API keys

Admins issue keys at /admin/api-keys or POST /_cms/api-keys with { name, role }. The plaintext key (cms_...) is returned once; only its hash is stored. DELETE /_cms/api-keys/:id revokes it.

The host turns the Bearer header into the request user with bearerToken from @interactive-inc/cms/api-key and verifyApiKey({ db, token }). The key's role is then checked by the same access rules as a session user.

curl https://<host>/api/docs -H "Authorization: Bearer cms_..."

Use an editor key for AI agents so publishing and structure changes stay with an admin. Scripts that publish or reindex need an admin key.