Duda prerequisites

This page lists everything needed before any Duda workflow tool runs. Duda is API-gated behind a paid plan, so the gating is more strict than WordPress.

1. Duda Team plan or higher

Duda API access requires a Team plan or higher. Free / Solo / Business plans don’t expose the REST API at all, so the worker can’t reach the backend regardless of what you configure here.

Check at https://my.duda.co/account/subscription — if you see “API access” listed, you’re good. If not, upgrade or ask your account owner to.

2. API credentials

In the Duda dashboard:

1. Click your account name → API & Webhooks (or go directly to https://my.duda.co/account/api-keys)
2. If you don’t see credentials, click Generate API key
3. Copy the API Username and API Password

These are account-wide — they let the worker manage any site under that Duda account, scoped per-site by duda_site_name. Treat them like an ordinary password (encrypted at rest if you store them anywhere else).

3. Set worker secrets

The worker reads Duda credentials from environment variables:

echo "<duda_api_user>" | npx wrangler secret put DUDA_API_USER
echo "<duda_api_pass>" | npx wrangler secret put DUDA_API_PASS

Or via the Cloudflare dashboard → Worker → Settings → Variables and Secrets. Mark both as Secret, not Text.

The worker uses the same pair for every Duda site you register. To rotate, revoke in Duda + regenerate + re-set the worker secrets.

4. Site duda_site_name

This is NOT the Duda site’s domain. It’s an internal Duda slug visible in the dashboard URL when you edit a site:

https://my.duda.co/home/site/edit/<DUDA_SITE_NAME>/main
                                  ^^^^^^^^^^^^^^^^^^^
                                  this part

The slug looks like 7a1c9e2f or mySiteName123. Grab it from the URL or from GET /api/sites/multiscreen/list if you have many sites.

5. Site registered in /admin/sites

Required fields:

Field	Value
ID (slug)	Stable worker identifier — acme-store, client-blog-2026
Display name	Free text
Platform	duda
Base URL	The site’s live URL — https://example.com
Duda site name	The internal slug from step 4

WordPress-specific fields (app password, page builders, MCP backend) are hidden for Duda sites — the worker doesn’t need them.

6. Blog enabled on the site (only for blog post workflows)

Duda creates the blog object lazily. The first create_draft will create it automatically if the site’s Post Types editor is enabled in Duda admin. If you see 404 not found at /blog/posts, open the Duda editor for the site and enable Blog under Post Types.

Pages (via create_page_draft, duplicate_page, inject_page_section) don’t need this — Pages v2 works as soon as the API user/pass is valid.

7. Token scope

The MCP token presented in /mcp calls must include:

• The Duda site in allowed_sites (or * wildcard)
• The tools in allowed_tools. Typical Duda picks:
  • Posts: create_draft, update_draft, schedule_draft, unschedule, get_post, list_drafts
  • Pages: create_page_draft, update_page_draft, duplicate_page, inject_page_section
  • Discovery: list_sites, get_site, ping_site

Note: Several built-in tools are not available on Duda:

• upload_media (Duda accepts only image URLs via featured_image_url)
• list_taxonomies / create_taxonomy (Duda tags are free-form strings, not WP-style taxonomies)
• schedule_page (Duda has no time-based page schedule — pages are drafted or pushed to STAGED_DRAFT for next site publish)
• create_page_from_code, list_page_templates (WordPress only)

The tools that don’t apply will return E_NOT_SUPPORTED if called against a Duda site — including them in allowed_tools doesn’t hurt, they just won’t ever fire.

8. Verify with ping_site

Confirm credentials + site_name resolve before any real work:

Ping site acme-store.

Should return { ok: true, message: "Authenticated as <name>" }. If you see 401 Unauthorized, the API user/pass is wrong. If you see 404 Site not found, duda_site_name is wrong.

diagnose_site is WordPress-only and will return a clear error for Duda sites — that’s expected.

Next

• Blog posts
• Pages (Pages v2)
• Duplicate a page
• Content injection (sections)