EmDash ships with a granular API token system that mirrors its plugin sandbox philosophy. Each token declares exactly which capabilities it carries\u2014content read, content write, media access, user management\u2014and can be set to expire after a defined period. That much is visible in the admin panel. What the documentation won\u2019t tell you is how to design a token strategy that survives production loads, third-party integrations, and the occasional audit.<\/p>\n
This guide assumes you\u2019ve already generated a token and connected a service to the EmDash API. We\u2019re skipping the \u201chow to click the button\u201d part. Instead, we\u2019ll cover the decisions that separate a secure integration from one that leaks data or breaks under scale.<\/p>\n
Every EmDash API token is bound to a capability manifest\u2014a JSON-like declaration of what the token can do. This isn\u2019t a role-based system where \u201ceditor\u201d grants a fixed set of permissions. You define the scope per token. For example:<\/p>\n
“`json<\/p>\n
{<\/p>\n
“capabilities”: [“content:read”, “content:write”],<\/p>\n
“collections”: [“posts”, “projects”],<\/p>\n
“expires”: “2026-12-31T23:59:59Z”<\/p>\n
}<\/p>\n
“`<\/p>\n
The non-obvious part: capabilities are not inherited from the user who creates the token. They are independently assigned. That means a token can have more<\/em> permissions than its creator\u2014or fewer. An author-level user can generate a token that writes to any content type, as long as the admin has enabled that capability in the token creation UI. This is by design: tokens are meant for machine-to-machine communication, not to mirror human roles.<\/p>\n Practical implication:<\/strong> Always audit token manifests against the principle of least privilege. A token that reads posts and sends email (a common plugin pattern) cannot accidentally read user profiles or modify the database. But if you grant The most common external integration is a static site generator (SSG) that pulls content from EmDash at build time. For this, create a token with The trick: EmDash\u2019s API supports conditional requests via For a JavaScript frontend (e.g., Next.js or Astro) that needs draft preview, you might be tempted to expose a token with EmDash\u2019s MCP server can help here: it exposes a read-only interface for agents, but you can also use it as a backend-to-backend bridge. The MCP server authenticates via its own token (typically a site-level secret), which is separate from user tokens.<\/p>\n The WordPress import tool uses a temporary token generated during the migration flow. For custom migrations (e.g., from another CMS or a CSV pipeline), generate a dedicated token with EmDash tokens can expire, but there is no built-in auto-rotation. You must implement it yourself. The standard approach in production environments is to:<\/p>\n Based on reported incident response data, improperly scoped tokens account for roughly 40% of API-related data breaches in CMS integrations. A strict rotation schedule reduces the window of exposure to a maximum of 90 days per token.<\/p>\nmedia:write<\/code>codecode to a token used only for content imports, you\u2019ve opened an unnecessary attack surface.<\/p>\nIntegration Patterns That Actually Work<\/h2>\n
1. Static Publishing Workflows<\/h3>\n
content:read<\/code>codecode scoped to the specific collections you need. Do not<\/em> use a token with content:write<\/code>codecode unless the build process also pushes data back (e.g., form submissions or comments).<\/p>\nETag<\/code>codecode headers. If your SSG sends the token with If-None-Match<\/code>codecode, you can skip re-fetching unchanged content. This halves build time on large sites and reduces worker invocation costs.<\/p>\n2. Headless Frontend with Live Preview<\/h3>\n
content:read<\/code>codecode directly in the client. Don\u2019t.<\/strong> Tokens are server-side secrets. Instead, proxy requests through your own API endpoint that checks authentication before forwarding the token.<\/p>\n3. Automated Content Migrations<\/h3>\n
content:write<\/code>codecode and media:write<\/code>codecode, but set a short expiration\u201424 hours at most. This limits blast radius if the token leaks during the batch upload.<\/p>\nToken Lifecycle Management<\/h2>\n
Rotation Strategy<\/h3>\n
\n
POST \/api\/tokens\/revoke<\/code>codecode endpoint to invalidate the old token after the new one is confirmed working.<\/li>\n<\/ol>\nMonitoring and Alerts<\/h3>\n