# Website Kit
Source: https://docs.aden.space/docs/help/promote-grow/website-kit

A generated AI migration prompt, a live request playground and the read-only key rules that let an artist or organisation website render live Aden data, shows, tours, releases and media, refreshed on a schedule.
{/* Generated by `bun docs:publish` from docs/features/website-kit.md: edit the spec, not this file. */}

## What it is [#what-it-is]

Most artist websites are hand-maintained: a developer edits a file every time a
show is announced, a date sells out, or a single drops. The Website Kit removes
that step. It generates a prompt you paste into your AI website builder
Lovable, ChatGPT, Claude, Cursor, v0, or any tool that edits your codebase, and
that prompt rewires your existing site to read live data from Aden.

The design of your site does not change. Only where its content comes from does.
After the migration, adding a show in Aden puts it on your website within the
refresh window, with nobody touching the code.

The kit has three parts:

1. **Prompt**: the migration instructions, generated for your team, your stack
   and the sections you want Aden to drive.
2. **Test it**: run a real API request from inside Aden to confirm your key
   works and to see the exact data your website will receive.
3. **Security**: the rules that keep a website key safe, and how to check the
   result your AI builder gives back.

## Using it [#using-it]

### Open the kit [#open-the-kit]

It lives anywhere your team's public presence is configured:

* **Team → API**: next to your API keys.
* **Team → Settings → Domains**: next to your website domain.
* **Organisation → Settings → Domains**: pick which artist the website is for.

An organisation works the same way as a team, with one extra step: a website
shows one artist's shows and releases, so you pick which artist you are
connecting before the kit opens. The site's key reads that artist only
nothing else in the organisation. Only artists with an active link to the
organisation are listed.

The kit keeps its place in the URL: `?kit=<teamId>` while the sheet is open,
`?kitTab=prompt|test|security` for the panel, and `?artist=<teamId>` for the
org picker. A reload, a shared link or the back button all land where you left
off instead of on a closed sheet.

### 1. Create a read-only key [#1-create-a-read-only-key]

In **Team → API**, click **New API key**, name it after the website (e.g.
"martingarrix.com"), and select **read** scopes only, no `write:` scopes. The
key is shown once; copy it straight into your hosting provider's environment
variables.

A key without a write scope is genuinely read-only: Aden rejects any request
from it that is not a read, so even a leaked website key cannot change your
catalogue, your shows or your team.

### 2. Generate the prompt [#2-generate-the-prompt]

In the kit's **Prompt** tab, pick:

* **What the website is built with**: this decides where the key is allowed to
  live. A Next.js or Astro site can hold it in a server environment variable. A
  browser-only build (Lovable, Vite, Create React App) cannot, so the prompt has
  the assistant build a small serverless proxy that holds the key instead.
* **How often it should refresh**: daily by default.
* **Which sections Aden should drive**: profile, shows and tours, music and
  releases, media and news, press and interviews.

Copy the prompt (or download it as a `.md` file) and paste it into your AI
builder along with access to the site's code.

### 3. Test before you migrate [#3-test-before-you-migrate]

In the **Test it** tab, pick an endpoint and press **Send request**. The request
runs on our servers, so the key you paste never reaches your browser's network
tab and is never stored. You get the status, the response time, your remaining
rate limit and the exact JSON your website will receive, plus a ready-made
`curl` command.

Leave the key field empty to preview the data using your own signed-in session,
before any key exists.

### 4. Check the result [#4-check-the-result]

When your AI builder reports back, verify:

* Search your live site's JavaScript bundle for `aden_`. If the key appears
  anywhere, it is public. Revoke it, create a new one, and move the fetch to
  the server.
* Images still load after a few hours. Media links from Aden are signed and
  expire in about an hour, so the site must refresh them roughly every 45
  minutes or copy the files onto its own hosting.
* A change you make in Aden appears on the site within the refresh window.

### If a key leaks [#if-a-key-leaks]

Revoke it in **Team → API** and it stops working immediately. Anyone who finds
an Aden key in the wild can also report it. We revoke it and email your team
admins a one-click restore link, valid for 24 hours, in case the report was
wrong.