Introduction
Strapi is an open-source headless CMS that lets you quickly build REST or GraphQL APIs. In 2026, it remains the go-to tool for developers who want to separate backend from frontend. This tutorial teaches you how to install Strapi, create a content type, and expose secure REST endpoints. You'll see how Strapi automatically generates CRUD routes while providing an intuitive admin panel. Ideal for modern projects that need flexible content management.
Prerequisites
- Node.js 20 or higher
- npm or yarn
- Basic JavaScript knowledge
- A code editor (VS Code recommended)
Install the Strapi Project
npx create-strapi-app@latest mon-api --quickstartThis command creates a complete Strapi project with SQLite by default. The --quickstart flag automatically starts the server after installation.
Start the Development Server
cd mon-api
npm run developThe server starts at http://localhost:1337. The admin panel is available at /admin to create your first user account.
Create the Article Content Type
{
"kind": "collectionType",
"collectionName": "articles",
"info": {
"singularName": "article",
"pluralName": "articles",
"displayName": "Article"
},
"options": {
"draftAndPublish": true
},
"attributes": {
"title": {
"type": "string",
"required": true
},
"content": {
"type": "richtext"
}
}
}This JSON file defines the Article model with a required title and rich content field. Restart the server to apply the changes.
Configure API Permissions
'use strict';
module.exports = {
routes: [
{
method: 'GET',
path: '/articles',
handler: 'article.find',
config: { policies: [] }
}
]
};This file explicitly enables the GET /api/articles route. Strapi automatically generates the remaining CRUD methods.
Test the REST API
curl http://localhost:1337/api/articlesThis command verifies that the REST endpoint returns articles. Add data through the admin panel before testing.
Best Practices
- Always enable draftAndPublish for content
- Protect routes with policies or roles
- Use environment variables for secrets
- Version your configuration files
- Test endpoints with Postman or Thunder Client
Common Mistakes to Avoid
- Forgetting to restart the server after modifying schemas
- Leaving API permissions open in production
- Incorrectly configuring environment variables
- Ignoring content type validation errors
Going Further
Check out our complete Strapi courses to master plugins, authentication, and production deployment.