Ghost is an open-source Content Management System for publishers and bloggers, making it easy to write and publish online content.
Ghost was created in 2013 with a focus on simplicity in writing and sharing content, good performance, improved SEO, and accessibility. It provides features to manage your content and membership and supports various integrations with third parties to enhance your blog's features.
Ghost lets third-party services interact with your blog content through a REST API. From this API, here are examples query you can perform:
- Retrieve the list of all posts published.
- Retrieve all the pages created.
- Retrieves the tags and authors.
- Access blog settings in read-only mode.
Security on the Ghost content API
To prevent users from accessing this data, you must generate an API key called Content API Key.
The Ghost Content API key allows you to interact with publicly available data on your blog through the Content API, but in read mode only. This means you cannot send a request to update the content of a blog post or add/remove a tag on a post.
On the contrary, the Admin API key allows you to perform admin actions through the Ghost REST API, such as creating or deleting a post, changing settings, creating an administrator, etc. Exposing this key can be damaging for your blog if a malicious person gains access to it.
Get the Ghost content API key
The process for retrieving a content API key may vary by Ghost major version. Ghost currently supports four major versions: v2, v3, v4, v5, and v6.
Because using the latest version is encouraged for security and feature improvements, this post shows how to retrieve the Content API key on Ghost v6.
Log in to the administration space of your blog. At the bottom left, click on the settings button.
A modal dialog appears displaying settings; on the left menu in the modal, scroll until you see the menu section named "Advanced" and click on the menu item "Integrations"
You will see the Integrations settings for your blog, such as the built-in integrations you can configure. At the top right, click on "Add custom integration"
A new modal appears with an input field to enter the integration name. Give a name and click on the "Add" button.
You will see the integration details, such as the Content API key, the Admin API key, and the API URL. You can optionally add an icon and a description for your integration. Click on the "Save" button.
Hover the Content API key field and click the "Copy" button to store it in the clipboard. You can now use this API key to access the content data of your blog even in unsecured environments or web browsers.
Use the Ghost content API key
Now that we have the content API key, let's use it to retrieve the list of published posts.
Making a request to the Ghost REST API requires the following information:
- Ghost version: It is the version of Ghost your blog runs on. We wrote a comprehensive guide to finding your blog's Ghost version.
- Content API key: We generated and copied it to the clipboard.
- API URL: It is the domain name of your blog.
The URL shape of the request to the content API is the following:
curl -H "Accept-Version: <GHOST_VERSION>" "https://<API_URL>/ghost/api/content/posts/?key=<CONTENT_API_KEY>&limit=100"
The code below shows how to send a request with cURL to retrieve all published posts.
curl -H "Accept-Version: v6.0" "https://writing.blogima.com/ghost/api/content/posts/?key=eb20d0b4606c7608bc960178af&limit=100"
Replace the request parameters with your blog's information, run it in the terminal, and see the result.
Wrap up
The Ghost content API makes it easy to programmatically access the data published on a blog. This allows developers to
- Display blog content on other websites.
- Enrich other applications with your data.
- Build web extensions for Ghost, such as Blogima, that help you manage internal linking.
- Perform analysis on blog posts' data, like checking broken links.
Interacting with the content API requires an API key generated in the blog settings' integration section. The content API key doesn't allow modifying blog content; you must use the Admin API key instead.