A headless blog CMS that your code and your AI assistant can both use.

Not a developer? You do not need any of this. The two-line embed and the free blog link work without code.

A project key is shown once, when created, and stored only as a keyed hash. A project key has no write scope to grant by mistake, because the key-based API has no write route. Free allows two live keys per website; paid plans have no key limit.

Some things no connected AI tool can ever do, whatever its owner may do: revoking keys, deleting a website or workspace, changing the plan, or inviting people. Full detail: Authentication.

npm install cmskite

import { createCMSKite } from 'cmskite'

const cms = createCMSKite({ apiKey: process.env.CMSKITE_KEY! })

// The index: a page of published posts (bodies left out of lists).
const { items } = await cms.posts.list({ limit: 10 })

// One post by its address. null rather than a throw when there is none.
const post = await cms.posts.findBySlug(slug)
if (!post) notFound()

// A renamed post still resolves; send the old address to the new one.
if (post.slugRedirectedFrom) redirect(`/blog/${post.slug}`)

Pagination is by cursor, and cms.posts.all() walks every post as an async iterator for sitemaps and static builds. Errors arrive as one CMSKiteError with the status, an error code and a request id. Without the SDK it is plain HTTP with a bearer token:

curl "https://api.cmskite.com/v1/blog/posts?limit=10" \
  -H "Authorization: Bearer csk_live_..."

Start with the Quickstart, then the SDK guide and the API reference.

Add https://api.cmskite.com/mcp to your AI tool — one command in Claude Code or Codex, one entry in a config file for Gemini CLI, Cursor, VS Code or Windsurf, a custom connector in Claude, ChatGPT or Lovable. The tool opens CMSKite in your browser: sign in, choose all your workspaces or one, decide whether it may delete, and press Allow. No key is shown or pasted, and you can disconnect it any time under Settings → Connected apps.

claude mcp add --transport http cmskite https://api.cmskite.com/mcp

codex mcp add cmskite --url https://api.cmskite.com/mcp

{
  "mcpServers": {
    "cmskite": {
      "url": "https://api.cmskite.com/mcp"
    }
  }
}

Then ask in plain words: “Draft a post on monsoon skin care and file it under Skin”. The assistant reads your categories, writes the post and leaves it as a draft unless you asked it to publish. It can also set up a whole site: create the website, write posts, mint the read-only key, and check that views are arriving.

Step-by-step setup for every tool, every grant and the tools behind it: MCP and automation.

Add an endpoint under Website settings → Webhooks and choose events: post.published, post.updated, post.unpublished, post.deleted. Each delivery is a JSON POST, typically used to rebuild a static site the moment a post changes.

• Signed: CMSKite-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256> over <t>.<raw body>. The signing secret is shown once. Reject timestamps older than five minutes.
• A failed delivery is retried. After 20 failures in a row the endpoint is switched off, so a dead URL does not get hammered forever.
• The card shows each endpoint’s last delivery and status. Delivery records are kept for 90 days.

On every paid plan, a website can keep its content in a MongoDB cluster you own and its images in your own bucket: Cloudflare R2, Amazon S3, any S3-compatible store, or Cloudinary. Set it up under Database & storage.

1. 01

   Test

   The connection is checked before it is saved, so a wrong password or a blocked network shows up on screen, not later as a reader’s error.

2. 02

   Migrate

   Existing content is copied across and the counts verified. It can be resumed, and nothing is removed from our side.

3. 03

   Activate

   Reads and writes move to your cluster. Every post keeps its id and slug, so your website notices nothing.

The credentials are encrypted and never shown again. Disconnecting points the website back at our database and deletes nothing from yours, and you can export everything as newline-delimited JSON at any time. What to weigh: your cluster’s location and uptime become the API’s. Reader numbers, usage and the activity log stay with us. Details: Bring your own database.

Requests per second use a token bucket set by your plan, and every response carries RateLimit-Policy and RateLimit headers so a client can slow down before it is refused; a 429 adds Retry-After. Monthly requests are the quota below. Full-text search and the per-endpoint traffic breakdown are on paid plans. See Rate limits and quotas.