Delivery Access Token

A DeliveryAccessToken is a read-only token used to read published content from the CDA (public delivery). When a website or app's browser fetches published content, it calls the CDA with this token. At issue time it is bound to a single SpaceRole, and that role determines the token's read scope (which Content Types it can read).

In CMA, a DeliveryAccessToken is a sub-resource of Space, and its path is based on /spaces/{spaceId}/delivery-access-tokens. Because this token operates while exposed to the browser (client), the role you bind to it must be a least-privilege role that reads only the Content Types you actually need (see Security: least-privilege binding below).

Resource structure

The following is the response when a DeliveryAccessToken is created. The token value and scope live in sys (system properties), while name and description are body properties.

{
  "sys": {
    "id": "3trmXRM3RqbgSnifyg7PUGndFQrblq",
    "type": "DeliveryAccessToken",
    "space": { "sys": { "id": "tcq4V2Xb", "type": "Refer", "targetType": "Space" } },
    "user": { "sys": { "id": "3trmXRLdJIqc9GPBbyFYQQw6hf9kGj", "type": "Refer", "targetType": "User" } },
    "createdBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } },
    "createdAt": "2026-06-18T09:25:32.624Z",
    "updatedBy": { "sys": { "id": "3trmXRM3RqbgSnifyg7PUGnban93rP", "type": "Refer", "targetType": "User" } },
    "updatedAt": "2026-06-18T09:25:32.624Z",
    "accessToken": "DVRATbQ8mX2vK9pLs7Rf1Zt0Nc4Wd6Hg5Ua2Ee9Ck3PoYx8Bj6Hg5Ua2Ee9Ck3Po…",
    "scopes": ["DELIVERY_ACCESS_TOKEN"]
  },
  "description": "Read-only delivery token for the clothing store public site",
  "name": "Public website delivery"
}

Key properties:

• sys.id: The unique identifier of the DeliveryAccessToken. It goes into {deliveryAccessTokenId} in the single-read, update, and delete paths.
• sys.accessToken: The secret token value used to call the CDA. The same value is returned on subsequent reads after issuance, so handle it with care (see the security section below).
• sys.scopes: The token's permission scope. A DeliveryAccessToken is always ["DELIVERY_ACCESS_TOKEN"] at issue time.
• sys.user: The dedicated user that is the authority subject of this token. It is created automatically at issue time, and the permissions of the bound SpaceRole are granted to this user. In other words, the token's effective permissions come from this user. It is a different user from the person who actually issued the token (sys.createdBy).
• name: The token name you specify on creation (e.g. Public website delivery).
• description: A description of the token (optional).

The accessToken in the example above is a secret value, so it is replaced with an example string. In reality it is a long, opaque string, and reading it again after issuance returns the same value.

System properties (sys)

Every DeliveryAccessToken carries common system properties and token-specific properties in the sys object. space, user, createdBy, and updatedBy are in the Refer shape ({ "sys": { "id", "type": "Refer", "targetType" } }).

Body properties:

Security: least-privilege binding

A DeliveryAccessToken calls the CDA while exposed to the browser and to visitors. Because of this, which SpaceRole you bind it to is exactly what defines the token's security boundary.

• In the create request's role, put the sys.id of a least-privilege SpaceRole that reads only the Content Types you need. A read-only role is recommended for public delivery.
• Never bind the Administrator role. Since this token is exposed to the client, binding a role that carries management privileges leaks those privileges externally as-is. Also, do not absentmindedly use the first item in the SpaceRole list; explicitly specify the sys.id of the intended least-privilege role.
• accessToken is a secret value that is returned with the same value on reads after issuance. Inject it safely into the client build, but do not expose it externally as-is.

API

The base URL for all endpoints below is https://cma.weegloo.com/v1, and a Bearer token that authenticates against CMA is required in the Authorization header. Updating and partially updating a DeliveryAccessToken does not require the X-Weegloo-Version header.

Related documents

• SpaceRole: Defines the role (read scope) to bind to this token.
• CDA overview: The delivery API that reads published content with this token.
• Personal Access Token: A Weegloo User token for servers and CI.