CubeSites Help
Cube apps and the API

Cube apps and the API

Automate with the API

Tokens, the JSON API for drafts, and the MCP server for AI assistants.

  • 3 minute read
  • One interactive walkthrough
  • For technical owners and developers

API tokens#

An API token lets a script work with a workspace as you: reading sites, managing a draft, anything the API offers and your permissions allow. Tokens are created in Settings, under API tokens, given a name that says what they are for, and shown once.

Treat a token like a password. If one leaks, revoke it there and then; scripts using it stop, nothing else is affected. A token can never grant more than the person who created it holds, so an automation does not out-rank its maker.

Your Company
CubeSitesYour Company
  • Home
  • Websites
  • Licences
  • Templates
  • Media
  • Cube apps
  • Settings
AI drafts, you decide4 of 100 drafts used this monthTrial9 days left

API tokens

A token lets a script work with this workspace's sites and messages.

Create a token

NameReporting script
Create token

Your tokens

shown once, then hiddenCopyReporting scriptRevoke

A token carries your permissions. Never share one, and revoke it if it is lost.

Step 1 of 4

Name it after the script

Six months from now, the name is the only clue about what a token was for.

Reduced motion is on, so the walkthrough waits for you. Use the arrows or pick a step.

  1. 1Open Settings, then API tokens, under Your account.
  2. 2Create a token and name it after the script, not the person.
  3. 3Copy it once into wherever the script keeps secrets.

The site JSON API#

The developer side of CubeSites is the same JSON the import and export files use. With the feature enabled, a site exposes an endpoint at /api/v1/workspaces/{workspace}/sites/{site}/json: a script can read the draft, change it wholesale or in part, and validate before sending.

Publishing is deliberately a separate action. An automation can manage the draft as much as it likes; making something live remains a person's press of Publish unless the script explicitly asks for it with the permissions to match.

Good to know: The JSON guide and schema on the developer pages describe every field, and generated sites can be imported like any other file.

AI assistants and the MCP server#

CubeSites has an MCP server, so AI assistants such as ChatGPT, Claude or a coding assistant can work with your websites. ChatGPT and Claude connect from Settings, under AI assistants, by signing in through CubeSites; other assistants use a personal API token. The assistant reads pages, posts and enquiries, edits the draft like the editor does, and gives you a preview link to check its work.

It can also make a whole website from scratch on a spare licence: blank, from a starter or saved template, from an AI draft, or from a complete website file, which is checked before anything is made. It looks at the licences first and tells you when none is spare; it can never buy one. It can list what is waiting to publish, and publishing always needs your agreement: it says what would go live and waits for you. A ChatGPT or Claude connection cannot publish at all, so you press Publish in CubeSites. An assistant using your personal API token can publish once you agree, if you could publish yourself.

Before you continue: Keep tokens out of any file that ends up in a repository, and never paste one into a prompt, a chat or a support message. Revoke first if one goes somewhere it should not.

Common questions

Is the API available on every plan?

The workspace API and token features come with a Pro website on the account. The JSON files themselves can be moved by hand on any plan.

Can the API publish a site?

Only with a token whose holder could publish anyway, and as a separate, explicit call. Through the MCP server an assistant asks before publishing, and ChatGPT or Claude connections cannot publish at all.

Can an assistant make a new website?

Yes, when a licence is spare. It can start blank, from a template, from a draft or from a website file, and the website is made on the spare licence. If none is spare it says so; a person buys licences in CubeSites.

Something here out of date, or a step that did not match what you see? Tell us and we will correct the guide. Never send a password or an API token.