Skip to main content

Issue an API key

In the site’s CMS, open API Keys and create a key. Give it only the scopes your app needs, and pick its signing mode:
  • Token only: the key alone authenticates. Use this to try calls in the API reference’s playground.
  • Signed writes or every request signed: the key also has a signing secret (fss_…). The SDKs sign each request for you; to sign by hand, see Signing requests.
The site shows the key once: fsk_<site>_<key id>_<secret>. Keep it in your app’s secrets, never in its code.
Reading the public content types needs no key at all. Leave the key out and the site answers as it does the public. Authentication → “What a key reaches today” lists what a key adds.

Install an SDK and point it at the site

The key you just made also installs the SDK from your site.
Your own site serves the SDK, and any API key from it lets you in. In a terminal, in your Laravel app’s folder, run:
Terminal
The first line tells Composer the SDK comes from your site (it’s saved in composer.json). The second saves your key in the app’s auth.json. The third installs the SDK, and the API client it uses, from your site. Put your site’s address in the first two lines (set your site in the bar under this page’s title and the example shows it), and paste your whole key in place of fsk_acme_….
Any API key from your site works, the same one your app uses included: its scopes and signing mode don’t matter for installing, only that it’s switched on and not past its expiry date. No key yet? Make one in the CMS under API Keys (Authentication).
auth.json holds a key to your site: never commit it. A Laravel app’s .gitignore already lists /auth.json; keep that line there (add it if yours doesn’t have it). In CI, write the same auth.json from a secret before installing.
401 Unauthorized? Your site refused the key in auth.json: it’s mistyped or cut short, switched off, or past its expiry date. Run the second line again with the right key.
Then point the SDK at the site:
Terminal
It asks for the site’s slug, URL, key and signing secret, writes them to .env, and checks the site answers.

Make your first call

Nothing to catch: the SDKs sign, retry what is safe, and check every answer against its type before your code sees it.

Next steps

Laravel SDK

The facade, fakes and Action scaffolding.

TypeScript SDK

One client, typed models, fakeSite().

Authentication

Scopes, signing and rate limits.