API Keys

Baan uses API keys to authenticate requests to the CMS API and the CLI. There are two key types, each with different permissions.

Key Types

Type	Permission	Use case
CMS	Read-only	Fetching content from external frontends, mobile apps, aggregators
CLI	Read + Write	Baan CLI (baan sync, baan posts), CI/CD pipelines

CMS keys can only read — they return 403 Forbidden on any write operation. CLI keys have cli:full permission and can create, update, publish, and delete posts.

Creating a Key

1. Go to Admin → Settings → API Keys
2. Click Create Key
3. Give it a descriptive name (e.g. "Frontend app", "CLI")
4. Select the key type: CMS or CLI
5. Copy the generated key — it starts with cms_live_... and is shown only once

Using a Key

Pass the key in the X-API-Key header on every request:

curl https://your-blog.com/api/cms/v1/posts \
  -H "X-API-Key: cms_live_xxxxxxxxxxxxxxxxxxxx"

For the CLI, keys are configured via baan init or environment variable:

BAAN_API_KEY=cms_live_xxxxxxxxxxxxxxxxxxxx

Rate Limiting

The default limit is 300 requests per hour per key. Each response includes rate limit headers:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 247
X-RateLimit-Reset: 1700000000

Clients that exceed the limit receive a 429 Too Many Requests response.

Security

• Keys are stored as SHA-256 hashes — Baan never stores the raw key
• Comparison uses constant-time equality to prevent timing attacks
• Revoke a key immediately from Admin → Settings → API Keys if it is compromised