diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4a0b1aa..f9790b6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,13 +10,27 @@
   - Enable `mod_deflate` compression for HTML, plain text, CSS, JS and JSON  
   - Configure `mod_expires` caching for images (1 month), CSS (1 week) and JS (3 hour)  
   - Deny access to hidden files (dot-files)
-- Add access control in public/.htaccess for api.html & openapi.json; update Nginx example in wiki
+~~- Add access control in public/.htaccess for api.html & openapi.json; update Nginx example in wiki~~
 - Remove obsolete folders from repo root
-- Embed API documentation (`api.html`) directly in the FileRise UI as a full-screen modal  
+- Embed API documentation (`api.php`) directly in the FileRise UI as a full-screen modal  
   - Introduced `openApiModalBtn` in the user panel to launch the API modal  
-  - Added `#apiModal` container with a same-origin `<iframe src="api.html">` so session cookies authenticate automatically  
+  - Added `#apiModal` container with a same-origin `<iframe src="api.php">` so session cookies authenticate automatically  
   - Close control uses the existing `.editor-close-btn` for consistent styling and hover effects
 
+- public/api.html has been replaced by the new api.php wrapper
+- **`public/api.php`**  
+  - Single PHP endpoint for both UI and spec  
+  - Enforces `$_SESSION['authenticated']`  
+  - Renders the Redoc API docs when accessed normally  
+  - Streams the JSON spec from `openapi.json.dist` when called as `api.php?spec=1`  
+  - Redirects unauthenticated users to `index.html?redirect=/api.php`
+- **Moved** `public/openapi.json` → `openapi.json.dist` (moved outside of `public/`) to prevent direct static access  
+- **Dockerfile**: enabled required Apache modules for rewrite, security headers, proxying, caching and compression:
+
+  ```dockerfile
+  RUN a2enmod rewrite headers proxy proxy_fcgi expires deflate
+  ```
+
 ## Changes 4/23/2025 1.2.4
 
 **AuthModel**  
diff --git a/Dockerfile b/Dockerfile
index 07dbf20..ab08658 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -126,7 +126,7 @@ RUN cat <<'EOF' > /etc/apache2/sites-available/000-default.conf
 EOF
 
 # Enable required modules
-RUN a2enmod rewrite headers
+RUN a2enmod rewrite headers proxy proxy_fcgi expires deflate
 
 EXPOSE 80 443
 COPY start.sh /usr/local/bin/start.sh
diff --git a/public/openapi.json b/openapi.json.dist
similarity index 100%
rename from public/openapi.json
rename to openapi.json.dist
diff --git a/public/.htaccess b/public/.htaccess
index 41825cb..dd58d5e 100644
--- a/public/.htaccess
+++ b/public/.htaccess
@@ -15,10 +15,6 @@ DirectoryIndex index.html
   Require all denied
 </FilesMatch>
 
-<FilesMatch "^(api\.html|openapi\.json)$">
-  Require valid-user
-</FilesMatch>
-
 # -----------------------------
 # Enforce HTTPS (optional)
 # -----------------------------
diff --git a/public/api.html b/public/api.html
deleted file mode 100644
index 4299a63..0000000
--- a/public/api.html
+++ /dev/null
@@ -1,20 +0,0 @@
-<!-- public/api.html -->
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="utf-8"/>
-  <meta name="viewport" content="width=device-width, initial-scale=1"/>
-  <title>FileRise API Docs</title>
-  <script src="https://cdn.redoc.ly/redoc/latest/bundles/redoc.standalone.js" integrity="sha384-4vOjrBu7SuDWXcAw1qFznVLA/sKL+0l4nn+J1HY8w7cpa6twQEYuh4b0Cwuo7CyX" crossorigin="anonymous"></script>
-</head>
-<body>
-  <redoc spec-url="openapi.json"></redoc>
-  <div id="redoc-container"></div>
-  <script>
-    // If the <redoc> tag didn’t render, fall back to init()
-    if (!customElements.get('redoc')) {
-      Redoc.init('openapi.json', {}, document.getElementById('redoc-container'));
-    }
-  </script>
-</body>
-</html>
\ No newline at end of file
diff --git a/public/api.php b/public/api.php
new file mode 100644
index 0000000..1d885a8
--- /dev/null
+++ b/public/api.php
@@ -0,0 +1,35 @@
+<?php
+// public/api.php
+require_once __DIR__ . '/../config/config.php'; 
+
+if (empty($_SESSION['authenticated'])) {
+  header('Location: /index.html?redirect=/api.php');
+  exit;
+}
+
+if (isset($_GET['spec'])) {
+  header('Content-Type: application/json');
+  readfile(__DIR__ . '/../openapi.json.dist');
+  exit;
+}
+
+?><!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8"/>
+  <meta name="viewport" content="width=device-width, initial-scale=1"/>
+  <title>FileRise API Docs</title>
+  <script src="https://cdn.redoc.ly/redoc/latest/bundles/redoc.standalone.js"
+          integrity="sha384-4vOjrBu7SuDWXcAw1qFznVLA/sKL+0l4nn+J1HY8w7cpa6twQEYuh4b0Cwuo7CyX"
+          crossorigin="anonymous"></script>
+</head>
+<body>
+  <redoc spec-url="api.php?spec=1"></redoc>
+  <div id="redoc-container"></div>
+  <script>
+    if (!customElements.get('redoc')) {
+      Redoc.init('api.php?spec=1', {}, document.getElementById('redoc-container'));
+    }
+  </script>
+</body>
+</html>
\ No newline at end of file
diff --git a/public/js/authModals.js b/public/js/authModals.js
index 86129dc..1b3984c 100644
--- a/public/js/authModals.js
+++ b/public/js/authModals.js
@@ -245,12 +245,15 @@ export function openUserPanel() {
   background: rgba(0,0,0,0.8); z-index: 4000; display:none;
   align-items: center; justify-content: center;
 `;
+
+// api.php
 apiModal.innerHTML = `
   <div style="position:relative; width:90vw; height:90vh; background:#fff; border-radius:8px; overflow:hidden;">
     <div class="editor-close-btn" id="closeApiModal">&times;</div>
-    <iframe src="api.html" style="width:100%;height:100%;border:none;"></iframe>
+    <iframe src="api.php" style="width:100%;height:100%;border:none;"></iframe>
   </div>
 `;
+
     document.body.appendChild(apiModal);
 
     document.getElementById("openApiModalBtn").addEventListener("click", () => {
