AgenCMS

API keys

API keys let your own apps, scripts, and integrations talk to the agencms API on your behalf. This page shows you how to create a key, where to copy it, and how to revoke a key you no longer trust.

Where to find API keys

Go to your account settings at /settings/api. The page is titled API keys and has two parts: a form to create a new key at the top, and a list of your Existing keys below it.

If you have a plan with a key limit, the description shows how many keys you have used and how many remain.

Create an API key

  1. Open Settings and go to the API keys page (/settings/api).
  2. In the Key name field, type a name that tells you where the key will be used, for example "Production API Key".
  3. Select Create key.

Your new key appears in a green box with the message: "Your new API key has been created. Please copy it now as it will not be shown again."

  1. Select Copy to copy the key to your clipboard, then paste it somewhere safe.

The key is shown only once. If you lose it, you cannot view it again. You will need to create a new key and update wherever the old one was used.

Use your key to call the API

Send the key as a Bearer token in the Authorization header of your requests. For example, to confirm the key works, call the current-user endpoint:

curl https://your-domain.example/api/user \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Accept: application/json"

The CMS endpoints live under /api/cms, for example /api/cms/websites to list your websites. For the full list of endpoints and what they return, see the API reference.

See your existing keys

The Existing keys section lists every key you have created. Each row shows:

  • The key name.
  • When it was created.
  • When it was last used, if it has been used at least once.

If you have no keys yet, you will see "No API keys created yet. Create your first key above."

Revoke an API key

Revoke a key as soon as it is no longer needed or you think it may have leaked.

  1. On the API keys page, find the key in the Existing keys list.
  2. Select the trash icon on the right of that row.
  3. In the Delete API key dialog, confirm by selecting Delete key.

Once a key is deleted, any app or script using it can no longer reach the API. This cannot be undone, so update your integrations with a new key first if they still need access.

Plan limits

The number of API keys you can have at once depends on your plan. If you reach the limit, the create form is replaced with a notice: "You have reached your limit of [N] API keys. Upgrade your plan to create more." Select Upgrade plan to move to a plan with a higher limit.

See Plans and subscriptions for details on what each plan includes.

Keep your keys safe

  • Treat a key like a password. Anyone with it can act on your account through the API.
  • Use a separate key for each app or environment so you can revoke one without breaking the others.
  • Store keys in environment variables or a secrets manager, not in code you commit.
  • Revoke and replace a key right away if you suspect it has been exposed.