Delivery and API keys
Delivery allows a website or application to read CMS content. API Explorer helps inspect requests and responses. It is separate from Content Manager's editing interface.
Create a credential
- Sign in as an administrator, open API Keys, and create a key.
- Enter a descriptive name and choose Published or Preview access.
- Set the Content type scope, optional Entry ID scope, and expiry.
- Create it and copy the secret immediately into the consuming application's secure configuration.
The full secret cannot be shown again. Database key records contain hashes, so restoring a backup cannot recover the plaintext secret. Keep application credentials in a separate secrets store.
| Setting | Meaning |
|---|---|
| Published | Read currently published content |
| Preview | Read preview content, potentially including unpublished work |
| All content types | Includes current and future types |
| Specific content types | Restricts the credential to selected types |
| Entry ID scope | Further restricts access to an entry |
Treat preview keys as private credentials. Keep scope and expiry appropriate to the consumer. Key creation and management are subject to your account's server-enforced permissions.
Inspect delivery
Open API Explorer, select the target content, language, and query options, and inspect the generated request and JSON response. Use the appropriate delivery credential when required. Built-in API documentation is available at /api/v1/delivery/docs on the CMS host.
Confirm published delivery shows live revisions, not merely saved drafts. Check language selection and permissions if content is absent. A website's cache may delay visible changes after a successful CMS publication.
Rotate or revoke
Use Rotate to replace a key, copy its new secret, and update consumers promptly. Use Revoke or bulk revocation to end access. Check active, expired, and revoked filters when locating credentials. Do not assume rotation provides an overlap period for the old secret.