---
title: "Academy Article"
canonical_url: "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api"
locale: en
meta:
"og:title": "Academy Article"
---
[Go to home](https://academy.laioutr.com/en)
- [For developers](https://academy.laioutr.com/en/bereiche/for-developers)
- [Platform and APIs](https://academy.laioutr.com/en/leitfaeden/platform-and-apis)
- [Delivery API, Management API and Assets API](https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api)
# Delivery API, Management API and Assets API
The Delivery API serves published Laioutr content to frontends and other channels, the Management API creates and changes content and assets programmatically. The assets part runs through the storefront's /api/public/media/\* routes and is authorised with a project-bound restricted key.
## Before you start
- Role
- Permission to manage organisation API keys and project settings
- Duration
- 8 min
### Prerequisites
- Deployed storefront
- Restricted key with the matching scopes
Last reviewed on October 15, 2026
Laioutr exposes content and assets through dedicated APIs, so systems outside Cockpit and Studio can work with them.
- **Delivery API**: serves published content to storefronts and other consumers. The storefront itself reads content collection entries through it, drafts in preview.
- **Management API**: creates, changes and manages content and assets programmatically, without going through Cockpit or Studio.
- **Assets API**: six routes under the storefront's `/api/public/media/` to list libraries, browse, upload and edit assets. The same call reaches Shopify Files, the Laioutr CDN or a custom DAM, and the response stays the same.
The asset routes are built for clients such as internal tools, partner pages, migration scripts or an MCP server. A **restricted key** is bound to exactly one project and carries only the selected scopes `media:read`, `media:write` or `media:delete`. There is no rate limiting; control lies in revoking individual keys. Every storefront describes the routes as an OpenAPI document at `/api/public/openapi.json`.
## Step by step
1. 1 ### Step 1: Allow an origin
Add at least one origin under **Allowed origins** in the project settings and redeploy. Without an entry, every route under `/api/public/` answers `404`.
2. 2 ### Step 2: Create a restricted key
Under **API keys**, use **Create key**, choose the **Restricted** type, select the project and tick only the scopes needed. The full value is shown once.
3. 3 ### Step 3: Query the libraries
Call `POST /api/public/media/libraries` with `Authorization: Bearer rstk_…`. The response lists the libraries and their capabilities for all further calls.
4. 4 ### Step 4: Generate a client
Import `/api/public/openapi.json` into Postman, Insomnia or Bruno, or generate a typed client from it with `openapi-typescript`.
## Frequently asked questions
Why does every route answer 404?
The project has no origin under **Allowed origins** yet, or the storefront was not redeployed since the change. The list only reaches the storefront with the build.
Does server-to-server access work?
Yes. A call without an `Origin` header does not come from a browser, so the key alone authorises it. For custom per-user rules, keep the key in a backend and forward requests.
Does an organisation API key work for the asset routes?
No. The routes only accept restricted keys, and a restricted key in turn only works there.
## Related
- [Create and manage API keys](https://academy.laioutr.com/en/artikel/create-and-manage-api-keys)6 min
API keys are created in the organisation settings under API keys. An organisation key authenticates the CLI and CI/CD, a restricted key gives an external application access to one project's media only.
- [Declare content collections in code](https://academy.laioutr.com/en/artikel/declare-content-collections-in-code)15 min
The project defines which content types the Laioutr CMS manages in the collections option of @laioutr-app/cms. After the next deployment, the types appear in Cockpit under Content, and their entries answer Orchestr queries like any other backend.
- [Manage media in Cockpit and Studio](https://academy.laioutr.com/en/artikel/manage-media-in-cockpit-and-studio)5 min
Images, videos and audio files are managed centrally in the Media Library under Content in Cockpit. In Studio, the media picker selects files from every connected library, such as the shop system, and uploads new ones where the library allows it.
- [Connect Laioutr MCP to an AI assistant](https://academy.laioutr.com/en/artikel/connect-laioutr-mcp-to-an-ai-assistant)5 min
Laioutr MCP connects Claude, ChatGPT, Cursor or another MCP client to Laioutr projects via OAuth. Once Laioutr has enabled it, signing in with the Laioutr account is enough; no API key is needed.
## Learn it in a lesson
- [Understand the architecture](https://academy.laioutr.com/en/lektionen/developer-architecture)10 min
## [Platform and APIs](https://academy.laioutr.com/en/leitfaeden/platform-and-apis)
Search this guide
1. [Delivery API, Management API and Assets API](https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api)8 min
2. [Design System 1.0: tokens, colour scales and themes](https://academy.laioutr.com/en/artikel/design-system-1-0-tokens-colour-scales-and-themes)7 min In preparation
## Structured Data
```json
{
"@context": "https://schema.org",
"@graph": [
{
"@id": "https://academy.laioutr.com/#website",
"@type": "WebSite",
"inLanguage": "en",
"name": "Default",
"url": "https://academy.laioutr.com/",
"translationOfWork": {
"@id": "https://academy.laioutr.com/#website"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#webpage",
"name": "Academy Article",
"url": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api",
"@type": [
"WebPage",
"FAQPage"
],
"breadcrumb": {
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#breadcrumb"
},
"isPartOf": {
"@id": "https://academy.laioutr.com/#website"
},
"mainEntity": [
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/1"
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/2"
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/3"
}
],
"potentialAction": [
{
"@type": "ReadAction",
"target": [
"https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api"
]
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#breadcrumb",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"name": "Home",
"item": "https://academy.laioutr.com/en",
"position": 1
},
{
"@type": "ListItem",
"name": "For developers",
"item": "https://academy.laioutr.com/en/bereiche/for-developers",
"position": 2
},
{
"@type": "ListItem",
"name": "Platform and APIs",
"item": "https://academy.laioutr.com/en/leitfaeden/platform-and-apis",
"position": 3
},
{
"@type": "ListItem",
"name": "Delivery API, Management API and Assets API",
"item": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api",
"position": 4
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/1",
"@type": "Question",
"inLanguage": "en",
"name": "Why does every route answer 404?",
"acceptedAnswer": {
"@type": "Answer",
"text": "The project has no origin under Allowed origins yet, or the storefront was not redeployed since the change. The list only reaches the storefront with the build.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/2",
"@type": "Question",
"inLanguage": "en",
"name": "Does server-to-server access work?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. A call without an Origin header does not come from a browser, so the key alone authorises it. For custom per-user rules, keep the key in a backend and forward requests.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/delivery-management-and-assets-api#/schema/question/3",
"@type": "Question",
"inLanguage": "en",
"name": "Does an organisation API key work for the asset routes?",
"acceptedAnswer": {
"@type": "Answer",
"text": "No. The routes only accept restricted keys, and a restricted key in turn only works there.
"
}
}
]
}
```