# Getting started
This walks you from zero to one published site in about 15 minutes. No prior StaticOwl knowledge assumed.
# Prerequisites
- Node.js 20+ (
node --version) - An InvariantDB engine endpoint — the hosted service at
https://invariantdb.com(you'll need agq_API key). The legacyhttps://api.graphiquity.comendpoint and the locally-runnable engine from the parent project are deprecated for production use (see ADR-0031, 2026-06-02 cutover). - AWS credentials if you plan to deploy to S3 + CloudFront (default deploy target)
If you're integrating against a hosted StaticOwl CMS rather than running one, you don't need any of this — go to HTTP API and the @staticowl/mcp-client typed SDK.
# Install
git clone <repo>
cd cms
npm install
npm run build
This builds every package in the workspace (@staticowl/core, @staticowl/server, @staticowl/build, @staticowl/cli, @staticowl/mcp, @staticowl/ui, @staticowl/ui-next).
# Configure
Set the environment variables the server needs. For local dev, drop them in a .env at the repo root or export them in your shell:
# Engine connection — required
export GRAPHIQUITY_ENDPOINT=https://invariantdb.com # was api.graphiquity.com pre-2026-06-02
export GRAPHIQUITY_API_KEY=gq_yourkey # graph-level engine key
# Cognito — required for the admin UI auth flow
export USER_POOL_ID=us-east-1_xxxxxx
export USER_POOL_CLIENT_ID=yyyyyyyyy
export AWS_REGION=us-east-1
# Deploy target — defaults to static-paths
export STATICOWL_DEPLOY_TARGET=static-paths # or 'github', 'manifest-pointer', 'both'
export STATICOWL_DEPLOYMENT_MODEL=new # or 'legacy', 'dual'
# AI providers — optional but unlocks the AI features
export ANTHROPIC_API_KEY=sk-ant-xxxxx
export REPLICATE_API_TOKEN=r8_xxxxx
See operations.md for the full env var reference.
# Run the admin server
npm run cms -- serve --port 5000
This boots the Express admin server on port 5000, serving:
- The admin UI at
http://localhost:5000/admin/ - The HTTP API at
http://localhost:5000/api/*
The MCP server is not mounted on this server. It's a separate, stdio-only process that talks to this HTTP API — launch it as a subprocess from your agent client. See MCP.
# First site
- Sign in at
http://localhost:5000/admin/login.html(creates a Cognito-backed user; the first user becomes platform owner automatically) - Create a site from the sites picker (
POST /api/sitesunder the hood) - Pick a starter kit based on your persona —
developer,author,designer, ornone. The starter seeds your site's graph with a content type or two and a default template. - Add content — go to the Content tab, pick a type, hit "New".
- Save — the content node is written to the graph.
- Publish — hit the Publish button or
POST /api/build. The site compiles to static files and (depending onSTATICOWL_DEPLOY_TARGET) writes to S3 / a GitHub repo / the manifest layer. - Visit the site — your bound public URL or the auto-provisioned
<site>.staticowl.compreview.
# Verify it built
# Static-paths target → S3
aws s3 ls s3://staticowl-sites/<site-id>/dev/
# GitHub target → your repo
git -C /tmp/your-clone log --oneline | head
# Manifest-pointer target → check the deployment fact
curl http://localhost:5000/api/releases/replay?envId=dev \
-H "Authorization: Bearer $TOKEN" -H "X-Site-Id: site:..."
# Where to go next
- Features overview — what the system can do for you
- HTTP API — every endpoint, for building integrations
- MCP — let Claude / Cursor talk to your CMS
- Architecture — how it all fits together
- Lifecycle hooks — code that runs at save / render / publish
# Common gotchas
- "Cognito SDK not loaded" — make sure
USER_POOL_IDandUSER_POOL_CLIENT_IDare correct; the SDK loads from a CDN at runtime, so the browser needs network access. - "Engine connection refused" — check
GRAPHIQUITY_ENDPOINTis reachable from wherever the server runs (Lambda, EC2, your laptop). - "Rate limit exceeded: 300/300 query requests" — the platform middleware is making one engine query per request for auth context. There's a known pending fix to add a 30-second cache on
getOrCreateUser. Until then, a busy admin session can hit it; reload solves it. - GitHub deploy target needs
giton the host — the publisher shells out togit. Lambda doesn't have git; deploy publisher work to EC2. - Lifecycle hook RCE risk — verify your sandbox is
isolated-vm, not Node's built-invm(which is not a security boundary). See lifecycle-hooks.md.