Authentication

Every Content API request is authenticated with a workspace API key sent in the X-API-Key header.

Create a key

1. Open Settings → API in your dashboard.
2. Choose Create key and copy the key — it is shown only once.
3. The key must match the ADMIN_API_KEY configured on the server environment.

Send the key

Include the key in the X-API-Key header on every request.

# Get content statistics
curl "https://your-domain.com/api/content/stats" \
  -H "X-API-Key: $CONTENT_HUB_API_KEY"

JWT sessions (dashboard endpoints)

The browser-facing endpoints (/api/auth/*, /api/users/*) authenticate users with JWT bearer tokens issued at login. The Content API itself always uses the X-API-Key header — do not send session tokens to it from server-side integrations.

# Log in and receive a JWT (used by dashboard endpoints)
curl -X POST "https://your-domain.com/api/auth/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"secure123"}'

Security best practices

• Keep keys in environment variables, never in client-side code.
• Use a separate key per integration so you can revoke one without breaking others.
• Rotate keys immediately if one is exposed — old keys stop working at once.

Errors