# Read-only Admin API key or Content API key that can access private content

**URL:** <https://forum.ghost.org/t/read-only-admin-api-key-or-content-api-key-that-can-access-private-content/62040>\
**Category:** Ideas\
**Tags:** security\
**Created:** [February 27, 2026, 1:22pm UTC](https://forum.ghost.org/t/read-only-admin-api-key-or-content-api-key-that-can-access-private-content/62040 "2026-02-27T13:22:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![markstos](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/markstos/32/18182_2.png) [@markstos](https://forum.ghost.org/u/markstos)\
**Post date:** [February 27, 2026, 1:22pm UTC](https://forum.ghost.org/t/read-only-admin-api-key-or-content-api-key-that-can-access-private-content/62040/1 "2026-02-27T13:22:38Z")

</div>

Following the security principle of least access, it would improve security to offer a third API key that unlike the Content API key can access non-public content and unlike the Admin API key, only needs read-only access to things.

A full-text search engine that works private context would a great use of this. The service doesn’t need permission to post or delete photos, so using the admin API key has extra risk here.

---

<div class="post-metadata">

**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\
**Post date:** [February 27, 2026, 2:09pm UTC](https://forum.ghost.org/t/read-only-admin-api-key-or-content-api-key-that-can-access-private-content/62040/2 "2026-02-27T14:09:25Z")

</div>

100%. Meanwhile, a contributor staff token comes very close.