Now with AI-powered page building via MCP Server

Draft preview

The delivery API returns published content only. Three mechanisms let the right people see drafts without opening that door to everyone.

Public reads return published content and nothing else. That is a property of the API, not a filter your app remembers to apply - which is why an unfinished page cannot leak by accident.

It also means seeing a draft requires deliberately proving who you are. There are three ways, for three different people.

1. Draft cookie - for reviewers

A colleague reviewing a change wants the draft on the real URL, without an editor in the way. The /api/draft route sets a cookie that flips the public route to draft content:

/api/draft?secret=...&slug=/pricing

The route validates the secret against CMSSY_DRAFT_SECRET, sets the cookie, and redirects to the slug. From then on that browser sees drafts until the cookie is cleared. Everyone else keeps seeing the published site.

2. Dev draft overlay - for you, while developing

Append ?cmssyDev=1 to any URL to render your own per-user draft overlay:

http://localhost:3000/pricing?cmssyDev=1

This is not the shared draft. It is your personal working copy, which is what makes it safe for trying a block that is not deployed yet - nobody else's preview changes.

It requires CMSSY_API_TOKEN and is meant for development. Without the flag you get published content, so leaving the token set does not change what visitors see.

3. Edit mode - for the editor

The editor iframe sends cmssyEdit=1 plus a matching cmssySecret. The middleware verifies the pair and rewrites to /cmssy-edit, which serves draft content and mounts the edit bridge.

An unverified ?cmssyEdit=1 does nothing. That is asserted by the smoke test, because a preview route that trusts a query string is a public draft leak with extra steps - see testing.

The secrets

  • CMSSY_DRAFT_SECRET - guards the draft-preview bridge and edit mode. Any random string; it only has to match what the admin sends.
  • CMSSY_API_TOKEN - required for the ?cmssyDev=1 overlay, because reading someone's personal draft is an authenticated operation.
  • CMSSY_REVALIDATE_SECRET - guards the /api/revalidate webhook, which is a different concern: it invalidates cache after publish, and does not expose drafts.

Set CMSSY_ADMIN_URL if you self-host the admin; the draft banner uses it for its "Open in editor" link.

Publishing and the cache

Publishing does not deploy, and it does not automatically show up either. Your public route caches to its own revalidate value, so a freshly published page can keep serving the old copy until that window passes.

The /api/revalidate webhook closes that gap: cmssy calls it on publish, and the route invalidates the affected paths. If a change is published but the site still shows the old version, check that webhook before suspecting the CMS.

Next steps

  • Routes and pages - the three request shapes these mechanisms serve.
  • Testing - proving edit mode still rejects unverified requests.
  • API tokens - creating and scoping CMSSY_API_TOKEN.