Ghost CMS API Authentication: A Technical Guide (2026)

Authentication overview

The Ghost CMS API provides programmatic access to Ghost installations, enabling developers to build custom frontends, integrate with other services, or automate publishing workflows. To ensure secure and authorized interactions, Ghost implements an API key-based authentication model. This model differentiates between access for public content consumption and administrative actions, preventing unauthorized modifications to a Ghost site's data.

Ghost's API is divided into two main categories, each requiring a specific type of API key for authentication:

• Content API: Designed for fetching public-facing content like posts, pages, authors, and tags. This API is read-only and suitable for use in public applications, custom themes, or client-side JavaScript. Authentication for the Content API typically involves including a Content API key as a query parameter or within the Authorization header.
• Admin API: Intended for administrative tasks such as creating, updating, or deleting content, managing members, configuring site settings, and uploading images. The Admin API requires an Admin API key and is designed for secure, server-side applications or trusted environments. Access to the Admin API is more privileged, requiring a Bearer Token in the Authorization header.

This separation of concerns allows developers to grant appropriate levels of access without exposing sensitive administrative capabilities where only public content retrieval is needed. For detailed information on API endpoints and data structures, refer to the Ghost API reference documentation.

Supported authentication methods

Ghost CMS API primarily relies on API keys for authentication. These keys function similarly to tokens, granting access to specific API functionalities based on their type (Content or Admin). The mechanism for providing these keys differs slightly between the Content and Admin APIs.

API Key Authentication

API key authentication is a common method for securing access to web services. It involves generating unique, secret keys that clients include with their API requests to prove their identity and authorization. Ghost's implementation aligns with this model, requiring API keys for all API interactions.

Content API Key

The Content API key is used to access public content. When making requests to the Content API, this key can be provided in two ways:

• Query Parameter: The Content API key can be appended to the request URL as a query parameter named key. This method is often used for client-side applications where the key might be exposed, as the Content API is read-only.
• Authorization Header: For greater consistency across API types, the Content API key can also be sent in the Authorization header with a Bearer prefix, similar to the Admin API.

The Content API key provides read-only access, meaning it cannot be used to modify, create, or delete content or settings. It is suitable for scenarios where data needs to be publicly displayed, such as in static site generators, mobile applications, or custom themes.

Admin API Key

The Admin API key is used for all administrative operations, including creating, updating, and deleting posts, pages, members, and settings. Due to its privileged access, the Admin API key must always be sent in the Authorization header as a Bearer Token.

• Authorization Header (Bearer Token): The Admin API key is concatenated with a version identifier (e.g., 5e48398eexampled394a:5e48398eexampled394a) to form the Bearer Token. This token is then placed in the Authorization header of every request, prefixed with Bearer. This method ensures that the key is transmitted more securely over HTTPS and is the standard practice for sensitive API access.

The Admin API provides full control over a Ghost instance and should only be used in secure, server-side environments or trusted applications where the key can be kept confidential.

Authentication Method Comparison

The table below summarizes the key characteristics of Ghost's API authentication methods:

Getting your credentials

To interact with the Ghost CMS API, you need to generate API keys from your Ghost administration interface. The process is straightforward and applies to both self-hosted Ghost instances and Ghost Pro (hosted) accounts.

Steps to generate API keys:

1. Log in to your Ghost Admin: Access your Ghost instance's admin panel (e.g., yourdomain.com/ghost).
2. Navigate to Integrations: In the left-hand navigation menu, click on Settings, then select Integrations.
3. Create a new Custom Integration: Scroll down to the "Custom Integrations" section and click the Add custom integration button.
4. Name your integration: Give your integration a descriptive name (e.g., "My Custom Frontend" or "Automated Content Sync"). This helps identify the purpose of the API keys later.
5. Retrieve your API keys: After naming and saving the integration, Ghost will display the generated API keys:
   • Content API Key: This key is used for read-only access to public content.
   • Admin API Key: This key provides full read/write access for administrative operations.
6. Copy and store keys securely: Copy both the Content API Key and the Admin API Key. It is crucial to store these keys securely. The Admin API key, in particular, should be treated with the same level of confidentiality as a password, as it grants extensive control over your Ghost site.

Each custom integration provides a unique pair of Content and Admin API keys. You can create multiple integrations for different applications or services, allowing for granular control and easier key rotation if an API key is compromised.

For additional guidance on managing integrations and API keys, consult the Ghost Integrations documentation.

Authenticated request example

Here are examples demonstrating how to make authenticated requests to both the Ghost Content API and Admin API using curl and a Node.js SDK, showcasing the different authentication mechanisms.

Content API example (fetching posts)

This example retrieves the latest posts using a Content API key. The key is included as a query parameter.

Using curl with query parameter:

curl "https://yourdomain.com/ghost/api/content/posts/?key=YOUR_CONTENT_API_KEY&limit=5"

Using Node.js SDK:

The official Ghost Content API Node.js client library simplifies interaction.

const GhostContentAPI = require('@tryghost/content-api');

const api = new GhostContentAPI({
    url: 'https://yourdomain.com',
    key: 'YOUR_CONTENT_API_KEY',
    version: 'v5.0'
});

api.posts.browse({
    limit: 5
})
.then((posts) => {
    posts.forEach((post) => {
        console.log(post.title);
    });
})
.catch((err) => {
    console.error(err);
});

Admin API example (creating a post)

This example demonstrates how to create a new post using the Admin API. The Admin API key is sent as a Bearer Token in the Authorization header.

Using curl with Bearer Token:

First, combine your Admin API Key components. If your Admin API Key is <id>:<secret>, the Bearer Token will be Bearer <id>:<secret>.

curl -X POST \
  https://yourdomain.com/ghost/api/admin/posts/ \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_ADMIN_API_KEY" \
  -d '{ "posts": [ { "title": "My New API Post", "html": "<p>This post was created via the Admin API.</p>" } ] }'

Using Node.js SDK:

The official Ghost Admin API Node.js client library facilitates administrative tasks.

const GhostAdminAPI = require('@tryghost/admin-api');

const api = new GhostAdminAPI({
    url: 'https://yourdomain.com',
    key: 'YOUR_ADMIN_API_KEY',
    version: 'v5.0'
});

api.posts.add({
    title: 'Another API Post',
    html: '<p>This post was also created programmatically.</p>',
    status: 'published'
})
.then((post) => {
    console.log('Post created:', post.title);
})
.catch((err) => {
    console.error(err);
});

Security best practices

Securing your Ghost CMS API keys is essential to protect your content and administrative functionalities from unauthorized access. Adhering to security best practices helps mitigate risks associated with API key exposure.

1. Keep Admin API Keys Confidential

The Admin API key grants full control over your Ghost site. Treat it as a highly sensitive credential, similar to your admin password. It should never be hardcoded into client-side code, exposed in public repositories, or transmitted insecurely. For server-side applications, store Admin API keys in environment variables or a secure key management service, rather than directly in your codebase. Utilize HTTPS for all API communications to encrypt data in transit, a standard practice for secure web communication as outlined by the Mozilla Developer Network's HTTPS guide.

2. Use Content API Keys for Public Access

Employ Content API keys exclusively for public-facing data retrieval. Since the Content API is read-only, compromising a Content API key poses a lower risk than compromising an Admin API key. Nonetheless, avoid unnecessary exposure and restrict its usage to necessary clients and environments.

3. Environment Variables for Keys

Store API keys as environment variables in your deployment environment (e.g., for Node.js applications, use process.env.GHOST_ADMIN_API_KEY). This practice prevents keys from being committed to version control systems and makes it easier to manage different keys for development, staging, and production environments.

4. Restrict CORS Access

If you're using Ghost in a scenario where it serves content to specific domains (e.g., a custom frontend), configure Cross-Origin Resource Sharing (CORS) settings in your Ghost instance (Settings > Integrations > Custom Integrations) to allow requests only from trusted domains. This prevents unauthorized websites from making requests to your Ghost API, even if they somehow obtain a Content API key.

5. Rotate API Keys Regularly

Periodically rotate your API keys, especially Admin API keys. This involves generating new keys and updating them in all applications that use them. Regular rotation minimizes the impact of a compromised key by limiting the window of opportunity for attackers to exploit it. If you suspect a key has been compromised, revoke it immediately via the Ghost Admin panel and generate a new one.

6. Monitor API Usage

While Ghost itself may not provide extensive built-in API usage monitoring, leverage server-side logging or API gateway solutions (if applicable) to monitor requests to your Ghost API. Unusual patterns or high volumes of requests could indicate a security incident.

7. Use Official SDKs

Whenever possible, use the official Ghost Node.js SDKs for interacting with the API. These SDKs are maintained by the Ghost team and handle authentication complexities securely, reducing the chance of implementation errors that could lead to vulnerabilities. The Ghost JavaScript Client Libraries documentation provides comprehensive details.

8. Implement Least Privilege

Grant only the necessary permissions. If an application only needs to read public content, provide it with a Content API key, not an Admin API key. Avoid over-privileged access to reduce the blast radius in case of a security breach.