API Keys

InlineCMS has two kinds of key:

• The publishable key (x-inlinecms-key) shown on every project — safe to embed in client code. The SDK uses it to read published content.
• Secret API keys (icms_sk_…) — for server-to-server access. Use them from your backend to read or write CMS data programmatically. Keep them secret; never ship them in a browser bundle.

This guide covers the secret keys.

Creating a key

In the dashboard, go to Settings → Secret API keys → New key:

1. Give the key a name.
2. Choose its access: Read & write or Read only.
3. Choose its sites: just this site, a chosen set, or every site you administer.
4. Copy the key — it’s shown once. Only its prefix is ever displayed again.

Only a site admin can create keys, and a key can only be scoped to sites you administer. Revoke a key at any time; it stops working immediately.

Using a key

Send the key as a Bearer token:

Authorization: Bearer icms_sk_…

If the key is scoped to more than one site, also send the target site:

x-inlinecms-project-id: <projectId>

A single-site key may omit that header. You can find a site’s project id in the dashboard URL / API responses. A request to a site the key isn’t authorized for is rejected with 403.

Reading data

Any read endpoint that accepts the publishable key also accepts a secret key, scoped to the key’s sites — for example the unified object overlay:

curl https://your-host/v1/objects?types=property \
  -H "Authorization: Bearer icms_sk_…" \
  -H "x-inlinecms-project-id: <projectId>"

Writing object data

A read-write key can push CMS data into objects with one call:

curl -X POST https://your-host/v1/objects/save \
  -H "Authorization: Bearer icms_sk_…" \
  -H "x-inlinecms-project-id: <projectId>" \
  -H "Content-Type: application/json" \
  -d '{
    "status": "published",
    "objects": [
      {
        "type": "property",
        "id": "prop_123",
        "fields": { "title": "Seaside Cottage", "pricePerNight": 240 },
        "collections": {
          "gallery": [ { "itemId": "img1", "value": { "url": "https://…/a.jpg", "type": "image" } } ]
        }
      }
    ]
  }'

• This uses the same schema-by-observation model as the rest of InlineCMS — there’s no schema to declare. Rows upsert by (type, id, fieldPath[, itemId]), so re-sending an object updates it in place.
• Writes are drafts by default. Pass "status": "published" (top-level or per object) to make them live; publishing also fires webhooks and any deploy hooks.
• A read-only key calling this endpoint is rejected with 403.

Pair this with webhooks for a full two-way integration: push data in with a key, and get signed events back out when anything publishes.