Manage Access Tokens

Storyblok offers a rich set of APIs and services for delivering and managing content and assets. Tokens safeguard access to these services.

Content Delivery API access tokens

Use the Content Delivery API’s read-only access tokens to view the content and assets of a specific space.

To manage per-space tokens and generate new ones, select the space and open Settings → Access Tokens.

The following types of tokens are available:

Public: access published content using the Content Delivery API. Use this token in production frontends.
Preview: access draft and published content using the Content Delivery API. Use this token in the Visual Editor or staging environments.
Asset: access private assets using the Content Delivery API.
Release: access content associated with a specific release. Requires the Releases app.
Theme: access a theme for use by the Storyblok rendering service (deprecated).

The following example uses the JavaScript SDK to fetch published stories via the Content Delivery API:

import { apiPlugin, storyblokInit } from "@storyblok/js";

const { storyblokApi } = storyblokInit({
  accessToken: "YOUR_ACCESS_TOKEN",
  use: [apiPlugin],
});

// Use a public or preview access token
const { data } = await storyblokApi.get("cdn/stories", {
  version: "published",
});

Management API access tokens

Use the Management API’s read-only/read-write access tokens to perform create, read, update, delete (CRUD) operations across spaces.

Personal access token

The personal access token is account-specific. Generate new tokens or view existing ones in your Account settings: My account → Account settings → Personal access tokens.

Choose + Generate New Token, name it, and set an expiration date for an additional security layer.

Select which spaces the token can access:

All spaces is the default, and grants access to all the spaces you own. Learn more about space ownership in the Roles manual.
Only selected spaces allows you to limit the token to specific spaces. Select one or more spaces where the token applies.

Next, set individual permissions. Select at least one the following scopes:

Asset folders
Assets
Collaborators
Comments
Components
Datasource entries
Datasources
Releases
Spaces
Statistics
Stories
Tags
Taxonomies
Users
Webhooks
Workflows

Finally, review the configuration before selecting Generate Token. Afterward, you can only rename the token; other settings are read-only.

Once you select Generate Token, you get a one-time option to view and copy the token. This is the only occasion you can view it—copy and store the token securely.

Security best practices

Store your personal access tokens in environment variables, and never expose them in frontend code you commit to version control.
Immediately revoke any exposed tokens and generate a new one.
Apply the principle of least privilege and restrict the token’s access to the required spaces and scopes.
Use unscoped tokens only for development or tooling that requires unrestricted access.