Skip to main content
ButterCMS uses API tokens for programmatic access to your content. Tokens are available from your account settings and should be kept secure.

​
Token types

​
Finding your API tokens

  1. Navigate to Settings > General
  2. View your Read API Token
  3. To enable a Write API Token, purchase the Write API add-on from the Billing page; the token activates automatically. The add-on is available on Advanced and Professional plans, not on Basic

​
Security best practices

Critical security practices:
  1. Never expose tokens in client-side code — Use server-side proxies instead
  2. Use environment variables — Don’t hardcode tokens in your source code
  3. Read vs. write — Use the read-only token when write access isn’t needed
  4. Rotate after incidents — Regenerate tokens if they may have been compromised
  5. Separate environments — Use different tokens for staging and production

​
Using tokens in your app

Store your token in an environment variable and reference it in code:

​
Frequently asked questions

For the Read API token, go to Settings > General and use the Reset API Token button to regenerate it immediately. Resetting invalidates the existing token, so update every application that uses it. For the Write API token, contact support.
The read token allows fetching content via the API. The write token allows creating, updating, and deleting content programmatically. The Write API token is a paid add-on for Advanced and Professional plans. Purchase it from the Billing page and it activates automatically. It isn’t offered on Basic plans.