Authentication

The credentials used by Copper CMS.

Delivery key

A delivery key reads articles from the site it was issued for. Send it as a bearer token.

GET https://api.coppercms.com/v1/wire/posts
authorization: Bearer ck_a41f9c2e77b1.8f2c…c1a9.k3Rd…

A key has parts split by dots. Only the last part is secret. The earlier parts let the API find the account.

Keys are issued on the Delivery keys screen. A key is displayed when it is issued and never again. Revoking a key takes effect immediately.

Keep the key on a server. A key in a browser bundle is public.

Ingest webhook url

An ingest webhook url lets a partner post articles in. The url is the credential. There is no key to send and no signature to build.

POST https://api.coppercms.com/v1/hook/8f2c…c1a9.k3Rd…

Treat the url as a password. It appears in server logs and proxy logs.

The url can be read again on the source page.

Rotating replaces the url immediately. A partner still posting to the old url gets a 401.

Webhook signing secret

A signing secret proves an outbound webhook came from Copper CMS. It is displayed when the endpoint is created and never again. It starts with whsec_.

The secret signs. It does not authorise. It cannot read anything.

See Outbound webhooks for checking a signature.

When a credential fails

Missing and unknown and revoked and malformed all get the same answer.

401 Unauthorized

{ "error": "unauthorized" }

They are not told apart.