API keys
Websites and apps use API keys to read content from Headra.
| Key | Starts with | Can | Use it in |
|---|---|---|---|
| Public | hcms_pub_ | Read published content only. | The website's JavaScript. Safe to be seen. |
| Private | hcms_prv_ | Everything an account admin can do, including drafts and writing. | Server-side code and build tools only. |
| Personal | hcms_usr_ | What you yourself are allowed to do. | Your own scripts and integrations. |
Creating a key
- Choose the website, then go to API keys.
- Pick the kind and give it a name you'll recognise, e.g. "Main website".
- Copy the key straight away. It's shown once and can't be retrieved later. If it's lost, create a new one.
Keeping keys safe
- Never put a private or personal key in website code, emails or chat. Headra refuses them in web addresses.
- Revoke a key you no longer need, or one that may have leaked. It stops working immediately.
- Requests with keys count towards the monthly API allowance in your package. Page-view tracking doesn't count.