Ghost CMS
Manage Ghost blog content, members, analytics, and newsletters through the Ghost Admin API.
⚠️ Security Warning
Ghost Admin API keys provide FULL access to your Ghost site:
- - Content Management: Create, update, delete, publish posts and pages
- Member Management: Add, modify, delete members and subscriptions
- Subscription Management: Create, modify, delete membership tiers
- Comment Management: Reply to, approve, delete comments
- User Management: Invite, modify, delete users
- Media Management: Upload images and files (affects storage)
- Site Configuration: Modify newsletters and settings
Published content is IMMEDIATELY PUBLIC - be extra careful with publish operations.
Security Best Practices:
- - Store API keys securely - Use 1Password CLI or secure env vars
- Review before publishing - Always check content before making it public
- Never commit keys - Keep credentials out of version control
- Rotate keys regularly - Create new integrations every 90 days
- Use dedicated integrations - Separate keys for different use cases
- Test on staging first - Use a test Ghost site when possible
Admin API Key Scope:
Ghost Admin API keys have no scoping options - they provide full access to everything. There are no read-only keys.
Operation Types:
Read-Only Operations (✅ Safe):
- - List posts, pages, tags, members, tiers, newsletters, comments
- Get analytics and member stats
- All GET requests
Destructive Operations (⚠️ Modify or delete data, may be public):
- - Create/update/delete posts, pages, tags (POST, PUT, DELETE)
- Publish/unpublish/schedule posts (makes content public)
- Create/update/delete members, tiers, newsletters
- Create replies, approve/delete comments
- Upload images (uses storage quota)
- All POST, PUT, DELETE requests
For detailed operation documentation, see api-reference.md.
Quick Setup
- 1. Get your Ghost Admin API credentials:
- Ghost dashboard → Settings → Integrations
- Create a new "Custom Integration"
- Copy the
Admin API Key and
API URL
- 2. Store credentials securely:
Option A: Environment Variables (Recommended)
CODEBLOCK0
API URL Examples (works with ALL hosting types):
CODEBLOCK1
Important:
- Always include protocol (http:// or https://)
- Include :PORT if Ghost runs on non-standard port
- Do NOT include trailing slash
- Do NOT include /ghost/api/admin (added automatically)
Option B: Config Files
CODEBLOCK2
Option C: 1Password CLI (Most Secure)
CODEBLOCK3
Security Notes:
- Keys provide full site access - protect them like passwords
- Rotate keys every 90 days (create new integration, revoke old)
- Never commit to git or share keys publicly
- Consider separate keys for production vs. staging
- HTTPS recommended: Use HTTPS for production (HTTP acceptable for localhost only)
- 3. Install dependencies:
CODEBLOCK4
Dependencies installed:
- form-data (^4.0.5) - Multipart file uploads (theme ZIP files)
- jsonwebtoken (^9.0.3) - JWT token generation for Ghost Admin API authentication
Optional dependencies (install manually if needed):
- gscan (^5.2.4) - Official Ghost theme validator (from TryGhost)
- Only needed for theme validation feature
- Install with: INLINECODE7
All dependencies from public npm registry. No custom downloads.
- 4. Test connection:
See
setup.md for detailed authentication and troubleshooting.
Tools & Utilities
Snippet Extractor
Purpose: Migrate existing Ghost snippets to local library for programmatic use.
Why needed: Ghost Admin API blocks snippet access (403 Forbidden) for integration tokens. This tool works around that limitation.
Usage:
CODEBLOCK5
Workflow:
- 1. Create draft post in Ghost
- For each snippet: add paragraph marker (e.g., "SNIPPET: name" or "This is: name")
- Insert the snippet content below each marker
- Run extractor → all snippets saved to INLINECODE8
Features:
- - ✅ Extracts all card types (bookmarks, callouts, images, markdown, HTML, etc.)
- ✅ Preserves exact Lexical structure
- ✅ Auto-detects credentials from
~/.config/ghost/ or env vars - ✅ Supports custom marker formats
- ✅ Dry-run and validation modes
- ✅ Verbose output for debugging
Example:
CODEBLOCK6
See snippets/README.md for complete documentation.
Theme Manager
Purpose: Upload, activate, switch, and manage Ghost themes programmatically.
Why needed: Automate theme deployments, switch themes, manage theme versions.
Usage:
CODEBLOCK7
Features:
- - ✅ Upload custom themes from ZIP files
- ✅ Switch between installed themes
- ✅ Download theme backups
- ✅ Delete unused themes
- ✅ Validation and error handling
- ✅ Immediate activation - theme changes are public instantly
⚠️ Important:
- - Theme activation is immediate and public - site appearance changes instantly
- Cannot delete the currently active theme (switch first)
- Themes must be valid Ghost theme ZIP files
Workflow:
CODEBLOCK8
See references/themes.md for complete theme management documentation and best practices.
Theme Validator
Purpose: Validate Ghost themes before uploading using official gscan validator.
⚠️ Optional Feature: Requires gscan package. Install with:
CODEBLOCK9
Why needed: Catch errors early - missing files, invalid syntax, deprecated helpers, version incompatibility.
Usage:
CODEBLOCK10
Features:
- - ✅ Official Ghost validator (gscan from TryGhost)
- ✅ Same validation as Ghost Admin
- ✅ Validates directories or ZIP files
- ✅ Ghost v5/v6 compatibility checking
- ✅ Finds deprecated helpers and syntax errors
- ✅ CI/CD integration (JSON output, exit codes)
- ✅ Categorized issues (errors, warnings, recommendations)
Validation levels:
- - Errors - Must fix before upload (theme will be rejected)
- Warnings - Should fix for best compatibility
- Recommendations - Nice to have (best practices)
Safe deployment workflow:
CODEBLOCK11
CI/CD integration:
CODEBLOCK12
Exit codes: 0 = valid, 1 = errors found, 2 = invalid arguments
See references/themes.md for complete validation documentation and common error fixes.
Core Operations
This skill covers all major Ghost operations. Navigate to the relevant reference for detailed guidance:
Content Management
When to use: Creating drafts, publishing posts, scheduling content, managing pages
See content.md for:
- - Creating new posts (drafts)
- Publishing and scheduling posts
- Updating existing content
- Managing tags, featured images, metadata
- Working with pages vs posts
See lexical-cards.md for:
- - Complete Lexical card type reference (23 documented types)
- Most comprehensive Ghost Lexical documentation available
- Full JSON structures with field references
- Video, audio, file uploads, buttons, toggles, embeds
- Product cards, headers, call-to-action, paywall
- Member visibility and content personalization
⚠️ Ghost Snippets Limitation:
Ghost's native snippet feature (reusable content blocks saved in the editor) cannot be accessed via the Admin API with integration tokens (403 Forbidden). This means:
- - ❌ Cannot list available snippets
- ❌ Cannot fetch snippet content
- ❌ Cannot programmatically use author's existing snippets
Solution: Automated Snippet Extraction
The skill includes a snippet extractor tool that migrates Ghost snippets to local files:
- 1. Create extraction post in Ghost with all snippets (one-time setup)
- Run extractor: INLINECODE14
- Done! All snippets saved to
snippets/library/ for programmatic use
Commands:
CODEBLOCK13
Benefits:
- - ✅ Migrate all existing Ghost snippets in seconds
- ✅ Preserves exact Lexical structure (bookmarks, callouts, images, etc.)
- ✅ Git version control
- ✅ Use programmatically in automated posts
- ✅ Works with any card types
See snippets/README.md for complete documentation on extraction workflow and local snippet usage.
Analytics & Insights
When to use: Checking subscriber counts, popular content, traffic trends
See analytics.md for:
- - Subscriber growth and counts
- Most popular posts (views, engagement)
- Tag/topic performance over time
- Member tier distribution
Comments & Engagement
When to use: Responding to comments, moderating discussions
See comments.md for:
- - Listing pending/unanswered comments
- Responding to comments
- Comment moderation
Members & Subscribers
When to use: Managing subscriber tiers, member access, premium content
See members.md for:
- - Subscriber tier management
- Member-only content settings
- Recent subscriber activity
- Subscription status
Newsletters
When to use: Managing newsletter settings, email campaigns
See newsletters.md for:
- - Newsletter configuration
- Sending newsletters
- Subscriber email settings
API Reference
For advanced operations or endpoint details, see api-reference.md.
Common Workflows
Draft → Notion → Ghost:
- 1. Draft content collaboratively in Notion
- Finalize content
- Use this skill to copy to Ghost as draft
- Review in Ghost admin
- Schedule or publish
Weekly content series:
- 1. "Navi, write and publish a unique weekly post about [topic from our discussions this week]"
- Skill creates post, sets author to "Navi", publishes automatically
Comment management:
- 1. "Are there any pending comments?"
- Review list of comments with post titles
- "Respond to comment #123 with [response]"
Analytics check:
- 1. "What tags have been most popular in the past 6 months?"
- "How many new subscribers this month?"
- "When was my last subscriber-exclusive post?"
Ghost CMS
通过Ghost Admin API管理Ghost博客内容、会员、分析数据和新闻通讯。
⚠️ 安全警告
Ghost Admin API密钥可完全访问您的Ghost网站:
- - 内容管理: 创建、更新、删除、发布文章和页面
- 会员管理: 添加、修改、删除会员和订阅
- 订阅管理: 创建、修改、删除会员等级
- 评论管理: 回复、批准、删除评论
- 用户管理: 邀请、修改、删除用户
- 媒体管理: 上传图片和文件(影响存储空间)
- 站点配置: 修改新闻通讯和设置
已发布内容立即公开 - 发布操作需格外谨慎。
安全最佳实践:
- - 安全存储API密钥 - 使用1Password CLI或安全环境变量
- 发布前审查 - 在公开前始终检查内容
- 切勿提交密钥 - 将凭证排除在版本控制之外
- 定期轮换密钥 - 每90天创建新的集成
- 使用专用集成 - 不同用途使用不同密钥
- 先在测试环境测试 - 尽可能使用测试Ghost网站
Admin API密钥范围:
Ghost Admin API密钥没有范围选项 - 它们提供对所有内容的完全访问权限。没有只读密钥。
操作类型:
只读操作(✅ 安全):
- - 列出文章、页面、标签、会员、等级、新闻通讯、评论
- 获取分析数据和会员统计
- 所有GET请求
破坏性操作(⚠️ 修改或删除数据,可能公开):
- - 创建/更新/删除文章、页面、标签(POST、PUT、DELETE)
- 发布/取消发布/定时发布文章(使内容公开)
- 创建/更新/删除会员、等级、新闻通讯
- 创建回复、批准/删除评论
- 上传图片(使用存储配额)
- 所有POST、PUT、DELETE请求
有关详细操作文档,请参阅api-reference.md。
快速设置
- 1. 获取您的Ghost Admin API凭证:
- Ghost仪表板 → 设置 → 集成
- 创建新的自定义集成
- 复制
Admin API密钥和
API URL
- 2. 安全存储凭证:
选项A:环境变量(推荐)
bash
# 添加到您的shell配置文件(~/.zshrc、~/.bashrc)
export GHOSTADMINKEY=YOURADMINAPI_KEY
export GHOSTAPIURL=YOURGHOSTURL
API URL示例(适用于所有托管类型):
bash
# Ghost(Pro)托管
export GHOSTAPIURL=https://yourblog.ghost.io
# 自托管带反向代理(生产环境)
export GHOSTAPIURL=https://blog.yourdomain.com
# 自托管开发环境(Ghost默认端口2368)
export GHOSTAPIURL=http://localhost:2368
# 自托管自定义端口
export GHOSTAPIURL=https://ghost.example.com:8080
重要提示:
- 始终包含协议(http://或https://)
- 如果Ghost运行在非标准端口上,请包含:PORT
- 不要包含尾部斜杠
- 不要包含/ghost/api/admin(会自动添加)
选项B:配置文件
bash
mkdir -p ~/.config/ghost
echo YOURADMINAPIKEY > ~/.config/ghost/apikey
echo YOURGHOSTURL > ~/.config/ghost/api_url
# 保护文件(仅所有者可读)
chmod 600 ~/.config/ghost/api_key
chmod 600 ~/.config/ghost/api_url
选项C:1Password CLI(最安全)
bash
# 在1Password中存储密钥
op item create --category=API_CREDENTIAL \
--title=Ghost Admin API \
adminkey[password]=YOURADMINAPIKEY \
apiurl[text]=YOURGHOST_URL
# 在命令中使用
export GHOSTADMINKEY=$(op read op://Private/Ghost Admin API/admin_key)
export GHOSTAPIURL=$(op read op://Private/Ghost Admin API/api_url)
安全说明:
- 密钥提供完整的站点访问权限 - 像保护密码一样保护它们
- 每90天轮换一次密钥(创建新集成,撤销旧集成)
- 切勿提交到git或公开分享密钥
- 考虑为生产环境和测试环境使用不同密钥
- 推荐使用HTTPS: 生产环境使用HTTPS(仅localhost可接受HTTP)
- 3. 安装依赖:
bash
cd ghost-cms-skill/scripts
npm install
已安装的依赖:
- form-data (^4.0.5) - 多部分文件上传(主题ZIP文件)
- jsonwebtoken (^9.0.3) - Ghost Admin API认证的JWT令牌生成
可选依赖(如需请手动安装):
- gscan (^5.2.4) - 官方Ghost主题验证器(来自TryGhost)
- 仅主题验证功能需要
- 安装方式:cd scripts && npm install gscan
所有依赖均来自公共npm注册表。无需自定义下载。
- 4. 测试连接:
有关详细认证和故障排除,请参阅
setup.md。
工具与实用程序
代码片段提取器
目的: 将现有Ghost代码片段迁移到本地库以供编程使用。
为什么需要: Ghost Admin API阻止集成令牌访问代码片段(403禁止)。此工具绕过了该限制。
用法:
bash
从特殊格式的草稿文章中提取代码片段
node scripts/snippet-extractor.js my-snippets-post
提取前验证格式
node scripts/snippet-extractor.js my-snippets-post --validate
预览而不保存
node scripts/snippet-extractor.js my-snippets-post --dry-run
自定义标记前缀
node scripts/snippet-extractor.js my-snippets-post --marker This is:
完整帮助
node scripts/snippet-extractor.js --help
工作流程:
- 1. 在Ghost中创建草稿文章
- 为每个代码片段添加段落标记(例如,SNIPPET: name或This is: name)
- 在每个标记下方插入代码片段内容
- 运行提取器 → 所有代码片段保存到snippets/library/
功能:
- - ✅ 提取所有卡片类型(书签、标注、图片、Markdown、HTML等)
- ✅ 保留精确的Lexical结构
- ✅ 自动从~/.config/ghost/或环境变量检测凭证
- ✅ 支持自定义标记格式
- ✅ 试运行和验证模式
- ✅ 详细输出用于调试
示例:
bash
用户在Ghost中有12个代码片段
创建带有标记的My Snippets草稿
运行:node scripts/snippet-extractor.js my-snippets --marker This is:
结果:所有12个代码片段在library/中准备就绪
完整文档请参阅snippets/README.md。
主题管理器
目的: 以编程方式上传、激活、切换和管理Ghost主题。
为什么需要: 自动化主题部署、切换主题、管理主题版本。
用法:
bash
cd scripts
列出所有已安装的主题
node theme-manager.js list
上传主题ZIP
node theme-manager.js upload /path/to/theme.zip
上传并立即激活
node theme-manager.js upload /path/to/theme.zip --activate
激活现有主题
node theme-manager.js activate theme-name
下载主题备份
node theme-manager.js download theme-name backup.zip
删除主题(不能删除活动主题)
node theme-manager.js delete old-theme
显示当前活动主题
node theme-manager.js active
功能:
- - ✅ 从ZIP文件上传自定义主题
- ✅ 在已安装的主题之间切换
- ✅ 下载主题备份
- ✅ 删除未使用的主题
- ✅ 验证和错误处理
- ✅ 即时激活 - 主题更改立即公开
⚠️ 重要提示:
- - 主题激活是即时且公开的 - 站点外观立即更改
- 不能删除当前活动主题(先切换)
- 主题必须是有效的Ghost主题ZIP文件
工作流程:
bash
安全的主题切换(带回滚)
node