Install Content

Choose a collection and the exact browser origins that will read it. Add an optional public HTTPS webhook URL for cache invalidation. Test and Live use different keys. HTTP localhost webhooks work only on a local non-production backend; a deployed backend requires a public HTTPS destination.

Create the Content credential in the Integrate step. The key can read published content only, for this website and environment. If a webhook is configured, its separate signing secret is shown at this step: put it on your webhook server before running installation checks. Missing or lost signing secrets can be rotated in website Settings > Delivery > Content.

async function publishedEvents() {
  const url = new URL("https://api.buckhy.com/v1/content/SITE_ID/events?environment=live&limit=100");
  const items = [];
  for (let page = 0; page < 20; page += 1) {
    const response = await fetch(url, {
      headers: { "X-Api-Key": process.env.BUCKHY_READ_KEY },
      cache: "no-store", redirect: "error", signal: AbortSignal.timeout(5000),
    });
    if (!response.ok) throw new Error(`Content API returned ${response.status}`);
    const data = await response.json();
    if (!Array.isArray(data.items) || data.collection?.key !== "events" || data.meta?.siteId !== "SITE_ID" || data.meta?.environment !== "live") throw new Error("Invalid Content response");
    items.push(...data.items);
    if (!data.meta.nextCursor) return items;
    url.searchParams.set("cursor", data.meta.nextCursor);
  }
  throw new Error("Page budget exceeded; do not show a partial catalogue");
}

Load a page that makes a successful request with the new key, then run installation checks in the console. Checks cover ownership, configuration, credential, origins, reader activity and collection response. A configured webhook must acknowledge a signed test event. Activate, create content and publish it. Keep your design and URLs; implement explicit error and empty states. A successful empty publication must never restore old static content. If you cache validated content, define a hard maximum age and invalidate on signed publish and unpublish notices.