Content Management API > Authentication

In order to make any request to the Content Management API (CMA), you need to first obtain an API token. Enter your project administrative area (ie. http://your-project.admin.datocms.com) and go to the Project Settings > API Tokens section:

Every project comes with a read-only API token by default. If you need to perform other types of requests — like writing or deleting content — you can create a custom API token with the appropriate permissions. You can use roles to define granular access levels and control exactly what each token can do.

Once you have the API Token, you need to pass it as an Authorization header in each HTTP request you perform:

curl \
  -H 'Authorization: Bearer <YOUR-API-TOKEN>' \
  -H 'Accept: application/json' \
  -H 'X-Api-Version: 3' \
  https://site-api.datocms.com/site

If you're using our Javascript client, you can pass the same API token as an option to the buildClient initialization function:

import { buildClient } from '@datocms/cma-client-node';

const client = buildClient({
  apiToken: '<YOUR_TOKEN>',
});