Your first proxy

This walkthrough creates a small read-only proxy for Radarr. You will grant one endpoint yourself, make an allowed request, and check that a different read endpoint is blocked.

Before starting, install Middlewarr, sign in, and have the base URL and API key for your Radarr instance ready.

1. Add Radarr as a service

Open Services → New service. Enter:

Field	Value
Base URL	The address Middlewarr can use to reach Radarr, for example http://192.168.1.20:7878
API key	Your Radarr instance’s API key

Include Radarr’s URL base if you configured one, such as http://192.168.1.20:7878/radarr. Do not append /api/v3.

Choose Create. Middlewarr contacts the instance to discover its name and type. If this fails, check the address and credentials before continuing.

Container addresses

Inside the Middlewarr container, localhost refers to Middlewarr itself. To reach a separate container, use its service name on a shared Docker network, or an address reachable from Middlewarr. Merely running two containers on the same host does not put them on a shared Compose network.

2. Create an app

Open Apps → New app and enter:

Field	Value
Name	Read-only demo
Slug	readonly-demo
Template	No template
Active	On

The app represents the client using Middlewarr. Here it is a demonstration client; later, create an app for each real integration.

3. Connect the app to Radarr

Open the app and choose Add proxy. Select your Radarr service and choose Create.

Open the new proxy. It has its own generated API key. Because this app has no template and you have not granted anything yet, its allowlist is empty.

4. Grant one read endpoint

In the proxy’s Endpoints tab, find /api/v3/movie. Enable GET for that exact path and choose Save configuration.

Do not enable every endpoint to make a connection test pass. This example only needs the movie-list endpoint. The permissions guide explains templates, local changes, and how methods are matched.

5. Make an allowed request

Copy the Proxy URL and API key from the proxy’s connection details. Use the address reachable from the machine running the command. The example below assumes the browser and terminal are on the Middlewarr host.

curl --include \
  --header 'X-Api-Key: REPLACE_WITH_PROXY_KEY' \
  'http://localhost:9292/proxy/readonly-demo/api/v3/movie'

Replace REPLACE_WITH_PROXY_KEY with the key from this proxy, not the Radarr API key. Keep real keys out of shared terminal transcripts and screenshots.

With a reachable Radarr instance and a valid upstream key, expect HTTP 200 and a JSON movie list. An empty list, [], is a valid result.

Middlewarr removes /proxy/readonly-demo before forwarding the request and supplies Radarr’s stored key upstream.

6. Verify a blocked request

Without granting another endpoint, try:

curl --include \
  --header 'X-Api-Key: REPLACE_WITH_PROXY_KEY' \
  'http://localhost:9292/proxy/readonly-demo/api/v3/queue'

Expect HTTP 403 because GET /api/v3/queue is outside this proxy’s allowlist. Open Tools → Warnings to inspect the rejection. Both examples use read requests; the blocked request does not need to perform a destructive action to prove the policy works.

A 401 instead points to the slug, key, or active state. A 502 on the allowed request points to upstream connectivity. See Troubleshooting.

Connect a real integration

Create an app for the integration, optionally choose its template, and create a proxy for each service it needs. Review the effective permissions before using it.

In the integration’s service settings, replace the upstream base URL with Middlewarr’s proxy URL and replace the upstream API key with that proxy’s key. The integration should append its normal API paths to the proxy URL. If it has separate host, port, and URL-base fields, put /proxy/YOUR_APP_SLUG in its URL-base field.

Use the integration’s connection test and then exercise the features you need. A connection test may call an endpoint that is not yet allowed; inspect the warning and grant only what is appropriate. You can remove the demonstration app when finished.