Keyboard shortcuts for Visual Editor

Experiment where content lives. Storyblok’s A/B Testing brings experimentation directly into the CMS, helping marketers, content teams, and developers test and optimize content without relying on disconnected tools or complex workflows. Built as part of Storyblok Labs, under Experiments, the feature introduces three core building blocks: Experiments: Define which content Variants should be tested and for how longVariants: Create and manage multiple versions of Stories directly in StoryblokResults: Surface experiment performance data from your existing analytics stack directly inside the CMS By separating content creation, experiment execution, and results visibility, teams can adopt experimentation in a way that fits their existing setup, while keeping governance, workflows, and collaboration centralized in Storyblok. Part of Storyblok Labs - Experiments. Available for Elite and Premium plans only. Learn More.

Personal access tokens for the Management API now support granular scopes and space restrictions. When you create a token, you choose which scopes it can use (stories, assets, components, webhooks, and more) on a read-write-publish hierarchy, and whether it applies to all spaces or only specific ones. Endpoints outside the standard content scopes — organization management, billing, SSO, user management, and others — are blocked by default. Until now, every personal access token had full read-write access to every space the user owned. A token built for a CI pipeline that publishes stories in one space could also delete components in any other space, change billing, or touch user management. The same risk applies to AI assistants calling the Management API through the Storyblok MCP server. Scoped tokens limit the blast radius of a compromised, leaked, or prompt-injected token. Existing unscoped tokens enter a six-month transition period and will be revoked on 30.11.2026. Key Benefits: Limit each token to only the scopes and spaces it actually needsEndpoints like organization, billing, SSO, and user management are blocked by defaultReduce the blast radius of a compromised or leaked tokenTighter control over AI assistants and MCP server integrationsToken rotation is explicit and audit-friendly — change scopes by revoking and creating a new token [Learn More]