Preview, cache, and crawlers
Both Delivery API endpoints share this behaviour: the preview token, the cache, CORS, and what a crawler can read.
Preview tokens
Pass ?preview_token=<token> to read unpublished content. Both endpoints take it,
and both return versionId: null for a preview. An invalid token returns 401.
curl "https://api.picked.app/api/v1/projects/proj_123?preview_token=<token>"The management API holds the preview token of a workspace in the
previewToken field. The preview action in the dashboard also makes one for you.
Use the same token for the project configuration request and for the experience content request. Both then come from the same preview.
Cache
The cache rules depend on the surface and on the client that makes the request. The
SDK sends a Picked-Client: sdk request header:
| Request | Cache-Control |
|---|---|
Published, Picked-Client: sdk | public, s-maxage=10 |
| Published, other clients | private, no-store |
| Preview | no-store |
A published response that a cache can hold also sends Vary: Picked-Client. A shared
cache therefore keys on the client header. It never gives a body that it cached for
the SDK to a request from another client.
CORS
Both endpoints can be read from another origin. An OPTIONS preflight returns 204
with the CORS headers:
| Header | Value |
|---|---|
Access-Control-Allow-Origin | * |
Access-Control-Allow-Methods | GET, OPTIONS |
Access-Control-Allow-Headers | Content-Type, Picked-Client, Picked-Version, traceparent, tracestate |
Crawlers and search rank
A crawler can read both endpoints, so a search engine can read your published
content. A preview URL is disallowed, so a draft never reaches the index. These are
the robots.txt rules:
User-agent: *
# Let a crawler read the public project configuration and experience content.
Allow: /api/v1/projects
Allow: /api/v1/projects/*/experiences/*/content
# Keep a preview response, which is a draft, away from a crawler.
Disallow: /api/v1/projects/*preview_token=
# Everything else stays disallowed: GraphQL, MCP, internal routes, and the ping.
Disallow: /
See Project Config and Experience Content for the endpoints.
Related
- About the two APIs — how a preview stays out of the search index.
- How to render an unpublished preview