Content APIs your stack can build on.
Clean REST and GraphQL APIs, scoped keys, HMAC-signed webhooks, full OpenAPI docs, and self-hosting. Everything you need to wire content into your app.
Full REST API reference
Authenticate with your API key and start querying content immediately.
1# Base URL
2https://api.cforcms.com/api/v1/{project}
3
4# Authentication
5curl -X GET \
6 'https://api.cforcms.com/api/v1/my-project/blog-posts?filter[status]=published&limit=10' \
7 -H 'X-API-Key: sk_live_a1b2c3d4e5f6' \
8 -H 'Content-Type: application/json'
9
10# Response
11{
12 "data": [...],
13 "meta": {
14 "page": 1,
15 "limit": 10,
16 "total": 42,
17 "totalPages": 5
18 }
19}GraphQL API
Query exactly the data you need with auto-generated schemas.
1query GetPosts($locale: String) {
2 blogPosts(
3 filter: { status: { eq: "published" } }
4 sort: "-publishedAt"
5 limit: 10
6 locale: $locale
7 ) {
8 id
9 title
10 slug
11 publishedAt
12 author {
13 name
14 avatar
15 }
16 }
17}Flexible authentication
Multiple authentication methods for different use cases.
API Keys
Project-scoped keys with an sk_ prefix for server-to-server communication.
Scoped Authorization
Fine-grained scopes for read/write access to each resource type.
JWT Tokens
JSON Web Tokens for Studio access and user authentication.
Google OAuth
Sign in with Google for team member authentication.
API key scopes
Control exactly what each API key can access.
Webhook integration
Subscribe to content events and verify payloads with HMAC signing.
1// Webhook payload example
2{
3 "event": "entry.published",
4 "timestamp": "2025-03-15T10:00:00Z",
5 "project": "my-project",
6 "contentType": "blog-posts",
7 "entry": {
8 "id": "post_8x9kL2",
9 "title": "Getting Started with C for CMS",
10 "status": "published"
11 }
12}1import crypto from 'crypto';
2
3function verifyWebhook(payload: string, signature: string, secret: string): boolean {
4 const expected = crypto
5 .createHmac('sha256', secret)
6 .update(payload)
7 .digest('hex');
8 return crypto.timingSafeEqual(
9 Buffer.from(signature),
10 Buffer.from(expected)
11 );
12}Full OpenAPI 3.0 specification
Interactive API documentation with Swagger UI, available at /api/docs for every project.
Self-host with confidence.
Docker Compose ready. Kubernetes manifests included. Full control over your infrastructure and your data.