Docs
Swagger

Developers

Where credentials come from

Before you write config files, collect websiteId and a frontend key from the dashboard — and keep server secrets out of the browser bundle.

You need a website first
Create a project in the Dashboard (app.macrocontent.dev). Then open Settings → SDK.

What to copy into the site

NameTypeDescription
websiteIdUUIDIdentifies the website to the Content API / SDK.
publicKeypk_… or dk_…Frontend key for macro.config.js.
apiBaseUrlURLAPI host — https://api.macrocontent.dev
MACRO_SECRET_KEYsk_… (env)Server-only for prerender — never in browser config.
X-Macro-Tokenmt_… (env)Management automation — Dashboard API tokens.

  1. Open Settings → SDK

    In the website sidebar open Settings, then the SDK tab. You will see the website id and key material for PUBLIC (pk_) and optional DEVELOPMENT (dk_) keys.

  2. Choose Public vs Development

    Use pk_ for production origins you list on the key. Prefer dk_ for staging or development so you can disable that access without rotating production. Details on SDK keys.

  3. Set apiBaseUrl

    Use https://api.macrocontent.dev in macro.config.js together with websiteId and publicKey.

  4. Keep secrets on the server

    Never put sk_ (legacy secret) or mt_ (management token) in macro.config.js or any Vite client bundle. Prerender/CI uses env MACRO_SECRET_KEY; automation uses API tokens.

Origins

PUBLIC keys enforce allowedOrigins. Align them with domains you mark primary/active in Domains. See SDK keys for origin rules and Development keys.

Do

  • Commit only pk_ / dk_ in frontend config (still rotate if leaked).
  • Store mt_ / sk_ in CI secrets.

Don’t

  • Don’t paste management tokens into the browser SDK.
  • Don’t reuse one production pk_ on untrusted third-party origins.

Next

Put values into macro.config.js and continue the Quickstart.