Authentication

The Delivery API authenticates with project-scoped API keys, sent as a Bearer token. A key only ever reaches the project it was created in.

Creating a key

In the dashboard, open your project → API Keys → create a key. Choose a scope, then copy the token. The full token is shown once and stored only as a hash.

Scopes

Param	Type	Description
read	wrk_live_…	Published content only. Safe to use from production sites.
preview	wrk_preview_…	Drafts + published. For preview / staging builds. Never cached.
manage	wrk_admin_…	Full access. Keep server-side only — never expose in a browser.

Sending the token

Pass the token in the Authorization header:

http

GET /v1/projects/PROJECT_ID/content/blog_post HTTP/1.1
Host: api.wriven.com
Authorization: Bearer wrk_live_xxx

// KEEP KEYS SECRETStore keys in server environment variables (e.g. process.env.WRIVEN_TOKEN). Never commit them. Only a read key is safe in client-side code, and even then prefer fetching on the server.

Revoking

Revoke a key from the same page. Revocation is immediate (within a short cache window) and permanent — sites using it stop working, so rotate first.

Errors

Param	Type	Description
401	Unauthorized	Missing, invalid, revoked, or expired key.
403	Forbidden	Key lacks the required scope, or targets another project.
404	Not Found	Unknown content type or entry slug.

Content Modeling