How do I generate an API token for headless or developer access?

To generate an API token in VeloCMS, go to Admin → Settings → Advanced → API Keys, click New key, choose the permission scopes your integration needs, and click Create API key. Copy the token immediately — it's shown only once.

What permission scopes should I select for my token?

Always select the minimum scopes your integration actually needs — this limits the damage if the token is ever compromised. If your external site just needs to display posts, use 'Read posts' only. If you're running a migration script that needs to create posts, use 'Write posts'. If your integration needs to look at your member list, add 'Read members (anonymized)' — member details come back anonymized. The available scopes are: Read posts, Write posts, Read media, Upload media, Read comments, Write comments, Read members (anonymized), Create/update members, Read site settings, Read webhook subscriptions, and Manage webhook subscriptions (Zapier / Make). Site settings are read-only for tokens, so a token can never change your domain, theme, or billing configuration. Grant 'Create/update members' and 'Manage webhook subscriptions' sparingly, since they let an integration change your member list or the endpoints your events are sent to.

How do I use the token in an API request?

Include the token in the HTTP Authorization header as a Bearer token, and call the /api/v1 endpoints on your blog's own address. In JavaScript or TypeScript that looks like: fetch('https://yourblog.com/api/v1/posts', { headers: { 'Authorization': 'Bearer your-token-here' } }). In curl it's: curl -H 'Authorization: Bearer your-token-here' https://yourblog.com/api/v1/posts. For most REST clients (Postman, Insomnia, HTTPie), there's a dedicated Authorization tab where you select Bearer Token and paste your value.

What happens if I lose the token after closing the modal?

VeloCMS stores a one-way hash of the token, not the token itself — it's designed this way so even a database breach doesn't expose your tokens. This means if you close the modal without copying the token, it's gone and can't be recovered. The only option is to delete the old token and create a new one. This takes about 30 seconds and doesn't affect other active tokens. It's a good habit to immediately paste a newly generated token into your application's environment variables or secrets manager before closing the VeloCMS modal.

How do I revoke or rotate a token?

Open Admin → Settings → Advanced → API Keys. Each key appears as a row with its name, scopes, last-used date, and a Delete key (trash can) button. Delete a key to instantly invalidate it — any API requests using it will start returning 401 Unauthorized immediately. To rotate a token (replace with a new one while minimizing downtime), create the new token first, update your integration to use the new token, verify the integration works, then revoke the old one. This zero-downtime rotation pattern avoids the brief gap that would occur if you revoked the old token before the new one was in place.