Authentication

Public delivery needs no credential.

Published JSON and media are public by URL. Do not publish private information. Agent keys, cookies, and organisation headers are not needed for delivery requests.

Create a site-specific agent key.

A site administrator creates the key under Agents. Copy it once into a server secret or MCP client’s private configuration. Keys are hashed at rest, limited to one site, expire within 90 days, and can be revoked. The editor defaults to 30 days.

Send the bearer header.

Authoring REST and MCP accept Authorization: Bearer followed by the ptcms. key. Never place it in a URL, NEXT_PUBLIC variable, VITE variable, rendered page, or source control.

# Run from a trusted terminal. Set SITE_ID and CMS_AGENT_TOKEN first.
curl --fail-with-body \
  -H "Authorization: Bearer $CMS_AGENT_TOKEN" \
  "https://content.peopletide.com/api/v1/sites/$SITE_ID/content?limit=25"

The workspace uses PeopleTide sign-in.

Cookie-based writes require the configured Origin and X-CSRF-Token. Continue using the existing browser sign-in rather than copying cookies into external clients. Human approval requires a publisher or administrator; an agent key cannot approve.

Respond to authentication failures.

Rotate credentials by creating a replacement, verifying the integration, then revoking the old key.

• 401: missing, invalid, expired, or revoked credentials.
• 403: the actor cannot perform the action or a human is required.
• 409: a revision or release changed; read the new state before making a fresh proposal.
• Do not retry validation or permission failures unchanged. Bound transient retries and show a useful error.