Skip to content
CMS Max Documentation

API Access

Create, rotate, revoke, and remove API access for integrations that connect to your CMS Max site.

Overview

Use the API screen when you need to connect your site to an external system such as an integration, automation tool, or custom application.

Each API entry has one current token. If you rotate the token, the old token stops working immediately and you must update the integration with the new one.

Opening API Access

  1. In the admin panel, go to Settings > API.
  2. Review the list of existing API entries.

The list shows whether each entry has an active token, when the token was created, when it was last used, and when it expires.

Creating a New API Entry

  1. Go to Settings > API.
  2. Click Create.
  3. Enter a name that clearly identifies the integration.
  4. Choose Initial Token Expiration.
  5. Click Create.

After the entry is created, CMS Max shows the token once. Add that token to the external system right away.

Exception: if you create an entry named Zapier, CMS Max always creates that token without expiration.

Important: You cannot reopen the same token value later. If you lose it, rotate the token and use the new one instead.

Rotating a Token

  1. Go to Settings > API.
  2. Find the API entry you want to update.
  3. Click Rotate Token.
  4. Choose the new expiration option.
  5. Confirm the action.
  6. Copy the new token and update the external system.

Rotating replaces the current token immediately. Any app still using the previous token will stop working until you update it.

Exception: the Zapier API entry does not allow an expiration choice when rotating. Zapier tokens always use No expiration.

Revoking a Token

  1. Go to Settings > API.
  2. Find the API entry you want to disable.
  3. Click Revoke Token.
  4. Confirm the action.

Revoking removes the current token but keeps the API entry itself. This is useful if you want to temporarily disable access without removing the entry name or its settings.

After revoking, the entry will show no current token until you rotate or create a new one.

Deleting an API Entry

  1. Go to Settings > API.
  2. Find the API entry you no longer need.
  3. Click Delete.
  4. Confirm the action.

Delete removes the entry itself. Use this when the integration is no longer needed at all.

Exception: the Zapier API entry cannot be revoked or deleted while the Zapier plugin is still installed. Use the Zapier plugin page if you want the plugin-specific token management flow.

Choosing an Expiration

When you create or rotate a token, you can choose:

  • No expiration
  • 1 day
  • 1 week
  • 1 month
  • 1 year

If a token expires, the connected system will no longer be able to access the API until you rotate the token and update the integration.

Reading the Token Columns

The API list includes these token-related columns:

Column What it means
Token Whether the current token is active, expired, or missing
Token Created When the current token was issued
Last Used The last time CMS Max accepted that token on an API request
Expires When the current token will expire, or whether it has no expiry

Viewing API Logs

  1. Go to Settings > API.
  2. Click API Logs.

Use the logs to review recent API traffic and help troubleshoot failed or unexpected requests.

Common Situations

A client exists but shows no token

This usually means the token was revoked. Rotate the token to issue a new one.

An integration suddenly stopped working

Check these first:

  1. The token may have expired.
  2. The token may have been rotated and the external system still has the old one.
  3. The token may have been revoked.

I need to replace a token without deleting the API entry

Use Rotate Token. This keeps the entry and replaces only the current token.