Operating model & access

Steeren runs behind your website. Your content, leads, CRM, newsletters, and analytics all live in Steeren, and your site reads from it. The thing to understand up front is that there's no single "right" way to use Steeren - you can drive it by hand, from your own code, or by asking an AI assistant to do the work for you. Pick whatever suits the moment, and switch freely. They all act on the same workspace, so anything you can do by hand, you can automate later.

This page covers those three ways to operate Steeren, how access and security work, and where a human stays in the loop before anything goes live.

Three ways to operate Steeren

These aren't separate products - they're three doors into the same workspace. A change you make in the dashboard shows up for your scripts; a post your assistant drafts shows up in the dashboard for you to review.

The dashboard

The dashboard is your cockpit. You log in, and you see the workspaces you belong to. From there you write and edit posts, publish them, manage your CRM and leads, send newsletters, and watch your analytics.

A few things worth knowing:

• There are no save buttons. Your edits autosave as you go.
• It updates live. When an AI assistant or a teammate changes something, you see it stream in - you don't need to refresh.
• Publishing is its own deliberate step. Writing a draft never puts it in front of the public. A post stays a draft until you (or someone you've authorized) explicitly publish it.

If you only ever use the dashboard, that's completely fine. Everything Steeren does is reachable here.

Using the API with your own key

If you're a developer and want to wire Steeren into your own scripts, jobs, or build tooling, you do that with a personal API key - a secret string that starts with nk_.

You create a key in the dashboard. Think of it as a password for your code: anyone holding it can act as you, so keep it in a secret manager or an environment variable, never in committed source.

A couple of practical points:

• A key is scoped to one workspace - the workspace you created it in. It can't reach your other workspaces. If you run several workspaces, create a key in each.
• The raw key is shown exactly once, right when you create it. Steeren stores only a fingerprint of it and can't show it to you again, so copy it somewhere safe immediately.
• If you lose a key, just revoke it and make a new one. Revoking takes effect right away.

[!WARNING] Treat an nk_ key like a password. If it leaks, revoke it in the dashboard and issue a fresh one - a revoked key stops working on its very next use.

Reading content onto your site

If you're a developer putting Steeren behind a website, you read your published content with the official SDK - @nukipa/site-sdk - and render post bodies with @nukipa/post-renderer-react (or @nukipa/post-renderer-vue). The SDK is a small, typed client for the reads your site needs (your posts, pages, navigation) and the signals it sends back (form submissions, newsletter subscribes, page visits, CTA clicks).

A few things hold true no matter how you build:

• Your site only ever sees published content. Drafts stay private. A draft is invisible to your live site until you publish it.
• You don't need an API key to read public content onto your site. The read side is keyed to your site's own domain, not to a secret. You only need an nk_ key when you want to operate Steeren from code - authoring, CRM, newsletters, and the like.
• Gated posts return a teaser. If you gate a post behind a form, your site receives the excerpt and opening paragraphs plus the form to render, and the rest unlocks once the reader submits. See the content gating guide for setup.

[!TIP] If your framework caches pages (for example, a statically-rendered Next.js site), a freshly published post appears on your site's next refresh rather than the exact instant you hit publish. That refresh window is yours to tune in the SDK. On a site that fetches fresh every time, new content shows up on the next request.

[!NOTE] Anything tied to a live visitor - a form submission, a newsletter subscribe, a page-visit ping, a CTA click - happens in real time, every time, and is never cached. Visit and click pings are also fire-and-forget: if one fails, it quietly drops and never breaks the page for your reader.

Asking an AI assistant

You can also connect an AI assistant - like Claude or ChatGPT - to your Steeren workspace and simply ask it to do the work. "Draft a launch announcement." "Who signed up this week?" "Schedule this newsletter for Tuesday." The assistant does the same things you'd do in the dashboard, and you stay in control of what actually ships.

Connecting and approving access

You connect Steeren as a tool in your assistant, sign in, and approve which workspace (or workspaces) the assistant may operate in. That approval is the boundary: the assistant can only touch the workspaces you explicitly grant, and nothing else.

Two ways to grant that access, depending on your assistant:

• Approve at connect time. Assistants like Claude.ai and ChatGPT walk you through a consent screen where you pick the workspace(s) to authorize. The assistant's reach is exactly what you approve there - no more.
• Hand it a personal key. For other setups, you can give the assistant an nk_ key you made in the dashboard. Since a personal key is scoped to one workspace, the assistant is confined to that workspace.

[!NOTE] Access is something you grant, not something the assistant takes. It starts with nothing and can reach only the workspaces you approve. To work in a new workspace, grant it and reconnect - and if you remove an assistant's access to a workspace, that takes effect within about a minute.

[!TIP] When you grant access to more than one workspace, a good assistant will confirm which workspace it's about to act in before doing anything that writes. If you're ever unsure, ask it to list the workspaces it can see, and to name the one it's working in.

Staying in the loop before publish

However you operate Steeren, going live is always a deliberate act - never an accidental side effect of drafting. An AI assistant can research, write a full post, generate a cover image, and check its facts, and the post still sits as a draft until someone hits publish.

That gives you two clean approval styles:

• Draft, then publish yourself. Let the assistant (or a teammate) do the work, then review it in the dashboard on your own time and publish when you're happy. This is the simplest hard gate: if you never hand over the publish step, nothing ships without you.
• Ride along while it works. When you want to watch an assistant in real time, the dashboard's Verify view shows what it's doing step by step and lets you leave feedback - a comment, a request for changes, or an approval - without leaving the page. The assistant pauses for your response and acts on it, so you can shape the work as it happens and only let it proceed once you approve.

Use whichever fits the task. Hand-off-and-review when you trust the brief; ride-along when you want a closer hand on the wheel.

[!NOTE] Publishing is reversible and nothing is lost along the way. Each time you publish, Steeren keeps a snapshot in the post's history, and unpublishing simply takes it off your live site while the history stays intact. You can always look back at - or roll back to - an earlier version.

FAQ

Do I need an API key just to put Steeren behind my site? No. Reading your published content onto your site doesn't need a key - it's tied to your site's own domain. You only need an nk_ key when you want to operate Steeren from your own code: authoring, CRM, newsletters, and so on.

Can one API key work across several workspaces? A personal key you create in the dashboard is scoped to the single workspace you made it in. If you run multiple workspaces, create a key in each. (An AI assistant connected through a consent flow can span the workspaces you approve there, but a personal key stays with one.)

I was just added to a workspace, but my assistant can't see it. Why? An assistant's access is fixed at the moment it connects. Newly granted access doesn't appear mid-session - reconnect (or re-authorize) to pick up the new workspace. Removing access is the reverse: it takes effect within about a minute, no reconnect needed.

Does publishing show up on my site instantly? Steeren marks it live immediately. Whether your visitors see it that exact second depends on how your site is built: a cached, statically-rendered site refreshes on its own timer (which you can tune), while a site that fetches fresh shows it on the next request.

Can an AI assistant publish without me? Only if you let it. For a hard human gate, keep the publish step to yourself in the dashboard, or use the Verify view so the assistant waits for your approval before anything goes live. Drafting on its own never publishes.

Where do I create and revoke API keys? In the dashboard. Keys are listed per workspace, the raw value is shown once when you create it, and you can revoke a key at any time - it stops working on its next use.