Permissions, Draft/Publish & Extending Strapi

RBAC & API Tokens

Role-based permissions restrict which admin users can do what (an editor role limited to blog posts, no site settings access). API tokens authenticate external clients (a frontend fetching content) without going through admin login — scope each token's permissions narrowly (e.g. read-only, published content only), following least privilege.

Draft & Publish

A draft entry can be edited without appearing on the public API by default; publishing makes it live. This lets editors prepare/review content changes before they go public, rather than every save being immediately visible.

Media Library & i18n

Built-in upload/organize UI for images/videos/docs, with swappable storage backends (local disk, S3) — editors don't need to know which is active. The i18n plugin manages multiple language versions of the same entry, with the API serving the right locale on request.

Lifecycle Hooks & Plugins

// src/api/article/content-types/article/lifecycles.js
module.exports = {
  async beforeCreate(event) {
    event.params.data.slug = slugify(event.params.data.title);
  },
  async afterUpdate(event) {
    await notifySubscribers(event.result);
  },
};

Hooks (beforeCreate, afterUpdate, beforeDelete) inject custom logic at specific points in an entry's lifecycle. Being Node.js/TS-based, Strapi customization uses the same language a JS-centric team already works in elsewhere — no context switch to a separate backend stack, and it pairs naturally with a frontend like Next.js fetching content via the API for a clean content/presentation split.