bcms/ai
Overview
This skill teaches the AI how to work with BCMS for building and integrating content-driven applications. It provides concise, BCMS-specific guidance on connecting to the API, modelling content with templates/groups/widgets, managing media, securing access, and using functions/webhooks. The guidance favors practical defaults, TypeScript examples, and safe production practices.
How this skill works
The skill instructs the agent to initialize the BCMS client using environment variables and the @thebcms/client SDK, then perform common operations: list and manage templates, create/update entries, inspect groups and widgets, upload and retrieve media, and call functions or handle webhooks. It embeds integration principles: default to latest packages, prefer templates + entries for modelling, and always isolate secrets and scope API keys. Deeper how-to examples are referenced for each topic when needed.
When to use it
- Setting up a new project that will use BCMS as the content backend
- Designing content schemas: templates, groups, widgets and localized entries
- Integrating media-heavy frontends or optimizing image delivery
- Implementing server-side functions or webhook handlers with secure verification
- Auditing permissions and configuring least-privilege API keys for environments
Best practices
- Always read orgId, instanceId and API key credentials from environment variables; never hard-code secrets
- Use scoped API keys with least privilege per environment (dev/stage/prod) and separate keys for media delivery
- Model content using templates first, reuse groups/widgets for structure, and avoid stuffing unstructured JSON into meta/content
- Prefer BCMS UI components (BCMSContentManager, BCMSImage) for rendering rich text and media instead of custom parsers
- Before deleting templates/groups/widgets/media in production, inspect usage and plan a migration path
- Secure webhooks by verifying signatures, validating timestamps, and making handlers idempotent
Example use cases
- Create a multi-locale blog: define a blog template, use groups for author/SEO, and render via BCMSContentManager
- Build an image-rich gallery: store images in media library, use a media-only public key for delivery and BCMSImage for optimized variants
- Automate content workflows: trigger a function from a webhook on entry publish and verify the webhook signature before processing
- Migrate a schema safely: add new fields to templates and migrate existing entries rather than deleting templates in production
- Integrate with a frontend framework (Next/Nuxt): use the official CLI starter and generated @bcms-types for type-safe rendering
FAQ
No. Never expose admin or write-capable keys in public clients. Keep mutations server-side and use read-only or media-only keys in the browser.
How do I verify incoming webhooks?
Validate the X-Bcms-Webhook-Signature header, check timestamps to prevent replay attacks, and ensure your handler is idempotent.