API tokens and webhooks

Settings → API and webhooks connects sc-cms to other software: a mobile app, a separate frontend, a deploy script, or a service that should hear about new posts. The API reference is at /api/docs on your site.

API tokens

A token lets a program use the API as you, limited to the permissions you pick.

1. Create a token: give it a Name (what it’s for), tick its Permissions, and choose when it Expires (30 days, 90 days, a year, or never).
2. Copy the token now. It’s shown only once.

The list shows when each token was last used. Revoke stops a token immediately; do it straight away if one leaks.

A token never has more power than its creator. If you lose a permission, your tokens lose it too, and if you’re suspended, your tokens stop working. Tokens can’t open the admin or create other tokens.

A token with no permissions can still read published content, which is useful when the Delivery API setting requires a token.

Webhooks

A webhook tells another service when something happens on your site, by sending a signed message to its address.

1. Add a webhook: the URL (must start with https://), an optional description, and the Events:
   • Content published, Content unpublished
   • Media uploaded, Media changed or replaced, Media deleted
2. Copy the signing secret now. The receiving service uses it to check that messages really come from your site (the X-SC-Signature header).

If the other service is down, sc-cms retries for about 15 hours. Recent deliveries shows what was sent and whether it worked. Send test sends a test event; Turn off pauses a webhook without deleting it.

Staging sites record webhooks but never send them.