Content API and receiver reference
Read approved content from your server and implement durable, signed publication delivery.
The Content API complements a connected destination. Reading a release does not confirm publication. Your receiver still implements the signed publication and withdrawal contract so Blogged can verify delivery and expose summary links.
Create a key
Open Integrations → Developer API. An owner or admin creates a key with Read approved content access and selects its destination. Copy the key when shown and keep it on your server. A separate Send server analytics key is for conversion events, not content reads.
Keys expire after 90 days, are shown once, and can be revoked from the same
section. A Project can have ten active keys. Each key permits 300 requests per
minute; honor HTTP 429 and Retry-After.
Read approved releases
curl 'https://app.blogged.dev/api/integrations/content?limit=10' -H 'Authorization: Bearer YOUR_SERVER_SIDE_KEY'The list returns releases for that key's destination. Follow nextCursor until
hasMore is false, then retain that cursor for polling. Pages contain at most
20 articles. The polling window overlaps by five seconds: deduplicate by
publication ID, revision, state and delivery state.
| Endpoint or result | Handling |
|---|---|
GET /api/integrations/content | Read destination-scoped approved releases, including summary-only projections |
GET /api/integrations/content/POST_ID | Read one approved release |
| HTTP 410 for a withdrawn article | Process the withdrawal tombstone; stop serving that managed copy |
| HTTP 409 for a waiting summary | Wait for the verified primary article and retry later |
Authenticated asset downloadUrl | Copy bytes from your server into your own durable storage and rewrite image URLs |
Do not expose keys in browser JavaScript, page HTML or image URLs. They are server credentials. Keep your Project's source blog domain valid so relative article links and managed image references can be resolved.
Receive signed operations
The Next.js receiver ZIP contains the implementation, deployment instructions and receiver tests. For another application, use the same versioned contract in the setup reference.
Validate X-Blogged-Timestamp and X-Blogged-Signature using HMAC-SHA256 over
timestamp + "." + rawBody and your shared signing secret. Reject stale timestamps
outside the five-minute window before processing the payload.
| Operation | Purpose |
|---|---|
connection.test | Verify receiver capabilities |
article.publish | Create or reconcile the managed publication |
article.inspect | Read its remote revision and content |
article.update | Apply an explicitly reviewed version conditionally |
article.withdraw | Remove the managed article from public service |
Preserve delivery IDs, durable publication IDs and revisions. Replayed requests
must not duplicate articles or overwrite a later version. An accepted response
means work is pending: send a signed completion receipt to
https://app.blogged.dev/api/integrations/receipts, or return the completed receipt
on redelivery. Copy all granted images before reporting completion. Temporary
image grants expire; do not hotlink them as permanent reader images.
Verify one publish, replay, update and withdrawal with disposable content before using a new receiver. Check both its durable records and public page; a successful HTTP response alone does not establish a published article.