API key access
When you create an API key, you choose its access. A key can read, write drafts, or also publish. A key can never do more than the person who made it.
The three levels
| Choice in the dashboard | Scopes | Can |
|---|---|---|
| Read published posts | blog:read | Read published content |
| Read and write drafts | blog:read, blog:write | Create and edit posts, categories, tags and authors, and delete them. It cannot publish, and it cannot change a post that is already live or scheduled |
| Read, write and publish | blog:read, blog:write, blog:publish | Everything above, and put posts live |
Write routes also need a plan that includes writing posts.
Create a key
Open Developers → API keys and choose Create key. Enter a Key name and pick the Access.
You can make a key only if you could do the same thing yourself. To make a write key you need permission to write content. To make a publish key you need permission to publish.
CMSKite shows the full key once. Copy it then. See Authentication for the format.
Keep write keys on a server
Send it in the Authorization header. A write key sent in a URL is refused.
Roll and revoke
Roll makes a new key. The old one keeps working for the time you pick: Not at all, 1 hour, 1 day, 3 days or 7 days. This lets you switch with no downtime.
Revoke stops a key at once. You cannot undo it.
The key list shows each key’s name, created date, last used date and status: Active, Expired or Revoked.
See also
To read posts, see Posts. To get called when something changes, use webhooks.