Authentication

How delivery tokens work in Exacta: the token selects the branch, and its access level decides whether drafts are visible.

The Content Delivery API authenticates with a query parameter, exactly as Storyblok does. There is no session and no header to set — these endpoints are called by your frontend, not by a logged-in user.

shell
curl "https://api.exacta.im/v2/cdn/stories?token=$EXACTA_TOKEN"

Query parameters

tokenrequiredstring

An Exacta delivery token. Identifies both the branch and the access level.

The token is the branch

This is the central idea. A token belongs to exactly one branch, so the environment your site reads is decided entirely by which token it was given. Moving a deployment from staging to production is an environment variable change — no code, no rebuild of your query layer.

env
# staging deployment
EXACTA_TOKEN=tk_wK3f...      # → Staging branch

# production deployment
EXACTA_TOKEN=tk_9Qm2...      # → Production branch

Access levels

Token access

publicaccess level

Published content only. Requesting version=draft with a public token silently returns published content — it is never an error, and never a leak.

previewaccess level

Adds draft content, and only on the preview branch. On any other branch a preview token behaves exactly like a public one, because those branches hold no drafts.

Revoking and rotating

  • Revoking a token takes effect on the next request; there is no cache of validated tokens.
  • Deleting a branch invalidates every token on it.
  • Each token records a lastUsedAt timestamp, so an unused token is safe to identify and remove.