How do I authenticate?

With an API key from Developer settings, sent as "Authorization: Bearer ". Each key belongs to one website and one environment. It's shown once when you create it, and we only keep a hash of it.

Can I call the API from the browser?

Yes, from the domains you allow for that environment; every other origin is refused, and the API never answers with a wildcard. Calls from a server send no origin, so the key alone authenticates them. Where you have a server, fetch there.

What's the difference between Development and Production keys?

A Development key returns the live site plus the work in progress, so your dev site always shows the whole website. A Production key returns released content only, once the website is published.

How do content changes reach my site without a redeploy?

Fetch at request time, or revalidate on a timer (for example every 60 seconds). Each release clears the API's cache for that website and environment at once, so the next request gets the new content.

What comes back for empty fields, or fields added later?

Every field of a section is always present: empty values are null and empty lists are []. New fields and sections can appear later, so render what's there and ignore keys you don't know.

What happens if someone renames or removes a field?

It's flagged Breaking in the Release before it goes live, so you can update your code first. An item whose address changes keeps its old slug as a redirect, and the API answers it with the new one.

Is rich text HTML or JSON?

Both. You get the structured JSON to render with your own components, and ready HTML for stacks that just want to print it. It carries content only: headings, lists, links and emphasis, never colours or fonts.

Do I need my own backend for forms?

No. Each form has its own POST endpoint. Send the values as JSON: you get 200 with the form's message, 422 with an error per field, or 429 when it's sent too often. Honeypot, duplicate protection and an optional CAPTCHA with your own keys are built in.

Can I add mywebcms to a site I've already built?

Yes. Create the pages and sections for the content you want editable, then swap your hardcoded text for API values. Each page's API tab gives you the request for your stack, and a prompt your AI coding assistant can follow to do the wiring.

For developers

A headless CMS API for any frontend.

Create a page, give its sections fields, and fetch it as plain JSON from Next.js, React, Vue, PHP, Laravel or static HTML. Every endpoint comes from the pages you set up, so there’s no backend to write, and your clients edit the content themselves.

Get started See the quickstart

Step 1 of 4. Create a page in Development: a single page, or a page with many items.

Quickstart

From sign-up to your first API call.

Seven steps, the same ones you’ll see in admin.

Start with step 1

01 / 07:Sign up

01Onboarding
Sign up
Name your workspace and your first website.
Workspace→Website
02Pages → New page
Create a page
A single page, or a page with many items.
GET /v1/pages/home
03Section → Add field
Add its fields
Give each section fields. Their keys become your JSON.
titlesubtitleimagebutton
04Page editor
Fill in the content
Type it in yourself, or let your client do it.
SavedInvite as Content editor
05Developer settings
Get a key
Create a Development key and allow your local address.
Development keylocalhost:3000
06Your code
Fetch the page
Plain HTTP and JSON, from any stack.
GET /v1/pages/home
1$ch = curl_init(getenv('MYWEBCMS_API_URL') . '/pages/home');2curl_setopt_array($ch, [3 CURLOPT_RETURNTRANSFER => true,4 CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('MYWEBCMS_API_KEY')],5]);6$data = json_decode(curl_exec($ch), true)['data'];
07Releases
Release it
Merge to Production. Your client edits from here on.
ReleasedProduction · v1

AI built in

AI on both sides of the API.

Show it a design and get the endpoints. Copy one prompt, and your coding assistant wires them into your site, in your stack.

1Your design

2Your API

3Your code

Your assistant builds

Nothing until you review
AI proposes the sections and fields. You tick, rename and create.ReviewCreate page
A prompt made from your page
Every endpoint, field and error code of that page, in one copy.GET /pages/home401 · 404 · 429
Any stack, any assistant
It writes code in your project's own stack and conventions.Next.jsLaravelWordPressPHP
Your design stays yours
The API sends content only. Classes, colours and layout stay in your code.Content onlyNo CSS in the API

Content API

Every endpoint, made from your pages.

A headless CMS API that follows what you build. Add a page and its endpoints exist, with filters and sorting for lists. No routes to write.

Your websiteWhat you set up

Its APINothing written by hand

Pages with many items also take filters, sorting and pages.

Released content only
A Production key reads what's released. A Development key reads work in progress.Production keyDevelopment key
Cached, cleared on release
Responses are cached, and each release clears exactly that website's cache.CachedCleared on release
Locked to your domains
Browsers can call it only from domains you allow. Servers use the key.your-domain.comlocalhost:3000
No silent breaking changes
Renaming or removing a field is flagged Breaking before it's released.title → headingBreaking

Form API

One endpoint per form. Checked for you.

Every form you create gets its own POST endpoint. Send plain JSON from any stack: each field is checked, bots and repeats are stopped, and every real submission becomes a lead.

What happens to each lead

Contact usYour form

Its endpoint, made for you

POST /v1/forms/contact-us/submit

New lead, with its page and campaign

Checked against your form
Required fields, types and limits come from the form. Errors arrive per field, ready to show.422errors.email
Bots and repeats stopped
A hidden honeypot, one lead per submission, and a CAPTCHA with your own keys if you want one._hpIdempotency-Key
Rate limited, never open
Limits per visitor and per form, locked to your domains. If limits can't be checked, it refuses.429Retry-After
Every submission, a lead
With the page it came from, the item on item pages, and the campaign in its UTM tags._contextNew lead

Your data

Your database. Your storage. Your call.

Keep content in mywebcms or your PostgreSQL, files in mywebcms storage or your S3-compatible bucket, and move either way any time. Here is what you have once you do.

$ psql $YOUR_DATABASE_URL

app=> \dt mywebcms.*

Schema | Name

mywebcms | pages

mywebcms | sections

mywebcms | content_entries

mywebcms | forms

mywebcms | leads

mywebcms | media_assets

mywebcms | releases

… and the rest of your content

app=> select title, slug, visible from mywebcms.pages limit 3;

Home | home | t

About us | about-us | t

Services | services | t

PostgreSQL 14+
Any provider: yours, managed or self-run.
Your schema
Everything sits in one schema you name.
Moved online
Copied, every row counted, then switched.
Both ways
Move back to mywebcms any time.

Isolated by PostgreSQL
Row-level security keeps each website's rows to that website, even if a query forgets a filter.tenant_isolation
Secrets encrypted
Bucket keys, database passwords and CAPTCHA secrets are encrypted, bound to their website.AES-256-GCM••••3f9a
Keys stored as hashes
API keys are shown once and kept only as a hash. Passwords are hashed too.SHA-256scrypt
Moves you can trust
Content is read-only while it moves, and nothing switches until every row is counted.CopyCheckSwitch

Sign-ins, team access and settings always stay with mywebcms, and files are served from the mywebcms files address, wherever they are stored. How your own database and storage work

Any frontend

A headless CMS for every stack you build in.

No SDK to install and nothing to learn but HTTP and JSON. Pick your stack: where the code goes, what it fetches, and what’s good to know.

Headless CMS for Next.js

Fetch in a server component, so the key stays on the server and pages can be static. Every item of a page with many items gets its own route, with a 404 when it doesn't exist.

Revalidate on a timer: each release clears the API's cache at once.
An old item address answers with its new slug, so redirects are easy.

app/services/[slug]/page.tsx

1import { notFound } from "next/navigation"2 3// A server component: the key never reaches the browser.4export default async function Service({ params }) {5  const { slug } = await params6  const res = await fetch(`${process.env.MYWEBCMS_API_URL}/pages/services/${slug}`, {7    headers: { Authorization: `Bearer ${process.env.MYWEBCMS_API_KEY}` },8    next: { revalidate: 60 },9  })10  if (res.status === 404) notFound()11  const { data } = await res.json()12  return <h1>{data.title}</h1>13}

Headless CMS for React

A list of items is one request, with the filters and sorting you ticked in the item template. Ask for featured items, cheapest first, or one page of twenty.

Browsers can call it only from the domains you allow for that environment.
Unknown query parameters are ignored, never an error.

src/FeaturedServices.jsx

1export function FeaturedServices() {2  const [items, setItems] = useState([])3  useEffect(() => {4    const url = `${import.meta.env.VITE_MYWEBCMS_API_URL}/pages/services?featured=true&sort=-price`5    fetch(url, {6      headers: { Authorization: `Bearer ${import.meta.env.VITE_MYWEBCMS_API_KEY}` },7    })8      .then((res) => res.json())9      .then(({ data }) => setItems(data))10  }, [])11  return items.map((item) => (12    <a key={item.slug} href={`/services/${item.slug}`}>{item.title}</a>13  ))14}

Headless CMS for Vue

Wrap the call in a small composable and every component can load its page or section by address. The shape is the same for every page, so one helper covers the site.

Ask for a whole page, or a single section by its key.
Empty fields arrive as null, so templates never meet a missing key.

src/composables/useMywebcms.js

1import { ref } from 'vue'2 3export function useMywebcms(path) {4  const data = ref(null)5  fetch(`${import.meta.env.VITE_MYWEBCMS_API_URL}${path}`, {6    headers: { Authorization: `Bearer ${import.meta.env.VITE_MYWEBCMS_API_KEY}` },7  })8    .then((res) => res.json())9    .then((json) => (data.value = json.data))10  return data11}12 13// In any component:14// const about = useMywebcms('/pages/about')15// const hero = useMywebcms('/pages/home/sections/hero')

Headless CMS for PHP

Plain PHP and cURL are enough: no SDK, no Composer package. Fetch the list, loop over it and escape what you print.

Rich text comes as JSON and as ready HTML, so PHP needs no editor library.
Server calls send no Origin: the key alone authenticates them.

services.php

1$ch = curl_init(getenv('MYWEBCMS_API_URL') . '/pages/services?sort=-price');2curl_setopt_array($ch, [3  CURLOPT_RETURNTRANSFER => true,4  CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('MYWEBCMS_API_KEY')],5]);6$items = json_decode(curl_exec($ch), true)['data'];7 8foreach ($items as $item) {9  echo '<a href="/services/' . urlencode($item['slug']) . '">'10    . htmlspecialchars($item['title']) . '</a>';11}

Headless CMS for Laravel

Use the HTTP client you already have, cache the answer, and hand the sections to a Blade view. Your routes, controllers and views stay exactly as you like them.

Keep the URL and key in config/services.php, read from .env.
Forms post to their own endpoint, from a controller or straight from the page.

routes/web.php

1use Illuminate\Support\Facades\Cache;2use Illuminate\Support\Facades\Http;3 4Route::get('/about', function () {5    $page = Cache::remember('mywebcms:about', 60, fn () =>6        Http::withToken(config('services.mywebcms.key'))7            ->get(config('services.mywebcms.url') . '/pages/about')8            ->throw()9            ->json('data'));10 11    return view('about', ['sections' => $page['sections']]);12});

Headless CMS for WordPress developers

Keep the theme you know and let the content come from mywebcms. A transient keeps it fast, and your client edits in one place instead of a page builder.

No plugin to install: the WordPress HTTP API is enough.
Leads from your forms land in mywebcms, not in another plugin.

front-page.php

1$data = get_transient('mywebcms_home');2if ($data === false) {3  $res = wp_remote_get(getenv('MYWEBCMS_API_URL') . '/pages/home', [4    'headers' => ['Authorization' => 'Bearer ' . getenv('MYWEBCMS_API_KEY')],5  ]);6  $data = json_decode(wp_remote_retrieve_body($res), true)['data'];7  set_transient('mywebcms_home', $data, MINUTE_IN_SECONDS);8}9 10echo '<h1>' . esc_html($data['sections']['hero']['values']['title']) . '</h1>';

A content API for static websites

A plain HTML page can fill itself in with one fetch. Good for landing pages and small sites that still need their text kept up to date.

In a browser the key is visible, so it only works from your allowed domains.
A Production key reads released content and sends forms, nothing else.

index.html

1<h1 id="title"></h1>2<script>3  const API_URL = 'YOUR_MYWEBCMS_API_URL' // from Developer settings4  const API_KEY = 'YOUR_PRODUCTION_KEY'5 6  fetch(`${API_URL}/pages/home`, { headers: { Authorization: `Bearer ${API_KEY}` } })7    .then((res) => res.json())8    .then(({ data }) => {9      document.getElementById('title').textContent = data.sections.hero.values.title10    })11</script>

Mobile apps and any other stack

iOS, Android, Flutter, Python, Go or a cron job: if it can send an HTTP request, it can read your content. The answer is the same JSON everywhere.

Errors come as { error: { code, message } } with the usual status codes.
Too many requests answer 429 with Retry-After.

See the mobile apps use case

Terminal

1curl "$MYWEBCMS_API_URL/pages/home" \2  -H "Authorization: Bearer $MYWEBCMS_API_KEY"

FAQ

Questions developers ask.

Keys, environments, caching, forms and what the API sends back, answered before you write a line.

Get started See the quickstart

You call it yourself. It's plain HTTP and JSON with a Bearer key, so any language works with the HTTP client it already has, and there's nothing to install or keep up to date.

Get started

Build your next client site on mywebcms.

Start from a screenshot, give your client one simple place to run it, and ship it on any stack you like.

Get started

Two steps to your first website:
1Create your workspace
2Add a client website

Everything that comes with mywebcms

Tap any feature to learn more.

1import { notFound } from "next/navigation"2 3// A server component: the key never reaches the browser.4export default async function Service({ params }) {5 const { slug } = await params6 const res = await fetch(`${process.env.MYWEBCMS_API_URL}/pages/services/${slug}`, {7 headers: { Authorization: `Bearer ${process.env.MYWEBCMS_API_KEY}` },8 next: { revalidate: 60 },9 })10 if (res.status === 404) notFound()11 const { data } = await res.json()12 return <h1>{data.title}</h1>13}

1export function FeaturedServices() {2 const [items, setItems] = useState([])3 useEffect(() => {4 const url = `${import.meta.env.VITE_MYWEBCMS_API_URL}/pages/services?featured=true&sort=-price`5 fetch(url, {6 headers: { Authorization: `Bearer ${import.meta.env.VITE_MYWEBCMS_API_KEY}` },7 })8 .then((res) => res.json())9 .then(({ data }) => setItems(data))10 }, [])11 return items.map((item) => (12 <a key={item.slug} href={`/services/${item.slug}`}>{item.title}</a>13 ))14}

1import { ref } from 'vue'2 3export function useMywebcms(path) {4 const data = ref(null)5 fetch(`${import.meta.env.VITE_MYWEBCMS_API_URL}${path}`, {6 headers: { Authorization: `Bearer ${import.meta.env.VITE_MYWEBCMS_API_KEY}` },7 })8 .then((res) => res.json())9 .then((json) => (data.value = json.data))10 return data11}12 13// In any component:14// const about = useMywebcms('/pages/about')15// const hero = useMywebcms('/pages/home/sections/hero')

1$ch = curl_init(getenv('MYWEBCMS_API_URL') . '/pages/services?sort=-price');2curl_setopt_array($ch, [3 CURLOPT_RETURNTRANSFER => true,4 CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('MYWEBCMS_API_KEY')],5]);6$items = json_decode(curl_exec($ch), true)['data'];7 8foreach ($items as $item) {9 echo '<a href="/services/' . urlencode($item['slug']) . '">'10 . htmlspecialchars($item['title']) . '</a>';11}

1use Illuminate\Support\Facades\Cache;2use Illuminate\Support\Facades\Http;3 4Route::get('/about', function () {5 $page = Cache::remember('mywebcms:about', 60, fn () =>6 Http::withToken(config('services.mywebcms.key'))7 ->get(config('services.mywebcms.url') . '/pages/about')8 ->throw()9 ->json('data'));10 11 return view('about', ['sections' => $page['sections']]);12});

1$data = get_transient('mywebcms_home');2if ($data === false) {3 $res = wp_remote_get(getenv('MYWEBCMS_API_URL') . '/pages/home', [4 'headers' => ['Authorization' => 'Bearer ' . getenv('MYWEBCMS_API_KEY')],5 ]);6 $data = json_decode(wp_remote_retrieve_body($res), true)['data'];7 set_transient('mywebcms_home', $data, MINUTE_IN_SECONDS);8}9 10echo '<h1>' . esc_html($data['sections']['hero']['values']['title']) . '</h1>';

1<h1 id="title"></h1>2<script>3 const API_URL = 'YOUR_MYWEBCMS_API_URL' // from Developer settings4 const API_KEY = 'YOUR_PRODUCTION_KEY'5 6 fetch(`${API_URL}/pages/home`, { headers: { Authorization: `Bearer ${API_KEY}` } })7 .then((res) => res.json())8 .then(({ data }) => {9 document.getElementById('title').textContent = data.sections.hero.values.title10 })11</script>

A headless CMS API for any frontend.

From sign-up to your first API call.

Sign up

Create a page

Add its fields

Fill in the content

Get a key

Fetch the page

Release it

AI on both sides of the API.

Nothing until you review

A prompt made from your page

Any stack, any assistant

Your design stays yours

Every endpoint, made from your pages.

Released content only

Cached, cleared on release

Locked to your domains

No silent breaking changes

One endpoint per form. Checked for you.

Checked against your form

Bots and repeats stopped

Rate limited, never open

Every submission, a lead

Your database. Your storage. Your call.

Isolated by PostgreSQL

Secrets encrypted

Keys stored as hashes

Moves you can trust

A headless CMS for every stack you build in.

Headless CMS for Next.js

Headless CMS for React

Headless CMS for Vue

Headless CMS for PHP

Headless CMS for Laravel

Headless CMS for WordPress developers

A content API for static websites

Mobile apps and any other stack

Questions developers ask.

Is there an SDK, or do I call the API myself?

How do I authenticate?

Can I call the API from the browser?

What's the difference between Development and Production keys?

How do content changes reach my site without a redeploy?

What comes back for empty fields, or fields added later?

What happens if someone renames or removes a field?

Is rich text HTML or JSON?

Do I need my own backend for forms?

Can I add mywebcms to a site I've already built?

Build your next client site on mywebcms.

A headless CMS API for any frontend.

From sign-up to your first API call.

Sign up

Create a page

Add its fields

Fill in the content

Get a key

Fetch the page

Release it

AI on both sides of the API.

Nothing until you review

A prompt made from your page

Any stack, any assistant

Your design stays yours

Every endpoint, made from your pages.

Released content only

Cached, cleared on release

Locked to your domains

No silent breaking changes

One endpoint per form. Checked for you.

Checked against your form

Bots and repeats stopped

Rate limited, never open

Every submission, a lead

Your database. Your storage. Your call.

Isolated by PostgreSQL

Secrets encrypted

Keys stored as hashes

Moves you can trust

A headless CMS for every stack you build in.