver).
### shopApiDebug
\
The debug config to the shop GraphQL API
[ApolloServer playground](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#constructoroptions-apolloserver).
### shopListQueryLimit
\
The maximum number of items that may be returned by a query which returns a `PaginatedList` response. In other words,
this is the upper limit of the `take` input option.
### adminListQueryLimit
\
The maximum number of items that may be returned by a query which returns a `PaginatedList` response. In other words,
this is the upper limit of the `take` input option.
### adminApiValidationRules
\ any>`} default={`[]`} />
Custom functions to use as additional validation rules when validating the schema for the admin GraphQL API
[ApolloServer validation rules](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#validationrules).
### shopApiValidationRules
\ any>`} default={`[]`} />
Custom functions to use as additional validation rules when validating the schema for the shop GraphQL API
[ApolloServer validation rules](https://www.apollographql.com/docs/apollo-server/api/apollo-server/#validationrules).
### channelTokenKey
\
The name of the property which contains the token of the
active channel. This property can be included either in
the request header or as a query string.
### cors
\
Set the CORS handling for the server. See the [express CORS docs](https://github.com/expressjs/cors#configuration-options).
### middleware
\Middleware[]`} default={`[]`} />
Custom Express or NestJS middleware for the server. More information can be found in the [Middleware](/current/core/reference/typescript-api/common/middleware#middleware) docs.
### trustProxy
\TrustProxyOptions`} default={`false`} since="3.4.0" />
Set the trust proxy configuration for the server. See the [express proxy docs](https://expressjs.com/en/guide/behind-proxies.html).
### apolloServerPlugins
\
Custom [ApolloServerPlugins](https://www.apollographql.com/docs/apollo-server/integrations/plugins/) which
allow the extension of the Apollo Server, which is the underlying GraphQL server used by Vendure.
Apollo plugins can be used e.g. to perform custom data transformations on incoming operations or outgoing
data.
### introspection
\
Controls whether introspection of the GraphQL APIs is enabled. For production, it is recommended to disable
introspection, since exposing your entire schema can allow an attacker to trivially learn all operations
and much more easily find any potentially exploitable queries.
**Note:** when introspection is disabled, tooling which relies on it for things like autocompletion
will not work.
*Example*
```ts
{
introspection: process.env.NODE_ENV !== 'production'
}
```