ButterCMS vs Ghost

ButterCMS

The Read and Write APIs have a public OpenAPI 3.1 file, Markdown docs and a status page with no incident since October 2025. The Write API is a paid add-on from the $249 plan, capped at 2,000 or 5,000 calls a month. Writes answer 202 with no identifier, support rotates tokens, and the terms are an undated website document.

Ghost

A create needs only a title, updates are checked against updated_at so a stale write is refused, and a Contributor's staff token can draft without being able to publish. The Admin API has no OpenAPI file and one fixed permission set per integration, and 20 security advisories were published between 3 September and 1 October 2026.

ButterCMS

1. End every path with a slash. A missing slash returns a 301, and the vendor counts the redirect and the retry as two API calls
2. Send the write token only as Authorization: Token <token>. The auth_token query parameter works for reads only
3. On page creation send every field key of the page type, with empty strings for fields left blank
4. A 202 means queued, not saved. Read the entry back with preview=1 to confirm, and check a slug exists before retrying a create
5. Call the REST API directly for writes. The JavaScript SDK 3.0.3 has list, retrieve and search methods only

Ghost

1. Sign a fresh HS256 token for each batch of calls. Decode the hex secret to bytes, set kid to the key id, aud to /admin/ and exp at most 5 minutes ahead
2. Set status to draft on every create unless told to publish, and publish later with a PUT that sets status to published
3. GET the post before each PUT and send its updated_at back. Tags and authors in a PUT replace the existing lists
4. Send content as a Lexical JSON string, or add ?source=html and send html. The HTML conversion is lossy unless wrapped in an HTML card
5. Page through lists with limit up to 100 and page. Since Ghost 6.0 limit=all returns 100 items without an error