Contentful Content Delivery API tokens only read published entries and are lower risk, but Content Preview tokens expose unpublished drafts and Content Management tokens can edit or delete content. Keep preview and management tokens on a server or edge proxy only.
Reads published content only. Still scope it per environment.
Reads unpublished drafts and embargoed content.
Creates, edits, publishes, and deletes content.
Gate preview mode behind authentication and keep the token out of client bundles.
Staging and production should not share delivery tokens.
Published content changes rarely, so caching cuts API usage and latency.
Those prefixes inline values into the public bundle, leaking unreleased content.
It allows anyone to rewrite or delete your site content.
Store the preview token in the vault and expose a client-token-protected preview pipeline, while published content runs through a cached public pipeline.
It is low risk because it reads published content only, but treat it as a credential and rotate it if abused.
You should not store Contentful credentials in FlutterFlow client code. Contentful Delivery API proxied with preview and delivery keys in Vault. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Contentful credentials in Next.js / React client code. Edge injects preview token; ISR pages fetch composed CMS JSON safely. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To stitch contentful entries with shopify products api, use one RealComposer pipeline with parallel steps. Contentful marketing fields plus Shopify SKU inventory in parallel. Your Next.js / React app makes one request instead of several sequential upstream calls.
To merge cloudinary assets with contentful entries, use one RealComposer pipeline with parallel steps. Resolve Contentful asset references with Cloudinary transformation metadata. Your Next.js / React app makes one request instead of several sequential upstream calls.
To cache contentful delivery api at edge avoid limits, put a TTL cache on your RealComposer pipeline. 300s TTL on composed entry responses at Cloudflare edge. Shared edge cache absorbs repeat traffic before it reaches Contentful.
You should not store Contentful credentials in Retool client code. Contentful CMA writes from Retool via edge with scoped tokens. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
A headless CMS is a content management system that stores and manages content but delivers it only through APIs, with no built-in presentation layer. Frontends such as websites, mobile apps, and kiosks fetch content as JSON and render it however they choose.
Jamstack ArchitectureJamstack is a web architecture where sites are prebuilt into static files served from a CDN, with dynamic functionality provided by JavaScript calling APIs at runtime. It delivers fast, secure pages because there is no origin server rendering each request.
Edge CachingEdge Caching is the practice of storing computed API responses on globally distributed Point of Presence (PoP) servers situated geographically close to users. By serving cached responses directly from edge memory, requests achieve sub-10ms latencies while offloading 95%+ of traffic from origin databases.