Skip to content

Requirements

Your iPhone or iPad

Grafida needs iOS 17 or iPadOS 17 or later. It is one app for both. There is no Mac version of this app; Grafida for the desktop is a separate application.

Your Joomla! site

  • Joomla! 4.0 or later. Grafida talks to Joomla's built-in Web Services (REST) API, which does not exist on Joomla 3.
  • HTTPS, with a certificate your device trusts. Grafida will not connect to a site over plain http://, and will not connect over https:// if the certificate cannot be verified — see HTTPS is required below.
  • Web Services enabled, with at least the content, media, tags and users web-service plugins published. Without them the API exists but has nothing useful to say.
  • An API token for the account you connect with, with the core.login.api permission. This is what actually lets that account authenticate to the API at all — see Connect a Site for exactly where to find and enable it.

HTTPS is required

Grafida connects to your site over HTTPS only, and only when your device can verify the site's TLS certificate — the same standard Safari applies. A plain http:// address is refused outright, as is an https:// address whose certificate is expired, self-signed, issued for a different domain, or served without its intermediate chain. Grafida will not offer to continue anyway, and there is no setting to make it.

That is not caution for its own sake. Your Joomla API token is sent to your site with every request Grafida makes. It never expires on its own, it cannot be limited to just one thing, and it carries the full privileges of the account it belongs to — which, for most people, is a Super User. Anyone able to read your traffic on an insecure connection — a hostile public Wi-Fi hotspot, a compromised router, an intercepting proxy — would capture that token once and keep permanent, unrestricted control of your site, with nothing in Joomla's logs to distinguish them from you. There is no version of that risk worth taking to save a few minutes of setup.

If your site cannot currently offer a valid certificate:

  • A site on the public internet can get one free, automatically renewed, from Let's Encrypt. Almost every hosting control panel has a one-click option for it, and many hosts enable it by default.
  • An intranet or private-network site can use a certificate issued by your organisation's own certificate authority. Your IT department installs that CA on the device with a configuration profile and marks it trusted; from then on Grafida connects to your internal sites normally.
  • A local development site can use a certificate from a local CA installed on the device in the same way.

Note

There is one narrow exception, and it does not apply to your Joomla site. An AI model server on your own hardware may be reached over plain http:// when its address is on this device or your local network — localhost, a private address, or a .local name. See Using a self-hosted model. Your site is always https://, with no exception at all.

The optional AI assistant

Grafida's AI assistant is entirely optional and needs nothing extra to run the rest of the app. Two of its options place their own requirement on the device, and Grafida tells you plainly when either is not met rather than offering something that will not actually work:

  • On-Device (Apple Intelligence) needs iOS 26 or iPadOS 26 or later, and a device Apple Intelligence itself supports. Below that, the option simply does not appear in the provider picker — see AI Services.
  • A downloaded local model needs a device that reports at least 6.5 GiB of memory — in practice an 8 GB-class device; a nominally 6 GB device reports about 5.8 GiB and does not qualify. Where a device does not clear that floor, the Models tab is not shown at all, and nothing else about Grafida changes. An M-series chip (M1 or later) is recommended for acceptable speed — a device with an A-series chip that clears the memory floor is still offered the download, with a plain warning that it will run noticeably slower. See Local Models.

Every other feature of Grafida — writing, editing, publishing, media, App Lock — works identically regardless of which, if either, of these your device supports.

What you do not need

  • Super User access. An ordinary Author or Editor account with core.login.api and the right category permissions works, though a handful of things (reading your site's Unicode Aliases setting, for one) only a Super User's token can see — see Sites.
  • A permanently-online device. Grafida works with no connection for everything except the moment you press Publish.

Note

Grafida stores your API token in the device's own Keychain, never in its database. See Sites for what that does and does not protect you from.