Getting Started

Authentication

API key types, how to pass a key, and the permissions a secret key can hold.

API Key Types

TentoCMS uses two types of API keys with different access levels:

Key Type	Prefix	Access	Use Case
Public Key	`tento_pk_*`	Read-only	Client-side apps, mobile apps, frontend frameworks
Secret Key	`tento_sk_*`	Read + write (with permissions)	Server-side integrations, CI/CD pipelines, webhooks

How to Authenticate

Pass your API key using either method:

Header (Recommended)

X-API-Key: tento_pk_abc123...

Query Parameter

GET /api/v1/pages?api_key=tento_pk_abc123...

Security Warning: Never pass secret keys (tento_sk_*) via query parameters. Query parameters are logged in server access logs, CDN logs, browser history, and Referer headers. Always use the X-API-Key header for secret keys. Query parameter authentication is acceptable only for public (read-only) keys.

Permissions (Secret Keys Only)

Public keys are always read-only. Secret keys can be assigned one or more permissions at creation:

Permission	Grants Access To
`content:write`	Create, update, publish, unpublish, delete pages and collection items
`media:write`	Upload media files
`ai:use`	Use AI features (SEO generation, content suggestions)

Error Responses

Public key used for write operation:

{
  "error": {
    "code": "FORBIDDEN",
    "message": "Public keys are read-only. Use a secret key (tento_sk_*) for write operations."
  }
}

Secret key missing required permission:

{
  "error": {
    "code": "FORBIDDEN",
    "message": "This key does not have the 'content:write' permission. Update key permissions or create a new key."
  }
}

Missing or invalid API key:

{
  "error": {
    "code": "UNAUTHORIZED",
    "message": "API key required. Provide via X-API-Key header or api_key query param."
  }
}

Edit this pageorReport an issue

Webhooks

Events emitted by content write operations, payload shape and retry behaviour.

Introduction

What the TentoCMS Public API is, what it can and cannot do, and where to go next.