Connect a Frontend

An API key is the password your website (or app) uses to fetch content from DM Editors. Generate one, lock it down, hand it to your developer.

One key per environment

Best practice: separate keys for separate places. That way if one leaks, you can revoke it without breaking the others.

• Website Production — read-only, broad CORS allowlist.
• Website Staging — read-only, staging origin only.
• Mobile App — read-only, no CORS (apps don't have an origin).
• CI / Static Build — read-only, no CORS, short-lived.
• Admin Sync Tool — read + write, locked to a single IP if possible.

Create a new key

1. Open API Keys Click API Keys in the sidebar, then New key.

   

2. Name the key Use a clear name ("Website Production", "Newsletter Sync"). Future-you needs to know what it does.
3. Pick scopes Tick what this key is allowed to do:
   • Read — fetch content. Almost always yes.
   • Write — create or update entries. Only for trusted automation.
   • Delete — remove entries or media. Only for cleanup scripts.

   

4. Add allowed origins One per line. Example:

   https://yourcompany.com
   https://www.yourcompany.com
   https://*.yourcompany.com

   Use * only if absolutely necessary. For server-side and mobile clients, leave the list empty.
5. Set a rate limit Requests per minute. Default 60 is fine for most websites. Bump it for high-traffic frontends or static builds.
6. (Optional) Pick an expiry date Useful for short-term integrations or seasonal campaigns. The key stops working at that time.
7. Click Create

   

8. Copy the secret immediately It is shown only once. Paste it into your password manager or directly into the developer's deployment secrets.

Share with your developer

Hand them three things, securely:

1. The API URL (e.g. https://cms.yourcompany.com/api/v1).
2. The API key (the public part).
3. The API secret (the one-time string).

Use 1Password, Bitwarden, or another secret manager. Never email these together.

Monitor usage

Open any key from the list to see its activity:

• Last used at + IP.
• Lifetime request count.
• Recent requests (endpoint, status, response time).

Rotate or revoke

• Rotate — when a secret may have leaked. Create a new key with the same scopes, give it to your developer, wait until traffic switches over, then delete the old key.
• Revoke — delete the key from the list. Any client still using it will start getting 401 Unauthorized immediately.
• Pause — flip the active toggle off. Useful for temporary lockdowns. Flip it back on to resume.

Next steps

Want to notify Slack, Zapier, or a custom service when content changes? Set up a webhook.