API Keys

What are API Keys?

Outstatic Pro turns your self-hosted CMS into a complete managed workflow. One project API key gives your team AI Completions, Member Management, Google Social Login and Email Sign-In, and Automatic Content Setup—without maintaining the supporting services yourself.

Creating or regenerating a key requires an active or trialing Pro subscription. Each project can have one active API key at a time.

You do not need an Outstatic API key to self-host Outstatic for free. Free self-hosted installations can connect directly to GitHub with their own OAuth app by setting OST_GITHUB_ID and OST_GITHUB_SECRET.

How API Keys Work

When you generate an API key from your project's API Key settings in the Outstatic dashboard, you receive a secret key that authenticates your self-hosted instance with Outstatic's services. You add this key to your .env file:

OUTSTATIC_API_KEY=your_api_key_here

Once configured, your self-hosted Outstatic instance can connect to Outstatic's hosted services. The key is validated on each request to ensure only authorized projects can use these capabilities.

Important: Treat the key as a secret. Newly generated keys can be revealed and copied from the API Keys page. Some older keys only show their prefix; replacing one requires regeneration. Regenerating a key revokes the previous key and requires an active or trialing Pro subscription.

If a Pro subscription ends, an existing key is not automatically revoked. It remains valid and can be revoked, but creating or regenerating a key requires subscribing to Pro again. Access to hosted Pro features still follows the workspace's current subscription status.

Hosted Services and Pro Features

A valid API key authenticates your self-hosted instance with Outstatic's hosted relay services. The workspace's subscription status separately determines which Pro capabilities are enabled.

With an active or trialing Pro subscription and a valid API key, your self-hosted instance gains access to:

• AI Completions — Give writers intelligent suggestions without configuring your own AI provider key.
• Member Management — Invite collaborators and control who can access each project.
• Google Social Login and Email Sign-In — Give your team simple, flexible ways to access the CMS.
• Automatic Content Setup — Detect and configure existing content so your project is ready faster.
• Managed GitHub Relay — Sign in with GitHub without maintaining local OAuth app credentials.

Getting an API Key

1. Start or trial an Outstatic Pro subscription for the project's workspace.
2. Sign in to outstatic.com and open your project.
3. Go to the API Key tab in your project settings.
4. In Step 1, add at least one Callback Origin base URL ending in /outstatic.
5. As soon as the first Callback Origin is added, the UI moves to Step 2 automatically. You can still go back to Step 1 anytime.
6. In Step 2, click Generate API Key.
7. Copy the key and add it to your .env file.

Callback Origin Configuration

Callback Origins are required for authentication callbacks and social login. Add every self-hosted base URL where Outstatic runs, and make sure each one ends in /outstatic.

Examples:

• https://myblog.com/outstatic
• http://localhost:3000/outstatic
• https://preview-myblog.vercel.app/outstatic

Rules:

• Must be a full URL with http:// or https://.
• Must end with /outstatic.
• Do not include query params or hash fragments.
• You can add multiple origins (development, preview, production).

If you don't set callback origins, team members can still access and manage content through outstatic.com.

GitHub Relay for Self-Hosted Installs

If you use OUTSTATIC_API_KEY, Outstatic can relay GitHub OAuth through outstatic.com and then send users back to your self-hosted callback route.

This means you can support GitHub login without creating your own local OAuth app credentials.

To use this flow safely:

1. Configure callback origins in outstatic.com (each one ending in /outstatic).
2. Make sure your self-hosted callback routes are available at: https://your-domain.com/outstatic/api/outstatic/callback https://your-domain.com/outstatic/api/outstatic/magic-link-callback
3. Add OUTSTATIC_API_KEY to your .env.

Outstatic validates callback URL and callback target strictly. If the callback does not match a configured callback base URL ending in /outstatic, or does not resolve to /outstatic/api/outstatic/callback, relay login will be blocked.