# Load configuration file from request call (header or subdomain)

**URL:** <https://discourse.laminas.dev/t/load-configuration-file-from-request-call-header-or-subdomain/2526>\
**Category:** API Tools\
**Created:** [September 29, 2021, 7:27pm UTC](https://discourse.laminas.dev/t/load-configuration-file-from-request-call-header-or-subdomain/2526 "2021-09-29T19:27:43Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpoitras](https://yyz2.discourse-cdn.com/flex032/user_avatar/discourse.laminas.dev/jpoitras/32/1142_2.png) [@jpoitras](https://discourse.laminas.dev/u/jpoitras)\
**Post date:** [September 29, 2021, 7:27pm UTC](https://discourse.laminas.dev/t/load-configuration-file-from-request-call-header-or-subdomain/2526/1 "2021-09-29T19:27:43Z")

</div>

Hello all,

I have developed an API with Apigility + Oauth2 for a specific client needs and now he would like to resell the tool to others in his industry (white label).

The api reside on a subdomain such as “[api.theproject.com](http://api.theproject.com)”

I ‘am not quite fixed on how to adapt the project, but my first thought would be:

- Clone databases including oauth2 db for each client
- Avoid duplicating business logic files. All clients will ping the same API
- Each client will have their own subdomain {clientkey}.theproject.com
- Load config file from one or the other
  - Variable in header request
  - Subdomain of the request using $\_SERVER data

I will then produce config file {clientkey}.client.php for each client and their specific data. Load the config file as suggest in here [Advanced Configuration Tricks - tutorials - Laminas Docs](https://docs.laminas.dev/tutorials/advanced-config/)

I will have to adapt all CRON jobs since my client key will not be provided as describe.

Does this make sense?  
Am I missing something concerning best practices or security?

Thank you