PeltyCMS User docs/Administrator guide
API keys and integrations
#API keys
Staff create personal API keys in Admin → Addons & integrations → API keys. A key is shown once, carries a subset of your own permissions (scopes) and can expire after 1 to 3650 days. Send it as Authorization: Bearer pelty_….
- Keys work on the API routes their scopes allow, but never on
/auth/…,/account/…or the API-key routes themselves: a key cannot create or revoke keys. - Creating, listing and revoking keys needs an interactive sign-in.
- Failed key lookups are rate-limited per IP address. The last use time and IP are recorded.
- Staff can revoke all keys of a user.
#OAuth clients and SAML
OAuth clients registers apps that sign users in with PeltyCMS (PeltyCMS as OAuth provider). Clients see the apps they approved under Connected apps. SAML configures SAML identity providers for single sign-on.
#The HTTP API
Every route is listed in the developer HTTP API reference with its permission, parameters and responses, and as an OpenAPI document (developers/api.json). The Developer docs cover events, webhooks and writing addons.