Refactor DashboardCollectionList: Simplify search input layout and improve tag selection logic for better user experience.

.env.example

@@ -7,10 +7,21 @@ RUSTYCMS_LOCALES=de,en
 # Only when RUSTYCMS_STORE=sqlite: SQLite URL (default: sqlite:content.db)
 # RUSTYCMS_DATABASE_URL=sqlite:content.db
 
-# API key for write access (POST/PUT/DELETE + POST /api/schemas). GET stays without key.
+# API key for write access. Single key = full access. Or use RUSTYCMS_API_KEYS for roles.
-# Authorization: Bearer <key> or X-API-Key: <key>. For Admin UI in browser: set same value in admin-ui as NEXT_PUBLIC_RUSTYCMS_API_KEY.
+# Authorization: Bearer <key> or X-API-Key: <key>. For Admin UI: set same in admin-ui as NEXT_PUBLIC_RUSTYCMS_API_KEY.
 RUSTYCMS_API_KEY=dein-geheimes-token
 
+# Optional: multiple keys with roles. Overrides RUSTYCMS_API_KEY when set.
+# Format: key1:role1,key2:role2. Roles: read (GET only), read_write (content + assets), admin (+ schemas).
+# RUSTYCMS_API_KEYS=key1:read,key2:read_write,key3:admin
+
+# Optional: environments (e.g. production,staging). File store only. Content under content/ and content/<env>/.
+# API: ?_environment=staging. Default = first in list.
+# RUSTYCMS_ENVIRONMENTS=production,staging
+
+# Optional: webhook URLs (comma-separated). POST with JSON { event, collection?, slug?, ... } on content/asset/schema changes.
+# RUSTYCMS_WEBHOOKS=https://example.com/hook
+
 # Optional: CORS – allowed origin (e.g. https://my-frontend.com). Empty or * = allow all.
 # RUSTYCMS_CORS_ORIGIN=
 

README.md

@@ -64,9 +64,25 @@ The Admin UI runs at `http://localhost:2001` (different port to avoid conflict w
 | Variable | Default | Description |
 |----------|---------|-------------|
 | `NEXT_PUBLIC_RUSTYCMS_API_URL` | `http://127.0.0.1:3000` | RustyCMS API base URL |
-| `NEXT_PUBLIC_RUSTYCMS_API_KEY` | – | API key for write operations (same as `RUSTYCMS_API_KEY`) |
+| `NEXT_PUBLIC_RUSTYCMS_API_KEY` | – | API key for write operations (same as `RUSTYCMS_API_KEY`). Optional if you use the Admin UI login. |
 
-If the API requires auth, set `NEXT_PUBLIC_RUSTYCMS_API_KEY` so the Admin UI can create, update and delete entries.
+**API key setup (backend + Admin UI):**
+
+1. **Backend** – In the project root (next to `Cargo.toml`), create or edit `.env`:
+   ```bash
+   RUSTYCMS_API_KEY=dein-geheimer-schluessel
+   ```
+   Use any secret string (e.g. `openssl rand -hex 32`). Start the API with `cargo run`; the log should show that API key auth is enabled.
+
+2. **Admin UI** – Either:
+   - **Option A:** In `admin-ui/.env.local` set the same key so the UI can write without logging in:
+     ```bash
+     NEXT_PUBLIC_RUSTYCMS_API_URL=http://127.0.0.1:3000
+     NEXT_PUBLIC_RUSTYCMS_API_KEY=dein-geheimer-schluessel
+     ```
+   - **Option B:** Leave `NEXT_PUBLIC_RUSTYCMS_API_KEY` unset. Open the Admin UI, click **Login** in the sidebar, enter the same API key, and submit. The key is stored in the browser (sessionStorage) until you log out or close the tab.
+
+3. **Check:** Without a key, `GET /api/collections` returns 200; `POST`/`PUT`/`DELETE` return 401. With header `X-API-Key: dein-geheimer-schluessel` (or `Authorization: Bearer …`), write requests succeed.
 
 ### CLI options
 
@@ -89,7 +105,10 @@ A `.env` in the project directory is loaded at startup. See `.env.example`.
 |--------------------------|---------------|--------------|
 | `RUSTYCMS_STORE`         | `file`        | Store backend: `file` or `sqlite` |
 | `RUSTYCMS_DATABASE_URL`  | `sqlite:content.db` | When using `sqlite`: SQLite URL (fallback: `DATABASE_URL`) |
-| `RUSTYCMS_API_KEY`       | –             | Optional. When set: POST/PUT/DELETE require this key (Bearer or X-API-Key). GET stays public. |
+| `RUSTYCMS_API_KEY`       | –             | Optional. Single key = full write access (Bearer or X-API-Key). GET stays public. |
+| `RUSTYCMS_API_KEYS`      | –             | Optional. Multiple keys with roles: `key1:read_write,key2:read`. Roles: `read`, `read_write`, `admin`. Overrides `RUSTYCMS_API_KEY`. |
+| `RUSTYCMS_ENVIRONMENTS`  | –             | Optional. Comma-separated (e.g. `production,staging`). File store only. Content per env; API uses `?_environment=staging`. |
+| `RUSTYCMS_WEBHOOKS`      | –             | Optional. Comma-separated URLs. POST with JSON `{ event, collection?, slug?, ... }` on content/asset/schema create/update/delete. |
 | `RUSTYCMS_CORS_ORIGIN`   | all           | Optional. One allowed CORS origin (e.g. `https://my-frontend.com`). Empty or `*` = all allowed. |
 | `RUSTYCMS_CACHE_TTL_SECS` | `60`          | Optional. Response cache for GET /api/content in seconds. `0` = cache off. |
 

admin-ui/messages/de.json

@@ -1,8 +1,17 @@
 {
+  "LoginPage": {
+    "title": "Anmelden",
+    "apiKeyLabel": "API-Schlüssel",
+    "apiKeyPlaceholder": "API-Schlüssel eingeben",
+    "submit": "Anmelden",
+    "hint": "Gleicher Schlüssel wie RUSTYCMS_API_KEY auf dem Server. Ohne Schlüssel nur Lesen, mit Schlüssel Bearbeiten."
+  },
   "Sidebar": {
     "dashboard": "Dashboard",
     "types": "Typen",
     "assets": "Assets",
+    "login": "Anmelden",
+    "logout": "Abmelden",
     "searchPlaceholder": "Sammlungen suchen…",
     "searchAriaLabel": "Sammlungen suchen",
     "closeMenu": "Menü schließen",

admin-ui/messages/en.json

@@ -1,8 +1,17 @@
 {
+  "LoginPage": {
+    "title": "Login",
+    "apiKeyLabel": "API key",
+    "apiKeyPlaceholder": "Enter your API key",
+    "submit": "Login",
+    "hint": "Use the same key as RUSTYCMS_API_KEY on the server. Without a key you can only read; with a key you can edit."
+  },
   "Sidebar": {
     "dashboard": "Dashboard",
     "types": "Types",
     "assets": "Assets",
+    "login": "Login",
+    "logout": "Logout",
     "searchPlaceholder": "Search collections…",
     "searchAriaLabel": "Search collections",
     "closeMenu": "Close menu",

admin-ui/src/app/login/page.tsx

@@ -0,0 +1,63 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import { useTranslations } from "next-intl";
+import Link from "next/link";
+import { setApiKey } from "@/lib/api";
+import { Button } from "@/components/ui/button";
+import { Input } from "@/components/ui/input";
+
+export default function LoginPage() {
+  const t = useTranslations("LoginPage");
+  const router = useRouter();
+  const [key, setKey] = useState("");
+  const [error, setError] = useState<string | null>(null);
+
+  function handleSubmit(e: React.FormEvent) {
+    e.preventDefault();
+    const trimmed = key.trim();
+    if (!trimmed) {
+      setError("API key is required.");
+      return;
+    }
+    setError(null);
+    setApiKey(trimmed);
+    router.push("/");
+    router.refresh();
+  }
+
+  return (
+    <div className="mx-auto max-w-sm py-8">
+      <div className="rounded-xl border border-accent-200 bg-white p-6 shadow-sm">
+        <h1 className="mb-4 text-xl font-semibold text-gray-900">{t("title")}</h1>
+        <form onSubmit={handleSubmit} className="space-y-4">
+          <div>
+            <label htmlFor="api-key" className="mb-1 block text-sm font-medium text-gray-700">
+              {t("apiKeyLabel")}
+            </label>
+            <Input
+              id="api-key"
+              type="password"
+              autoComplete="off"
+              value={key}
+              onChange={(e) => setKey(e.target.value)}
+              placeholder={t("apiKeyPlaceholder")}
+              className="w-full"
+            />
+          </div>
+          {error && <p className="text-sm text-red-600">{error}</p>}
+          <Button type="submit" className="w-full">
+            {t("submit")}
+          </Button>
+        </form>
+        <p className="mt-4 text-xs text-gray-500">{t("hint")}</p>
+        <p className="mt-3">
+          <Link href="/" className="text-sm text-accent-600 hover:underline">
+            ← Back to dashboard
+          </Link>
+        </p>
+      </div>
+    </div>
+  );
+}

admin-ui/src/app/providers.tsx

@@ -1,9 +1,14 @@
 "use client";
 
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { useState } from "react";
+import { useState, useEffect } from "react";
+import { syncStoredApiKey } from "@/lib/api";
 
 export function Providers({ children }: { children: React.ReactNode }) {
+  useEffect(() => {
+    syncStoredApiKey();
+  }, []);
+
   const [client] = useState(
     () =>
       new QueryClient({

admin-ui/src/components/DashboardCollectionList.tsx

@@ -44,15 +44,14 @@ export function DashboardCollectionList({ collections }: Props) {
 
   return (
     <div className="space-y-4">
-      <div className="flex flex-col gap-3 sm:flex-row sm:items-center sm:gap-4">
+      <div className="relative max-w-md">
-        <div className="relative flex-1">
         <Input
           type="search"
           value={search}
           onChange={(e) => setSearch(e.target.value)}
           placeholder={t("searchPlaceholder")}
           aria-label={t("searchPlaceholder")}
-            className="w-full max-w-md"
+          className="w-full"
         />
       </div>
       {allTags.length > 0 && (
@@ -85,7 +84,6 @@ export function DashboardCollectionList({ collections }: Props) {
           ))}
         </div>
       )}
-      </div>
 
       {collections.length === 0 ? (
         <p className="text-gray-500">

admin-ui/src/components/Sidebar.tsx

@@ -6,7 +6,7 @@ import { usePathname } from "next/navigation";
 import { Icon } from "@iconify/react";
 import { useQueries, useQuery } from "@tanstack/react-query";
 import { useTranslations } from "next-intl";
-import { fetchCollections, fetchContentList } from "@/lib/api";
+import { fetchCollections, fetchContentList, getApiKey, setApiKey } from "@/lib/api";
 import { LocaleSwitcher } from "./LocaleSwitcher";
 
 const navLinkClass =
@@ -22,6 +22,11 @@ export function Sidebar({ locale, mobileOpen = false, onClose }: SidebarProps) {
   const t = useTranslations("Sidebar");
   const pathname = usePathname();
   const [search, setSearch] = useState("");
+  const [, setLogoutVersion] = useState(0);
+  const apiKey = getApiKey();
+  const hasEnvKey = typeof window !== "undefined" && !!process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY;
+  const hasStoredKey =
+    typeof window !== "undefined" && !!sessionStorage.getItem("rustycms_admin_api_key");
   const { data, isLoading, error } = useQuery({
     queryKey: ["collections"],
     queryFn: fetchCollections,
@@ -205,6 +210,31 @@ export function Sidebar({ locale, mobileOpen = false, onClose }: SidebarProps) {
           })}
         </div>
       </nav>
+      <div className="mt-2 border-t border-accent-200/50 pt-2">
+        {hasStoredKey ? (
+          <button
+            type="button"
+            onClick={() => {
+              setApiKey(null);
+              setLogoutVersion((v) => v + 1);
+              onClose?.();
+            }}
+            className={`${navLinkClass} w-full text-left text-gray-700 hover:bg-accent-100/80 hover:text-gray-900`}
+          >
+            <Icon icon="mdi:logout" className="size-4" aria-hidden />
+            {t("logout")}
+          </button>
+        ) : !hasEnvKey ? (
+          <Link
+            href="/login"
+            onClick={onClose}
+            className={`${navLinkClass} w-full text-left text-gray-700 no-underline hover:bg-accent-100/80 hover:text-gray-900 ${pathname === "/login" ? "bg-accent-200/70 font-medium text-gray-900" : ""}`}
+          >
+            <Icon icon="mdi:login" className="size-4" aria-hidden />
+            {t("login")}
+          </Link>
+        ) : null}
+      </div>
       <LocaleSwitcher locale={locale} />
     </aside>
   );

admin-ui/src/lib/api.ts

@@ -1,20 +1,49 @@
 /**
  * RustyCMS API client. Base URL from NEXT_PUBLIC_RUSTYCMS_API_URL.
- * Optional RUSTYCMS_API_KEY for write operations (sent as X-API-Key).
+ * API key: from env (NEXT_PUBLIC_RUSTYCMS_API_KEY) or from login (sessionStorage).
  */
 
 export const getBaseUrl = () =>
   process.env.NEXT_PUBLIC_RUSTYCMS_API_URL || "http://127.0.0.1:3000";
 
+const STORAGE_KEY = "rustycms_admin_api_key";
+
+/** Client-side only: key set by login when no env key. */
+let clientApiKey: string | null = null;
+
+/** Get API key (env or login). Call from client; server uses env only. */
+export function getApiKey(): string | null {
+  if (typeof window !== "undefined") {
+    const fromEnv = process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null;
+    if (fromEnv) return fromEnv;
+    return clientApiKey ?? sessionStorage.getItem(STORAGE_KEY);
+  }
+  return process.env.RUSTYCMS_API_KEY ?? process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null;
+}
+
+/** Set API key after login (sessionStorage + in-memory). */
+export function setApiKey(key: string | null): void {
+  if (key) {
+    sessionStorage.setItem(STORAGE_KEY, key);
+    clientApiKey = key;
+  } else {
+    sessionStorage.removeItem(STORAGE_KEY);
+    clientApiKey = null;
+  }
+}
+
+/** Sync stored key into memory (call once on app load). */
+export function syncStoredApiKey(): void {
+  const stored = sessionStorage.getItem(STORAGE_KEY);
+  if (stored) clientApiKey = stored;
+}
+
 const getHeaders = (): HeadersInit => {
   const headers: HeadersInit = {
     "Content-Type": "application/json",
     Accept: "application/json",
   };
-  const key =
+  const key = getApiKey();
-    typeof window !== "undefined"
-      ? process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null
-      : process.env.RUSTYCMS_API_KEY ?? process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null;
   if (key) headers["X-API-Key"] = key;
   return headers;
 };
@@ -306,11 +335,8 @@ export async function deleteFolder(name: string): Promise<void> {
 }
 
 const getUploadHeaders = (): HeadersInit => {
-  const key =
-    typeof window !== "undefined"
-      ? process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null
-      : process.env.RUSTYCMS_API_KEY ?? process.env.NEXT_PUBLIC_RUSTYCMS_API_KEY ?? null;
   const headers: HeadersInit = {};
+  const key = getApiKey();
   if (key) headers["X-API-Key"] = key;
   return headers;
 };

src/api/assets.rs

@@ -28,6 +28,7 @@ use tokio::fs;
 use super::auth;
 use super::error::ApiError;
 use super::handlers::AppState;
+use super::webhooks;
 
 const ALLOWED_EXTENSIONS: &[(&str, &str)] = &[
     ("jpg", "image/jpeg"),
@@ -46,6 +47,13 @@ fn mime_for_ext(ext: &str) -> Option<&'static str> {
         .map(|(_, m)| *m)
 }
 
+fn path_for_webhook(folder: &Option<String>, filename: &str) -> String {
+    folder
+        .as_deref()
+        .map(|f| format!("{}/{}", f, filename))
+        .unwrap_or_else(|| filename.to_string())
+}
+
 /// Sanitize a single path segment: lowercase, alphanumeric + dash + underscore + dot.
 fn sanitize_segment(name: &str) -> Result<String, ApiError> {
     let name = name.trim();
@@ -175,15 +183,18 @@ async fn read_images(
 #[derive(Deserialize)]
 pub struct ListAssetsParams {
     folder: Option<String>,
+    #[serde(rename = "_environment")]
+    environment: Option<String>,
 }
 
 pub async fn list_assets(
     State(state): State<Arc<AppState>>,
     Query(params): Query<ListAssetsParams>,
 ) -> Result<Json<Value>, ApiError> {
-    let base = &state.assets_dir;
+    let env = state.effective_environment_from_param(params.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let base = state.assets_dir_for(&env);
     if !base.exists() {
-        fs::create_dir_all(base)
+        fs::create_dir_all(&base)
             .await
             .map_err(|e| ApiError::Internal(format!("Cannot create assets dir: {}", e)))?;
     }
@@ -199,12 +210,12 @@ pub async fn list_assets(
         }
         // Root only (folder= with empty value)
         Some(_empty) => {
-            all.extend(read_images(base, None).await?);
+            all.extend(read_images(&base, None).await?);
         }
         // All: root + every subdirectory
         None => {
-            all.extend(read_images(base, None).await?);
+            all.extend(read_images(&base, None).await?);
-            let mut rd = fs::read_dir(base)
+            let mut rd = fs::read_dir(&base)
                 .await
                 .map_err(|e| ApiError::Internal(e.to_string()))?;
             while let Some(e) = rd
@@ -243,18 +254,26 @@ pub async fn list_assets(
 // GET /api/assets/folders
 // ---------------------------------------------------------------------------
 
+#[derive(Deserialize, Default)]
+pub struct EnvironmentParam {
+    #[serde(rename = "_environment")]
+    pub environment: Option<String>,
+}
+
 pub async fn list_folders(
     State(state): State<Arc<AppState>>,
+    Query(params): Query<EnvironmentParam>,
 ) -> Result<Json<Value>, ApiError> {
-    let base = &state.assets_dir;
+    let env = state.effective_environment_from_param(params.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let base = state.assets_dir_for(&env);
     if !base.exists() {
-        fs::create_dir_all(base)
+        fs::create_dir_all(&base)
             .await
             .map_err(|e| ApiError::Internal(format!("Cannot create assets dir: {}", e)))?;
     }
 
     let mut folders: Vec<Value> = Vec::new();
-    let mut rd = fs::read_dir(base)
+    let mut rd = fs::read_dir(&base)
         .await
         .map_err(|e| ApiError::Internal(e.to_string()))?;
     while let Some(e) = rd
@@ -303,14 +322,19 @@ pub async fn list_folders(
 pub async fn create_folder(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
+    Query(env_param): Query<EnvironmentParam>,
     Json(body): Json<Value>,
 ) -> Result<axum::response::Response, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::AssetsWrite)?;
+    }
+    let env = state.effective_environment_from_param(env_param.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
     let name = body["name"]
         .as_str()
         .ok_or_else(|| ApiError::BadRequest("Missing 'name' field".into()))?;
     let name = validate_folder_name(name)?;
-    let path = state.assets_dir.join(&name);
+    let path = assets_dir.join(&name);
     if path.exists() {
         return Err(ApiError::Conflict(format!(
             "Folder '{}' already exists",
@@ -330,11 +354,16 @@ pub async fn create_folder(
 pub async fn delete_folder(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
+    Query(env_param): Query<EnvironmentParam>,
     AxumPath(name): AxumPath<String>,
 ) -> Result<axum::response::Response, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::AssetsWrite)?;
+    }
+    let env = state.effective_environment_from_param(env_param.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
     let name = validate_folder_name(&name)?;
-    let path = state.assets_dir.join(&name);
+    let path = assets_dir.join(&name);
     if !path.exists() {
         return Err(ApiError::NotFound(format!("Folder '{}' not found", name)));
     }
@@ -355,6 +384,8 @@ pub async fn delete_folder(
 #[derive(Deserialize)]
 pub struct UploadParams {
     folder: Option<String>,
+    #[serde(rename = "_environment")]
+    environment: Option<String>,
 }
 
 /// Max upload size for asset uploads (50 MB).
@@ -370,7 +401,12 @@ pub async fn upload_asset(
     Query(params): Query<UploadParams>,
     mut multipart: Multipart,
 ) -> Result<axum::response::Response, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::AssetsWrite)?;
+    }
+
+    let env = state.effective_environment_from_param(params.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
 
     let folder = match params.folder.as_deref() {
         Some(f) if !f.is_empty() => Some(validate_folder_name(f)?),
@@ -378,8 +414,8 @@ pub async fn upload_asset(
     };
 
     let dir = match &folder {
-        Some(f) => state.assets_dir.join(f),
+        Some(f) => assets_dir.join(f),
-        None => state.assets_dir.clone(),
+        None => assets_dir.clone(),
     };
     if !dir.exists() {
         fs::create_dir_all(&dir)
@@ -447,6 +483,18 @@ pub async fn upload_asset(
         .and_then(|d| DateTime::<Utc>::from_timestamp_secs(d.as_secs() as i64))
         .map(|dt: DateTime<Utc>| dt.to_rfc3339());
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_ASSET_UPLOADED,
+            "path": path_for_webhook(&folder, &filename),
+            "filename": filename,
+            "folder": folder,
+            "url": url,
+        }),
+    );
+
     Ok((
         StatusCode::CREATED,
         Json(json!({
@@ -468,12 +516,15 @@ pub async fn upload_asset(
 
 pub async fn get_asset(
     State(state): State<Arc<AppState>>,
+    Query(env_param): Query<EnvironmentParam>,
     AxumPath(path): AxumPath<String>,
 ) -> Result<axum::response::Response, ApiError> {
+    let env = state.effective_environment_from_param(env_param.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
     let (folder, filename) = parse_path(&path)?;
     let file_path = match &folder {
-        Some(f) => state.assets_dir.join(f).join(&filename),
+        Some(f) => assets_dir.join(f).join(&filename),
-        None => state.assets_dir.join(&filename),
+        None => assets_dir.join(&filename),
     };
     if !file_path.exists() {
         return Err(ApiError::NotFound(format!("Asset '{}' not found", path)));
@@ -507,18 +558,23 @@ pub struct RenameBody {
 pub async fn rename_asset(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
+    Query(env_param): Query<EnvironmentParam>,
     AxumPath(path): AxumPath<String>,
     Json(body): Json<RenameBody>,
 ) -> Result<axum::response::Response, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::AssetsWrite)?;
+    }
+    let env = state.effective_environment_from_param(env_param.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
     let (folder, old_filename) = parse_path(&path)?;
     let new_filename = validate_filename(&body.filename)?;
     if new_filename == old_filename {
         return Err(ApiError::BadRequest("New filename is the same as current".into()));
     }
     let base = match &folder {
-        Some(f) => state.assets_dir.join(f),
+        Some(f) => assets_dir.join(f),
-        None => state.assets_dir.clone(),
+        None => assets_dir.clone(),
     };
     let old_path = base.join(&old_filename);
     let new_path = base.join(&new_filename);
@@ -577,13 +633,18 @@ pub async fn rename_asset(
 pub async fn delete_asset(
     State(state): State<Arc<AppState>>,
     headers: HeaderMap,
+    Query(env_param): Query<EnvironmentParam>,
     AxumPath(path): AxumPath<String>,
 ) -> Result<axum::response::Response, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::AssetsWrite)?;
+    }
+    let env = state.effective_environment_from_param(env_param.environment.as_deref().map(|s| s.trim()).filter(|s| !s.is_empty()));
+    let assets_dir = state.assets_dir_for(&env);
     let (folder, filename) = parse_path(&path)?;
     let file_path = match &folder {
-        Some(f) => state.assets_dir.join(f).join(&filename),
+        Some(f) => assets_dir.join(f).join(&filename),
-        None => state.assets_dir.join(&filename),
+        None => assets_dir.join(&filename),
     };
     if !file_path.exists() {
         return Err(ApiError::NotFound(format!("Asset '{}' not found", path)));
@@ -591,5 +652,15 @@ pub async fn delete_asset(
     fs::remove_file(&file_path)
         .await
         .map_err(|e| ApiError::Internal(format!("Failed to delete asset: {}", e)))?;
+
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_ASSET_DELETED,
+            "path": path,
+        }),
+    );
+
     Ok(StatusCode::NO_CONTENT.into_response())
 }

src/api/auth.rs

@@ -1,9 +1,135 @@
-//! Optional API key auth via env RUSTYCMS_API_KEY. Protects POST/PUT/DELETE.
+//! Optional API key auth. Configure via RUSTYCMS_API_KEY (single key = full access)
+//! or RUSTYCMS_API_KEYS (key1:role1,key2:role2). Roles: read | read_write | admin.
 
+use std::collections::HashMap;
 use axum::http::HeaderMap;
 
 use super::error::ApiError;
 
+/// Permission required for an action.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Permission {
+    /// GET only (read content, list, assets). Used to decide draft visibility.
+    Read,
+    /// Write content (POST/PUT/DELETE entries).
+    ContentWrite,
+    /// Write assets (upload, delete, rename, folders).
+    AssetsWrite,
+    /// Write schemas (create/update/delete types).
+    SchemasWrite,
+}
+
+/// Role granted by an API key.
+#[derive(Clone, Copy, PartialEq, Eq)]
+pub enum Role {
+    /// Read-only: GET requests; can see drafts when using this key.
+    Read,
+    /// Read + write content and assets.
+    ReadWrite,
+    /// ReadWrite + schema management.
+    Admin,
+}
+
+impl Role {
+    fn from_str(s: &str) -> Option<Self> {
+        match s.trim().to_lowercase().as_str() {
+            "read" => Some(Role::Read),
+            "read_write" | "readwrite" => Some(Role::ReadWrite),
+            "admin" => Some(Role::Admin),
+            _ => None,
+        }
+    }
+
+    fn allows(self, perm: Permission) -> bool {
+        match perm {
+            Permission::Read => true,
+            Permission::ContentWrite | Permission::AssetsWrite => matches!(self, Role::ReadWrite | Role::Admin),
+            Permission::SchemasWrite => matches!(self, Role::Admin),
+        }
+    }
+}
+
+/// Parsed API keys with roles. Built from env in main.
+#[derive(Clone, Default)]
+pub struct ApiKeys {
+    /// key (token) -> role
+    keys: HashMap<String, Role>,
+}
+
+impl ApiKeys {
+    /// Parse from env: RUSTYCMS_API_KEYS=key1:read_write,key2:read or RUSTYCMS_API_KEY=single (admin).
+    pub fn from_env() -> Option<Self> {
+        if let Ok(s) = std::env::var("RUSTYCMS_API_KEYS") {
+            let mut keys = HashMap::new();
+            for part in s.split(',') {
+                let part = part.trim();
+                if part.is_empty() {
+                    continue;
+                }
+                if let Some((k, v)) = part.split_once(':') {
+                    let key = k.trim().to_string();
+                    let role = Role::from_str(v).unwrap_or(Role::Read);
+                    if !key.is_empty() {
+                        keys.insert(key, role);
+                    }
+                } else {
+                    // key without role = full access (admin)
+                    let key = part.to_string();
+                    if !key.is_empty() {
+                        keys.insert(key, Role::Admin);
+                    }
+                }
+            }
+            if keys.is_empty() {
+                return None;
+            }
+            return Some(ApiKeys { keys });
+        }
+        if let Ok(key) = std::env::var("RUSTYCMS_API_KEY") {
+            let key = key.trim().to_string();
+            if key.is_empty() {
+                return None;
+            }
+            let mut keys = HashMap::new();
+            keys.insert(key, Role::Admin);
+            return Some(ApiKeys { keys });
+        }
+        None
+    }
+
+    /// Return the role for this token if it matches any key.
+    pub fn role_for_token(&self, token: Option<&str>) -> Option<Role> {
+        let t = token?;
+        self.keys.get(t).copied()
+    }
+
+    /// Require the given permission; the request must send a key that has it.
+    pub fn require(&self, headers: &HeaderMap, permission: Permission) -> Result<(), ApiError> {
+        let token = token_from_headers(headers);
+        let role = self.role_for_token(token.as_deref());
+        match role {
+            Some(r) if r.allows(permission) => Ok(()),
+            Some(_) => Err(ApiError::Unauthorized(
+                "This API key does not have permission for this action.".to_string(),
+            )),
+            None => Err(ApiError::Unauthorized(
+                "Missing or invalid API key. Use Authorization: Bearer <key> or X-API-Key: <key>."
+                    .to_string(),
+            )),
+        }
+    }
+
+    /// True if any key is configured (so we hide drafts from unauthenticated requests).
+    pub fn is_enabled(&self) -> bool {
+        !self.keys.is_empty()
+    }
+
+    /// True if the request has a valid key (any role). Used for draft visibility.
+    pub fn is_authenticated(&self, headers: &HeaderMap) -> bool {
+        self.role_for_token(token_from_headers(headers).as_deref()).is_some()
+    }
+}
+
 /// Read token from `Authorization: Bearer <token>` or `X-API-Key: <token>`.
 pub fn token_from_headers(headers: &HeaderMap) -> Option<String> {
     if let Some(v) = headers.get("Authorization") {
@@ -22,17 +148,11 @@ pub fn token_from_headers(headers: &HeaderMap) -> Option<String> {
     None
 }
 
-/// If `required_key` is Some, the request must send a matching token (Bearer or X-API-Key).
+/// Legacy: require any valid API key (for call sites that only need “has key”).
-pub fn require_api_key(required_key: Option<&String>, headers: &HeaderMap) -> Result<(), ApiError> {
+/// Prefer ApiKeys::require(permission) when possible.
-    let Some(required) = required_key else {
+pub fn require_api_key(api_keys: Option<&ApiKeys>, headers: &HeaderMap) -> Result<(), ApiError> {
+    let Some(keys) = api_keys else {
         return Ok(());
     };
-    let provided = token_from_headers(headers);
+    keys.require(headers, Permission::ContentWrite)
-    if provided.as_deref() != Some(required.as_str()) {
-        return Err(ApiError::Unauthorized(
-            "Missing or invalid API key. Use Authorization: Bearer <key> or X-API-Key: <key>."
-                .to_string(),
-        ));
-    }
-    Ok(())
 }

src/api/cache.rs

@@ -57,11 +57,10 @@ impl ContentCache {
         );
     }
 
-    /// Removes all entries for the given collection (after create/update/delete).
+    /// Removes all entries for the given collection in the given environment (after create/update/delete).
-    /// Invalidates all locales for this collection (e:collection:*, l:collection:*).
+    pub async fn invalidate_collection(&self, env: &str, collection: &str) {
-    pub async fn invalidate_collection(&self, collection: &str) {
+        let prefix_e = format!("e:{}:{}:", env, collection);
-        let prefix_e = format!("e:{}:", collection);
+        let prefix_l = format!("l:{}:{}:", env, collection);
-        let prefix_l = format!("l:{}:", collection);
         let mut guard = self.data.write().await;
         guard.retain(|k, _| !k.starts_with(&prefix_e) && !k.starts_with(&prefix_l));
     }
@@ -73,16 +72,16 @@ impl ContentCache {
     }
 }
 
-/// Cache key for a single entry (incl. _resolve and optional _locale).
+/// Cache key for a single entry (env + collection + slug + _resolve + optional _locale).
-pub fn entry_cache_key(collection: &str, slug: &str, resolve_key: &str, locale: Option<&str>) -> String {
+pub fn entry_cache_key(env: &str, collection: &str, slug: &str, resolve_key: &str, locale: Option<&str>) -> String {
     let loc = locale.unwrap_or("");
-    format!("e:{}:{}:{}:{}", collection, slug, resolve_key, loc)
+    format!("e:{}:{}:{}:{}:{}", env, collection, slug, resolve_key, loc)
 }
 
-/// Cache key for a list (collection + hash of query params + optional locale).
+/// Cache key for a list (env + collection + query hash + optional locale).
-pub fn list_cache_key(collection: &str, query_hash: u64, locale: Option<&str>) -> String {
+pub fn list_cache_key(env: &str, collection: &str, query_hash: u64, locale: Option<&str>) -> String {
     let loc = locale.unwrap_or("");
-    format!("l:{}:{}:{}", collection, loc, query_hash)
+    format!("l:{}:{}:{}:{}", env, collection, loc, query_hash)
 }
 
 // ---------------------------------------------------------------------------

src/api/handlers.rs

@@ -22,10 +22,11 @@ use super::auth;
 use super::cache::{self, ContentCache, TransformCache};
 use super::error::ApiError;
 use super::response::{collapse_asset_urls, expand_asset_urls, format_references, parse_resolve};
+use super::webhooks;
 
 /// Shared application state. Registry and OpenAPI spec are behind RwLock for hot-reload.
 /// Store is selected via RUSTYCMS_STORE=file|sqlite.
-/// If api_key is set (RUSTYCMS_API_KEY), POST/PUT/DELETE require it (Bearer or X-API-Key).
+/// If api_keys is set (RUSTYCMS_API_KEY or RUSTYCMS_API_KEYS), write operations require a matching key with the right role.
 /// When locales is set (RUSTYCMS_LOCALES e.g. "de,en"), API accepts _locale query param.
 pub struct AppState {
     pub registry: Arc<RwLock<SchemaRegistry>>,
@@ -33,7 +34,8 @@ pub struct AppState {
     pub openapi_spec: Arc<RwLock<serde_json::Value>>,
     /// Path to types directory (e.g. ./types) for schema file writes.
     pub types_dir: PathBuf,
-    pub api_key: Option<String>,
+    /// API keys with roles (from RUSTYCMS_API_KEYS or RUSTYCMS_API_KEY).
+    pub api_keys: Option<super::auth::ApiKeys>,
     pub cache: Arc<ContentCache>,
     pub transform_cache: Arc<TransformCache>,
     pub http_client: reqwest::Client,
@@ -43,6 +45,52 @@ pub struct AppState {
     pub assets_dir: PathBuf,
     /// Public base URL (e.g. https://api.example.com). Used to expand relative /api/assets/ paths.
     pub base_url: String,
+    /// Webhook URLs to POST on content/asset/schema changes (from RUSTYCMS_WEBHOOKS).
+    pub webhook_urls: Vec<String>,
+    /// When set (RUSTYCMS_ENVIRONMENTS), content/assets are per-environment (e.g. production, staging).
+    pub environments: Option<Vec<String>>,
+    /// Store per environment when environments is set. Key = env name.
+    pub stores: Option<HashMap<String, Arc<dyn ContentStore>>>,
+    /// Assets dir per environment when environments is set. Key = env name.
+    pub assets_dirs: Option<HashMap<String, PathBuf>>,
+}
+
+impl AppState {
+    /// Resolve environment from query _environment. Default = first in list.
+    pub fn effective_environment(&self, params: &HashMap<String, String>) -> String {
+        let requested = params.get("_environment").map(|s| s.trim()).filter(|s| !s.is_empty());
+        self.effective_environment_from_param(requested)
+    }
+
+    /// Resolve environment from optional _environment value (e.g. from asset query params).
+    pub fn effective_environment_from_param(&self, env_param: Option<&str>) -> String {
+        let Some(ref list) = self.environments else {
+            return "default".to_string();
+        };
+        if list.is_empty() {
+            return "default".to_string();
+        }
+        match env_param {
+            Some(env) if list.iter().any(|e| e == env) => env.to_string(),
+            _ => list[0].clone(),
+        }
+    }
+
+    /// Store for the given environment. When environments is off, returns the single store.
+    pub fn store_for(&self, env: &str) -> Arc<dyn ContentStore> {
+        self.stores
+            .as_ref()
+            .and_then(|m| m.get(env).cloned())
+            .unwrap_or_else(|| Arc::clone(&self.store))
+    }
+
+    /// Assets directory for the given environment.
+    pub fn assets_dir_for(&self, env: &str) -> PathBuf {
+        self.assets_dirs
+            .as_ref()
+            .and_then(|m| m.get(env).cloned())
+            .unwrap_or_else(|| self.assets_dir.clone())
+    }
 }
 
 /// Resolve effective locale from query _locale and state.locales. Returns None when i18n is off.
@@ -114,7 +162,9 @@ pub async fn create_schema(
     headers: HeaderMap,
     Json(schema): Json<SchemaDefinition>,
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::SchemasWrite)?;
+    }
 
     if !is_valid_schema_name(&schema.name) {
         return Err(ApiError::BadRequest(
@@ -156,6 +206,15 @@ pub async fn create_schema(
 
     tracing::info!("Schema created: {} ({})", schema.name, path.display());
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_SCHEMA_CREATED,
+            "name": schema.name,
+        }),
+    );
+
     Ok((
         StatusCode::CREATED,
         Json(serde_json::to_value(&schema).unwrap()),
@@ -172,7 +231,9 @@ pub async fn update_schema(
     headers: HeaderMap,
     Json(schema): Json<SchemaDefinition>,
 ) -> Result<Json<Value>, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::SchemasWrite)?;
+    }
 
     if name != schema.name {
         return Err(ApiError::BadRequest(
@@ -215,6 +276,15 @@ pub async fn update_schema(
 
     tracing::info!("Schema updated: {} ({})", name, path.display());
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_SCHEMA_UPDATED,
+            "name": name,
+        }),
+    );
+
     Ok(Json(serde_json::to_value(&schema).unwrap()))
 }
 
@@ -227,7 +297,9 @@ pub async fn delete_schema(
     Path(name): Path<String>,
     headers: HeaderMap,
 ) -> Result<StatusCode, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::SchemasWrite)?;
+    }
 
     if !is_valid_schema_name(&name) {
         return Err(ApiError::BadRequest("Invalid schema name".to_string()));
@@ -254,6 +326,15 @@ pub async fn delete_schema(
         return Err(ApiError::NotFound(format!("Schema '{}' not found", name)));
     }
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_SCHEMA_DELETED,
+            "name": name,
+        }),
+    );
+
     Ok(StatusCode::NO_CONTENT)
 }
 
@@ -342,8 +423,9 @@ pub async fn slug_check(
         if exclude.as_deref() == Some(normalized.as_str()) {
             true
         } else {
-            let exists = state
+            let env = state.effective_environment(&params);
-                .store
+            let store = state.store_for(&env);
+            let exists = store
                 .get(&collection, &normalized, locale_ref)
                 .await
                 .map_err(ApiError::from)?
@@ -381,6 +463,8 @@ pub async fn list_entries(
         )));
     }
 
+    let env = state.effective_environment(&params);
+    let store = state.store_for(&env);
     let locale = effective_locale(&params, state.locales.as_deref());
     let locale_ref = locale.as_deref();
 
@@ -404,17 +488,20 @@ pub async fn list_entries(
         list_params.get(k.as_str()).unwrap().hash(&mut hasher);
     }
     let query_hash = hasher.finish();
-    let cache_key = cache::list_cache_key(&collection, query_hash, locale_ref);
+    let cache_key = cache::list_cache_key(&env, &collection, query_hash, locale_ref);
     if let Some(cached) = state.cache.get(&cache_key).await {
         return Ok(Json(cached));
     }
 
-    let entries = state.store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
+    let entries = store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
 
     let resolve = parse_resolve(list_params.get("_resolve").map(|s| s.as_str()));
-    // When API key is required but not sent, show only published entries. Otherwise use _status param.
+    // When API keys are enabled but request has no valid key, show only published entries.
-    let status_override = if state.api_key.as_ref().is_some()
+    let status_override = if state
-        && auth::token_from_headers(&headers).as_deref() != state.api_key.as_ref().map(String::as_str)
+        .api_keys
+        .as_ref()
+        .map(|k| k.is_enabled() && !k.is_authenticated(&headers))
+        .unwrap_or(false)
     {
         Some(StatusFilter::Published)
     } else {
@@ -427,7 +514,7 @@ pub async fn list_entries(
         *item = format_references(
             std::mem::take(item),
             schema,
-            state.store.as_ref(),
+            store.as_ref(),
             resolve.as_ref(),
             locale_ref,
             Some(&*registry),
@@ -464,15 +551,20 @@ pub async fn get_entry(
         )));
     }
 
+    let env = state.effective_environment(&params);
+    let store = state.store_for(&env);
     let locale = effective_locale(&params, state.locales.as_deref());
     let locale_ref = locale.as_deref();
 
     let resolve_key = params.get("_resolve").map(|s| s.as_str()).unwrap_or("");
-    let cache_key = cache::entry_cache_key(&collection, &slug, resolve_key, locale_ref);
+    let cache_key = cache::entry_cache_key(&env, &collection, &slug, resolve_key, locale_ref);
     if let Some(ref cached) = state.cache.get(&cache_key).await {
         // Don't serve cached draft to unauthenticated requests.
-        let is_authenticated = state.api_key.as_ref().is_none()
+        let is_authenticated = state
-            || auth::token_from_headers(&headers).as_deref() == state.api_key.as_ref().map(String::as_str);
+            .api_keys
+            .as_ref()
+            .map(|k| k.is_authenticated(&headers))
+            .unwrap_or(true);
         if !is_authenticated && entry_is_draft(cached) {
             // Fall through to load from store (will 404 if draft).
         } else {
@@ -502,8 +594,7 @@ pub async fn get_entry(
         }
     }
 
-    let entry = state
+    let entry = store
-        .store
         .get(&collection, &slug, locale_ref)
         .await
         .map_err(ApiError::from)?
@@ -511,9 +602,12 @@ pub async fn get_entry(
             ApiError::NotFound(format!("Entry '{}' not found in '{}'", slug, collection))
         })?;
 
-    // When no API key is sent, hide draft entries (return 404).
+    // When API keys are enabled and request has no valid key, hide draft entries (return 404).
-    if state.api_key.as_ref().is_some()
+    if state
-        && auth::token_from_headers(&headers).as_deref() != state.api_key.as_ref().map(String::as_str)
+        .api_keys
+        .as_ref()
+        .map(|k| k.is_enabled() && !k.is_authenticated(&headers))
+        .unwrap_or(false)
         && entry_is_draft(&entry)
     {
         return Err(ApiError::NotFound(format!(
@@ -526,7 +620,7 @@ pub async fn get_entry(
     let mut formatted = format_references(
         entry,
         schema,
-        state.store.as_ref(),
+        store.as_ref(),
         resolve.as_ref(),
         locale_ref,
         Some(&*registry),
@@ -538,7 +632,7 @@ pub async fn get_entry(
 
     // Only cache published entries so unauthenticated requests never see cached drafts.
     if !entry_is_draft(&formatted) {
-        state.cache.set(cache_key, formatted.clone()).await;
+        state.cache.set(cache_key.clone(), formatted.clone()).await;
     }
 
     let json_str = serde_json::to_string(&formatted).unwrap_or_default();
@@ -579,8 +673,12 @@ pub async fn create_entry(
     headers: HeaderMap,
     Json(mut body): Json<Value>,
 ) -> Result<(StatusCode, Json<Value>), ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::ContentWrite)?;
+    }
 
+    let env = state.effective_environment(&params);
+    let store = state.store_for(&env);
     let locale = effective_locale(&params, state.locales.as_deref());
     let locale_ref = locale.as_deref();
 
@@ -637,7 +735,7 @@ pub async fn create_entry(
     }
 
     // Unique constraint check (within same locale)
-    let entries = state.store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
+    let entries = store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
     let unique_errors = validator::validate_unique(&schema, &body, None, &entries);
     if !unique_errors.is_empty() {
         let messages: Vec<String> = unique_errors.iter().map(|e| e.to_string()).collect();
@@ -645,11 +743,11 @@ pub async fn create_entry(
     }
 
     // Reference validation (blocking: we need sync closure; use tokio::task::block_in_place or spawn)
-    let store = &state.store;
     let ref_errors = validator::validate_references(&schema, &body, &|coll, s| {
+        let store_ref = Arc::clone(&store);
         tokio::task::block_in_place(|| {
             tokio::runtime::Handle::current().block_on(async move {
-                store.get(coll, s, locale_ref).await.ok().flatten().is_some()
+                store_ref.get(coll, s, locale_ref).await.ok().flatten().is_some()
             })
         })
     });
@@ -662,16 +760,14 @@ pub async fn create_entry(
     collapse_asset_urls(&mut body, &state.base_url);
 
     // Persist to filesystem
-    state
+    store
-        .store
         .create(&collection, &slug, &body, locale_ref)
         .await
         .map_err(ApiError::from)?;
-    state.cache.invalidate_collection(&collection).await;
+    state.cache.invalidate_collection(&env, &collection).await;
 
     // Return created entry (with reference format)
-    let entry = state
+    let entry = store
-        .store
         .get(&collection, &slug, locale_ref)
         .await
         .map_err(ApiError::from)?
@@ -679,13 +775,25 @@ pub async fn create_entry(
     let formatted = format_references(
         entry,
         &schema,
-        state.store.as_ref(),
+        store.as_ref(),
         None,
         locale_ref,
         None,
     )
     .await;
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_CONTENT_CREATED,
+            "collection": collection,
+            "slug": slug,
+            "locale": locale_ref,
+            "environment": env,
+        }),
+    );
+
     Ok((StatusCode::CREATED, Json(formatted)))
 }
 
@@ -700,8 +808,12 @@ pub async fn update_entry(
     headers: HeaderMap,
     Json(mut body): Json<Value>,
 ) -> Result<Json<Value>, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::ContentWrite)?;
+    }
 
+    let env = state.effective_environment(&params);
+    let store = state.store_for(&env);
     let locale = effective_locale(&params, state.locales.as_deref());
     let locale_ref = locale.as_deref();
 
@@ -736,8 +848,7 @@ pub async fn update_entry(
     validator::normalize_reference_arrays(&schema, &mut body);
 
     // Load existing content for readonly check
-    let existing = state
+    let existing = store
-        .store
         .get(&collection, &slug, locale_ref)
         .await
         .map_err(ApiError::from)?
@@ -760,7 +871,7 @@ pub async fn update_entry(
     }
 
     // Unique constraint check (exclude self, within same locale)
-    let entries = state.store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
+    let entries = store.list(&collection, locale_ref).await.map_err(ApiError::from)?;
     let unique_errors = validator::validate_unique(&schema, &body, Some(&slug), &entries);
     if !unique_errors.is_empty() {
         let messages: Vec<String> = unique_errors.iter().map(|e| e.to_string()).collect();
@@ -768,11 +879,11 @@ pub async fn update_entry(
     }
 
     // Reference validation
-    let store = &state.store;
     let ref_errors = validator::validate_references(&schema, &body, &|coll, s| {
+        let store_ref = Arc::clone(&store);
         tokio::task::block_in_place(|| {
             tokio::runtime::Handle::current().block_on(async move {
-                store.get(coll, s, locale_ref).await.ok().flatten().is_some()
+                store_ref.get(coll, s, locale_ref).await.ok().flatten().is_some()
             })
         })
     });
@@ -785,16 +896,14 @@ pub async fn update_entry(
     collapse_asset_urls(&mut body, &state.base_url);
 
     // Persist to filesystem
-    state
+    store
-        .store
         .update(&collection, &slug, &body, locale_ref)
         .await
         .map_err(ApiError::from)?;
-    state.cache.invalidate_collection(&collection).await;
+    state.cache.invalidate_collection(&env, &collection).await;
 
     // Return updated entry (with reference format)
-    let entry = state
+    let entry = store
-        .store
         .get(&collection, &slug, locale_ref)
         .await
         .map_err(ApiError::from)?
@@ -802,13 +911,25 @@ pub async fn update_entry(
     let formatted = format_references(
         entry,
         &schema,
-        state.store.as_ref(),
+        store.as_ref(),
         None,
         locale_ref,
         None,
     )
     .await;
 
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_CONTENT_UPDATED,
+            "collection": collection,
+            "slug": slug,
+            "locale": locale_ref,
+            "environment": env,
+        }),
+    );
+
     Ok(Json(formatted))
 }
 
@@ -838,8 +959,12 @@ pub async fn delete_entry(
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Result<StatusCode, ApiError> {
-    auth::require_api_key(state.api_key.as_ref(), &headers)?;
+    if let Some(ref keys) = state.api_keys {
+        keys.require(&headers, auth::Permission::ContentWrite)?;
+    }
 
+    let env = state.effective_environment(&params);
+    let store = state.store_for(&env);
     let locale = effective_locale(&params, state.locales.as_deref());
     let locale_ref = locale.as_deref();
 
@@ -857,12 +982,23 @@ pub async fn delete_entry(
         )));
     }
 
-    state
+    store
-        .store
         .delete(&collection, &slug, locale_ref)
         .await
         .map_err(ApiError::from)?;
-    state.cache.invalidate_collection(&collection).await;
+    state.cache.invalidate_collection(&env, &collection).await;
+
+    webhooks::fire(
+        state.http_client.clone(),
+        &state.webhook_urls,
+        json!({
+            "event": webhooks::EVENT_CONTENT_DELETED,
+            "collection": collection,
+            "slug": slug,
+            "locale": locale_ref,
+            "environment": env,
+        }),
+    );
 
     Ok(StatusCode::NO_CONTENT)
 }

src/api/mod.rs

@@ -7,3 +7,4 @@ pub mod openapi;
 pub mod response;
 pub mod routes;
 pub mod transform;
+pub mod webhooks;

src/api/webhooks.rs

@@ -0,0 +1,62 @@
+//! Webhooks: POST to configured URLs when content or assets change.
+//! Configure via RUSTYCMS_WEBHOOKS (comma-separated URLs).
+
+use serde_json::Value;
+
+/// Event types sent in the payload.
+pub const EVENT_CONTENT_CREATED: &str = "content.created";
+pub const EVENT_CONTENT_UPDATED: &str = "content.updated";
+pub const EVENT_CONTENT_DELETED: &str = "content.deleted";
+pub const EVENT_ASSET_UPLOADED: &str = "asset.uploaded";
+pub const EVENT_ASSET_DELETED: &str = "asset.deleted";
+pub const EVENT_SCHEMA_CREATED: &str = "schema.created";
+pub const EVENT_SCHEMA_UPDATED: &str = "schema.updated";
+pub const EVENT_SCHEMA_DELETED: &str = "schema.deleted";
+
+/// Parse RUSTYCMS_WEBHOOKS env: comma-separated list of URLs.
+pub fn urls_from_env() -> Vec<String> {
+    std::env::var("RUSTYCMS_WEBHOOKS")
+        .ok()
+        .map(|s| {
+            s.split(',')
+                .map(|u| u.trim().to_string())
+                .filter(|u| !u.is_empty() && (u.starts_with("http://") || u.starts_with("https://")))
+                .collect()
+        })
+        .unwrap_or_default()
+}
+
+/// Fire webhooks in the background (spawns task, does not block).
+/// Payload should include at least "event" and relevant ids (collection, slug, etc.).
+pub fn fire(client: reqwest::Client, urls: &[String], payload: Value) {
+    if urls.is_empty() {
+        return;
+    }
+    let urls: Vec<String> = urls.to_vec();
+    let client = client.clone();
+    let body = match serde_json::to_vec(&payload) {
+        Ok(b) => b,
+        Err(_) => return,
+    };
+    tokio::spawn(async move {
+        for url in urls {
+            let res = client
+                .post(&url)
+                .header("Content-Type", "application/json")
+                .body(body.clone())
+                .send()
+                .await;
+            match res {
+                Ok(r) if r.status().is_success() => {
+                    tracing::debug!("Webhook {} succeeded", url);
+                }
+                Ok(r) => {
+                    tracing::warn!("Webhook {} returned {}", url, r.status());
+                }
+                Err(e) => {
+                    tracing::warn!("Webhook {} failed: {}", url, e);
+                }
+            }
+        }
+    });
+}

src/main.rs

@@ -146,9 +146,9 @@ async fn main() -> anyhow::Result<()> {
     let registry = Arc::new(RwLock::new(registry));
     let openapi_spec = Arc::new(RwLock::new(openapi_spec));
 
-    let api_key = std::env::var("RUSTYCMS_API_KEY").ok();
+    let api_keys = rustycms::api::auth::ApiKeys::from_env();
-    if api_key.is_some() {
+    if api_keys.as_ref().map(|k| k.is_enabled()).unwrap_or(false) {
-        tracing::info!("API key auth enabled (POST/PUT/DELETE require key)");
+        tracing::info!("API key auth enabled (write operations require key with role)");
     }
 
     let cache_ttl_secs = std::env::var("RUSTYCMS_CACHE_TTL_SECS")
@@ -173,23 +173,72 @@ async fn main() -> anyhow::Result<()> {
 
     let assets_dir = cli.content_dir.join("assets");
 
+    // RUSTYCMS_ENVIRONMENTS: comma-separated list (e.g. production,staging). File store only.
+    // Content for first env = content_dir; others = content_dir/<env>. Assets = content_dir/assets or content_dir/<env>/assets.
+    let store_kind = std::env::var("RUSTYCMS_STORE").unwrap_or_else(|_| "file".into());
+    let (environments, stores_map, assets_dirs_map, store, assets_dir) = match std::env::var("RUSTYCMS_ENVIRONMENTS").ok().as_deref() {
+        Some(s) if !s.trim().is_empty() && store_kind != "sqlite" => {
+            let env_list: Vec<String> = s.split(',').map(|e| e.trim().to_string()).filter(|e| !e.is_empty()).collect();
+            if env_list.is_empty() {
+                (None, None, None, store, assets_dir)
+            } else {
+                let mut stores = std::collections::HashMap::new();
+                let mut assets_dirs = std::collections::HashMap::new();
+                for (i, name) in env_list.iter().enumerate() {
+                    let content_base = if i == 0 {
+                        cli.content_dir.clone()
+                    } else {
+                        cli.content_dir.join(name)
+                    };
+                    let assets_path = if i == 0 {
+                        cli.content_dir.join("assets")
+                    } else {
+                        cli.content_dir.join(name).join("assets")
+                    };
+                    let s = FileStore::new(&content_base);
+                    stores.insert(name.clone(), Arc::new(s) as Arc<dyn rustycms::store::ContentStore>);
+                    assets_dirs.insert(name.clone(), assets_path);
+                }
+                let default_store = stores.get(&env_list[0]).cloned().unwrap();
+                let default_assets = assets_dirs.get(&env_list[0]).cloned().unwrap();
+                tracing::info!("Environments enabled: {:?} (default: {})", env_list, &env_list[0]);
+                (Some(env_list), Some(stores), Some(assets_dirs), default_store, default_assets)
+            }
+        }
+        _ => {
+            if std::env::var("RUSTYCMS_ENVIRONMENTS").is_ok() && store_kind == "sqlite" {
+                tracing::warn!("RUSTYCMS_ENVIRONMENTS is ignored when using SQLite store");
+            }
+            (None, None, None, store, assets_dir)
+        }
+    };
+
     // RUSTYCMS_BASE_URL is the public URL of the API (e.g. https://api.example.com).
     // Used to expand relative /api/assets/ paths to absolute URLs in responses.
     // Falls back to the local server_url (http://host:port).
     let base_url = std::env::var("RUSTYCMS_BASE_URL").unwrap_or_else(|_| server_url.clone());
 
+    let webhook_urls = rustycms::api::webhooks::urls_from_env();
+    if !webhook_urls.is_empty() {
+        tracing::info!("Webhooks enabled: {} URL(s)", webhook_urls.len());
+    }
+
     let state = Arc::new(AppState {
         registry: Arc::clone(&registry),
         store,
         openapi_spec: Arc::clone(&openapi_spec),
         types_dir: cli.types_dir.clone(),
-        api_key,
+        api_keys,
         cache: Arc::clone(&cache),
         transform_cache,
         http_client,
         locales,
         assets_dir,
         base_url,
+        webhook_urls,
+        environments,
+        stores: stores_map,
+        assets_dirs: assets_dirs_map,
     });
 
     // Hot-reload: watch types_dir and reload schemas on change

src/schema/mod.rs

@@ -64,8 +64,8 @@ mod tests {
         assert!(!registry.names().is_empty());
         let collections = registry.collection_names();
         assert!(
-            collections.contains(&"page".to_string()) || collections.contains(&"tag".to_string()),
+            !collections.is_empty(),
-            "expected at least one known collection, got {:?}",
+            "expected at least one content collection (non-reusable), got {:?}",
             collections
         );
     }