Skip to content

Requirements

Your phone or tablet

Grafida runs on Android, and needs nothing beyond a reasonably current Android System WebView, which Google updates through the Play Store independently of the operating system itself. Grafida has been run on the WebView versions shipping with Android 13 and later; a device whose WebView has not been updated for several years may draw the editor incorrectly.

Your Joomla! site

  • Joomla! 4.0 or later. Grafida talks to Joomla's built-in Web Services (REST) API, which does not exist on Joomla 3.
  • HTTPS, with a certificate your system already trusts. Grafida will not connect over plain http://, and will not connect over https:// if the certificate cannot be verified — see HTTPS is required below.
  • Web Services enabled, with at least the Content, Media, Tags and Users web-service plugins published. Without them the API exists but has nothing useful to say. Two more are optional: Templates lets Grafida find your template's editor stylesheet, and Configuration lets it read your site's Unicode Aliases setting. Grafida manages without either — see Sites for the fields that stand in.
  • An API token for the account you connect with, and that account needs the core.login.api permission. That permission is what lets the account authenticate to the API at all. See Connect a Site for where the token comes from.

HTTPS is required

Grafida connects to your site over HTTPS only, and only when your system can verify the site's certificate — the same standard your browser applies. A plain http:// address is refused outright, as is an https:// address whose certificate has expired, is self-signed, was issued for a different domain, or is served without its intermediate chain. Grafida will not offer to continue anyway, and there is no setting that makes it.

That is not caution for its own sake. Your Joomla API token is sent to your site with every request Grafida makes. It never expires on its own, it cannot be narrowed to one task, and it carries the full privileges of the account it belongs to — which, for most people, is a Super User. Anyone able to read your traffic on an insecure connection — a hostile public Wi-Fi hotspot, a compromised router, an intercepting proxy — would capture that token once and keep permanent, unrestricted control of your site, with nothing in Joomla's logs to tell them apart from you.

Important

There is no exception, not even for localhost. A development site on your own machine is reached across a virtual-machine boundary, a port forward, a container bridge or an SSH tunnel more often than not, and none of those is the same thing as "my own machine".

If your site cannot currently offer a valid certificate:

  • A site on the public internet can get one free, and automatically renewed, from Let's Encrypt. Almost every hosting control panel has a one-click option for it, and many hosts enable it by default.
  • An intranet or private-network site can use a certificate issued by your organisation's own certificate authority, provided that authority is installed and trusted in Android's own trusted-credentials store on the device you run Grafida on.
  • A local development site can use a certificate from a local authority installed the same way.

Where your API token is kept

Grafida stores the token in the Android Keystore, never in its database.

Note

Grafida never writes an API token to a file. If you would rather it did not keep one at all, use Remove stored token on the site's own form — see Sites.

What you do not need

  • Super User access. An ordinary Author or Editor account with core.login.api and the right category permissions works. A few things only a more privileged token can read — your site's Unicode Aliases setting, and the list of template styles Grafida uses to find editor.css — and Sites explains what to do in each case.
  • A permanent connection. Everything except publishing works offline.