Public Data API (Zero-Auth)
While the core API requires a secure sk_live_ key to manage data, Saint CMS also provides a dedicated Public API designed exclusively for your frontend applications (like a Next.js website).
This endpoint requires zero authentication and is completely safe to use in client-side components.
How It Works
The Public API has strict security rules built into the Go engine:
- GET Requests Only: It will automatically reject any attempt to POST, PUT, or DELETE data.
- Auto-Filtering: It exclusively returns records where
status = 'Published'. Drafts are completely hidden from the public automatically. - Open CORS: It sends an
Access-Control-Allow-Origin: *header, meaning any frontend domain can fetch this data without browser blocks.
Fetching Public Data
To fetch published data, append your collection name to the /api/v1/public/ route.
Basic Fetch
// Fetching all published blog posts
const res = await fetch('http://localhost:3333/api/v1/public/blog');
const data = await res.json();Full-Text Search (FTS5)
Saint CMS features a native, lightning-fast SQLite FTS5 search engine. You can instantly filter published records by adding the ?search= query parameter. The backend automatically scans all text fields and returns ranked matches.
// Search across all text fields for the word "React"
const res = await fetch('http://localhost:3333/api/v1/public/blog?search=React');Multi-Language Delivery (i18n)
If you enabled localization on specific fields in your Schema Builder, the API will automatically parse and flatten the JSON payload based on the requested language using the ?lang= parameter.
// Fetch the French version of your content
const res = await fetch('http://localhost:3333/api/v1/public/blog?lang=fr');Combining Parameters
You can combine query parameters to perform complex fetches with zero extra backend configuration:
// Search for "Design" and return the results translated to Spanish
const res = await fetch('http://localhost:3333/api/v1/public/blog?search=Design&lang=es');