Browse documentation
API authentication
Create scoped API credentials and authenticate supported server-to-server requests.
Create an API key
Create credentials from the site integrations area. The secret is shown once. Store it in a server-side secret manager and never include it in browser code, generated pages, or a source repository.
Choose the smallest scope required by the integration. Rotate credentials when ownership changes or whenever exposure is suspected.
Authenticate requests
Send the API key as a bearer token over HTTPS. Requests are evaluated against the credential status, scope, workspace, site, and requested operation.
curl https://app.devassistant.io/api/v1/cms/sites/SITE_ID/collections \
-H "Authorization: Bearer $DEVASSISTANT_API_KEY" \
-H "Accept: application/json"Handle errors
Treat authentication and authorization failures as terminal until credentials or scopes are corrected. Retry rate limits and temporary service failures with bounded exponential backoff.
Use idempotency keys when a supported mutation may be retried. Log request identifiers, but never log bearer tokens or sensitive response content.
Server-side use only
API keys identify a trusted integration. For browser or delegated user access, use a purpose-built user authorization flow instead.
Still need help?
Find recovery guidance or contact the DevAssistant team.