Ghost Authentication: API Keys & OAuth (2026)

Authentication overview

Ghost provides distinct authentication mechanisms tailored for different use cases when interacting with its APIs. The platform offers two primary APIs: the Admin API, for managing content, members, and settings; and the Content API, for fetching published content to integrate with custom frontends or applications. Each API has specific authentication requirements designed to ensure data security and appropriate access levels.

For programmatic access, such as integrating Ghost with other services or building custom tools, API keys are the primary method. These keys grant specific permissions and are generated within the Ghost Admin interface. The Admin API requires a specific type of API key that grants broader permissions, while the Content API uses a public key that allows read-only access to published data.

For applications requiring user consent and delegated access, such as third-party integrations that operate on behalf of a Ghost user, Ghost supports OAuth 2.0. This standard allows applications to obtain limited access to a user's account without requiring their credentials, using a secure authorization flow. Understanding the appropriate authentication method for your specific integration is crucial for maintaining security and functionality.

Supported authentication methods

Ghost supports the following authentication methods for its APIs:

API Keys (Admin): These keys are generated with specific content and admin client types and include an ID and a Secret. They are used to sign requests to the Admin API, allowing full CRUD (Create, Read, Update, Delete) operations on posts, pages, members, and other administrative data. The Admin API key also allows access to the Content API. Requests are signed using HMAC-SHA256, where the secret is used to create a signature of the request payload, ensuring the integrity and authenticity of the request. Details on Admin API key authentication are available in the Ghost Admin API documentation.

API Keys (Content): These keys are designed for read-only access to published content. They consist of a public API key (often referred to as a "Content API Key") that is included directly in the request URL or headers. Since these keys only grant access to public content, they are suitable for client-side applications or static site builds where the key might be exposed. The Ghost Content API documentation outlines its usage.

OAuth 2.0: Ghost supports OAuth 2.0 for third-party applications that need to interact with a user's Ghost instance securely and with their explicit permission. This flow involves an authorization server, resource owner, client application, and resource server. The client application requests authorization from the user, who then grants or denies access. Upon approval, the application receives an access token, which it uses to make authenticated requests to the Ghost APIs. This method is standard for delegated authorization and is detailed in the OAuth 2.0 specification.

Getting your credentials

The process for obtaining authentication credentials for Ghost involves accessing your Ghost Admin panel:

1. Log in to Ghost Admin: Access your Ghost instance's admin interface (e.g., yourdomain.com/ghost).
2. Navigate to Integrations: In the sidebar menu, click on "Settings" and then "Integrations."
3. Create a Custom Integration: Click on "Add custom integration" to generate new API keys.

For Admin API Keys:

When creating a custom integration, Ghost automatically generates an Admin API Key (labeled "Admin API Key"). This key consists of an ID and a Secret. The Secret is displayed only once upon creation, so it's critical to copy and store it securely immediately. This key allows full access to the Admin API functionalities, including managing posts, pages, members, and other site settings. It also provides access to the Content API.

For Content API Keys:

Within the same "Integrations" section, for any custom integration you create, Ghost provides a "Content API Key." This key is visible at all times and is used for read-only access to public content. You only need to copy this key directly.

For OAuth 2.0 Credentials:

To use OAuth 2.0 with Ghost, you typically need to register your application as an "internal integration" or "custom integration" within your Ghost instance, configuring redirect URIs and obtaining a Client ID and Client Secret. The specifics of setting up OAuth 2.0 for third-party applications or custom integrations are generally handled through the Ghost Admin panel under "Integrations" or by consulting the specific Ghost OAuth documentation.

Authenticated request example

Here's an example of how to make an authenticated request to the Ghost Admin API using an Admin API Key with Node.js. This example demonstrates fetching posts using the @tryghost/admin-api client library, which handles the HMAC signing automatically.

const GhostAdminAPI = require('@tryghost/admin-api');

// Initialize the Ghost Admin API client
const api = new GhostAdminAPI({
    url: 'https://your-ghost-blog.com',
    key: 'YOUR_ADMIN_API_KEY_ID:YOUR_ADMIN_API_KEY_SECRET', // Format: API Key ID:API Key Secret
    version: 'v5.0' // Or your specific API version
});

async function fetchPosts() {
    try {
        const posts = await api.posts.browse({
            limit: 'all',
            fields: 'id,title,slug,status'
        });
        console.log('Fetched posts:', posts);
    } catch (error) {
        console.error('Error fetching posts:', error);
    }
}

fetchPosts();

For Content API requests, the API key is passed directly, often as a query parameter:

const fetch = require('node-fetch');

const ghostUrl = 'https://your-ghost-blog.com';
const contentApiKey = 'YOUR_CONTENT_API_KEY';

async function fetchPublicPosts() {
    try {
        const response = await fetch(`${ghostUrl}/ghost/api/content/v5/posts/?key=${contentApiKey}&fields=id,title,slug`);
        if (!response.ok) {
            throw new Error(`HTTP error! status: ${response.status}`);
        }
        const data = await response.json();
        console.log('Fetched public posts:', data.posts);
    } catch (error) {
        console.error('Error fetching public posts:', error);
    }
}

fetchPublicPosts();

Security best practices

Adhering to security best practices is essential when handling Ghost authentication credentials:

• Secure Storage of Admin API Keys: Admin API Keys, especially their secrets, must never be exposed publicly. Store them in environment variables, secure configuration management systems, or secrets managers (e.g., AWS Secrets Manager, Google Cloud Secret Manager, or Azure Key Vault). Avoid hardcoding them directly into your codebase.
• Restrict Access to Admin Interface: Limit access to your Ghost Admin panel to authorized personnel only. Use strong, unique passwords and consider enabling two-factor authentication (2FA) if available for your Ghost instance or hosting provider.
• Use Specific API Keys: Generate separate API keys for different applications or services. This allows for granular revocation if a key is compromised without affecting other integrations.
• Rotate Admin API Keys Regularly: Periodically rotate your Admin API Keys. This practice minimizes the window of exposure if a key is compromised.
• Encrypt Data in Transit: Always use HTTPS for all communications with Ghost APIs. This ensures that API keys and other sensitive data are encrypted during transmission, protecting against eavesdropping.
• Audit Logs: Regularly review access logs for your Ghost instance to detect any unauthorized or suspicious activity.
• Understand OAuth Scopes: When using OAuth 2.0, request only the minimum necessary scopes (permissions) that your application requires. This limits the potential damage if your application's access token is compromised.
• Secure Redirect URIs for OAuth: For OAuth 2.0, ensure your redirect URIs are strictly controlled and only allow redirects to trusted, secure endpoints.
• Handle Tokens Securely: If implementing OAuth 2.0, securely store access tokens and refresh tokens. Access tokens have a limited lifespan, and refresh tokens should be stored with the same care as API keys.
• Keep Software Updated: Ensure your Ghost instance and any client libraries or SDKs used for authentication are kept up-to-date. Updates often include security patches that address known vulnerabilities.