Everything Duggie Can Do

A complete reference of every feature across content management, publishing, the public API, live preview, team tools, audit logging, and security.

Content Management

Everything you need to create, manage, and deliver content from a single place.

Multiple Asset Types

Manage text, HTML, JSON, and images all under one roof, with no separate tools required. HTML can be written as code or edited visually with a toolbar.

  • Plain text for headings, labels, and copy
  • Rich HTML in a code editor or a visual editor, with sanitization and configurable validation rules
  • Structured JSON with custom field definitions
  • Images with upload, storage, and delivery via Cloudflare R2

Multi-Locale Content

Deliver content in multiple languages from the same asset, with per-locale drafts and publishing.

  • Add any number of locales per project
  • First locale automatically becomes the default
  • Filter API responses by language query param
  • Independent draft and publish states per locale

Tag-Based Asset System

Assets are identified by a simple string tag. No schema setup, no IDs to manage.

  • Fetch a single asset by tag in one API call
  • Batch-fetch multiple tags in one request
  • Filter by tag list from your frontend
  • Consistent addressing across environments

Batch Upsert via API

Push content updates from your own pipeline using the server-side Secret key.

  • Upsert up to 100 assets per request
  • Locale-aware content dictionary per asset
  • Optionally publish immediately on write
  • Ideal for CI/CD content seeding workflows

Publishing Workflow

A structured approval-to-publish flow that keeps editors safe and owners in control.

Draft to Published Lifecycle

Every asset starts as a draft. Published content is what your API serves. Drafts never leak.

  • Draft, Review Pending, Ready to Publish, Published, Disabled
  • Drafts are never exposed via the public API
  • Disable published assets without deleting them
  • Full lifecycle history captured in audit log

Approval Workflow

Require editor changes to be reviewed and approved before they can go live.

  • Per-asset approval gate (configurable)
  • Editors submit for review; Admins approve or reject
  • Rejection notes visible to editors
  • Approved state required before publish

Asset Locking

Prevent conflicting edits by locking an asset while work is in progress.

  • Lock an asset to yourself while editing
  • Locked-by display name visible to the team
  • Admins and Owners can force-unlock
  • Lock state resets automatically on publish

Version History

Every save creates a new version. Review what changed and when, with full rollback support.

  • Stores 10 previous versions for image assets
  • Stores 50 previous versions for non-image types
  • View content diffs between versions
  • Version number shown in the activity log
  • Versions scoped per locale

Public API

A clean, minimal API your frontend can call with a single fetch.

Dual API Key Architecture

Two distinct keys for two distinct contexts. Client key for the browser, Secret key for your server.

  • Client key: built to ship in frontend code
  • Secret key: restricted to server-side use
  • CORS origin locking on the Client key
  • Keys are independently rotatable and revocable

Allowed Origins (CORS)

Lock your Client key to specific domains so it cannot be used from unexpected origins.

  • Add one or more allowed origins per project
  • Browser requests from unlisted origins are rejected
  • Server-side requests (no Origin header) always pass
  • Changes tracked in the project audit log

Response Caching

API responses are cached server-side to keep latency low and quota usage efficient.

  • Cache hit/miss signaled via X-Duggie-App-Cache header
  • Cache bypassed automatically for preview tokens
  • Invalidated on publish or content change
  • No CDN setup required on your end

Rate Limiting & Metering

No monthly request limit on paid projects, with rate limiting that protects the API without metering you.

  • Unlimited requests for your paid project projects
  • Intelligent rate limiting protects all public endpoints
  • Usage dashboard shows current month consumption
  • Storage add-ons available when you need more room

Live Preview

See draft content on your real site before it goes live.

Short-Lived Preview Tokens

Generate a time-limited URL that serves draft content on your live website.

  • Opaque tokens with a short, configurable expiry
  • Preview URL built from your project website setting, token appended automatically
  • Read-only: a preview token cannot write content
  • Expired tokens fall back to published content

Team & Project Management

Per-project roles and isolated workspaces built for the way agencies actually operate.

Multi-Project Workspaces

Each project is a fully isolated workspace with its own assets, keys, members, and settings.

  • Separate API keys and allowed origins per project
  • No cross-project content leakage
  • Project-level archive and restore
  • Usage and quota tracked independently per project

Role-Based Access Control

Three roles covering every part of the developer-to-client handoff.

  • Admin: manages members, keys, and access to dev tools
  • Editor: Edits and submits content changes
  • Viewer: read-only access to the dashboard

Email Invitations

Invite collaborators by email. They receive a typed invite link to join the project.

  • Invite-only access, no self-service join
  • Role assigned at invitation time
  • Pending invitations visible and cancelable
  • Owners and Admins are notified of membership changes

Ownership Transfer

Hand a project off to another member when your engagement ends.

  • Transfer to any existing project member
  • Previous owner becomes an Admin
  • Transfer recorded in the project audit log
  • No downtime or key rotation required

Audit & Activity Log

A complete, queryable record of everything that happens inside your project.

Project-Level Audit Trail

Every settings change, membership event, and key rotation is logged with the actor and timestamp.

  • Settings changes show exactly what field changed
  • Allowed Origins additions and removals captured
  • API key rotations, revocations, and generations logged
  • Ownership transfers and member role changes tracked

Asset-Level Activity Log

Every create, edit, publish, lock, review, and approval event is recorded per asset.

  • Content diffs shown inline in the activity feed
  • Before/after comparison for text, HTML, and JSON
  • Image changes shown as linked filenames
  • Version number linked to each publish event

Filterable Activity Feed

Slice the activity log by user, asset, action type, and date range.

  • Filter by team member display name
  • Filter by asset tag
  • Filter by action type (published, approved, etc.)
  • Date range picker with combined Apply button

Activity Export

Download the full activity log as JSON or CSV for audits, handoffs, or reporting.

  • Export all activity or a custom date range
  • JSON and CSV formats supported
  • Export range is independent of the page filter
  • Available to all project members

Security

Built-in protections that keep your content and your clients safe.

HTML Sanitization

Client-submitted HTML is sanitized server-side before storage, against an allow-list of permitted tags and attributes.

  • Allow-list based HTML sanitization on every save
  • Configurable per-asset allowed tags and attributes
  • Sanitization runs server-side, not in the browser
  • Raw HTML never stored unsanitized

Image Rebuilding

Uploaded images are decoded and rebuilt from their pixels before they are stored, so the file that lands in storage is not the file that was uploaded.

  • Format confirmed by decoding the file, not by trusting its name
  • Every image re-encoded, so anything hidden in the uploaded bytes does not survive
  • EXIF, IPTC, XMP and ICC metadata stripped by default
  • SVG is turned off by default and has to be enabled per asset

Authentication

All dashboard access requires authentication.

  • Adjustable timed authentication
  • Email verification required before generating your first API keys
  • Password reset via time-limited signed tokens
  • Turnstile bot protection on registration

Project Permission Guards

Every API endpoint enforces project membership and role.

  • Separate admin-only and edit-only permission levels
  • Demo sessions isolated from production data
  • No permission check duplication across processors

Ready to put these features to work?

Start free. No credit card required. No SDK needed.