Strapi

Standalone Node.js server with REST and GraphQL APIs

Strapi is a headless CMS written in TypeScript that runs as its own Node.js server. Content types are modeled in an admin panel; Strapi stores the entries in a SQL database and serves them over a REST API, or over GraphQL with the official @strapi/plugin-graphql plugin. The frontend sees nothing of the CMS but that API.

That design sets it apart from TinaCMS, which commits content as Markdown to the Git repository, and from StudioCMS, which lives inside an Astro project. Strapi is one more service to host, along with its database. It is also downloaded far more often than TinaCMS: 258,813 times from npm in the week of September 28, 2026, against 62,778 for tinacms.

The open source headless CMS comparison lays out the framework, database and hosting each option requires.

Content models you commit with the code

• Content models live in the codebase: the Content-Type Builder writes each type to a schema.json under src/api/, which you commit and deploy with the project.
• REST endpoints without writing code: every type gets its routes, with filters, sort, pagination, populate for relations, and locale and status for translations and drafts.
• Two permission systems: admin roles govern editors, while the Users & Permissions plugin authenticates the API's end users with JWTs, by email or through a provider such as Google or GitHub.
• Drafts, locales and media in core: Draft & Publish, internationalization and the media library ship without plugins.

MIT outside the ee/ folders, SSO as a paid add-on

MIT, except the ee/ folders. The LICENSE file grants MIT only to users who touch no component under the ee/ directories and hold no Strapi Cloud account. That code ships in the same repository and falls under the Strapi Enterprise license.

Review workflows, SSO and audit logs are paid. The free Community edition keeps the APIs, roles and unlimited usage. Growth, at $45 a month for three seats plus $15 per extra seat, adds Live Preview, Releases (a batch of entries published in one go), 14 days of content history and Strapi AI; admin SSO is an add-on from $150 a month. Review workflows and audit logs exist only in Enterprise, priced on request.

Node.js LTS, a SQL database and at least 2 GB of RAM. The docs require Node.js 22, 24 or 26, and PostgreSQL 14+, MySQL 8.0+, MariaDB 10.3+ or SQLite 3. MongoDB and "cloud native" databases such as Amazon Aurora are not supported. The minimum is 1 core, 2 GB of RAM and 8 GB of disk; the recommendation is 2 cores, 4 GB and 32 GB.

No official Docker image. You build your own from the project, by hand or with the community tool @strapi-community/dockerize. On Strapi Cloud, the Starter plan costs $35 per project per month and sleeps when idle.

Schema changes happen in development only. The Content-Type Builder is only available in the development environment, so in production a new field goes through code and a redeploy.

Weekly releases, v4 retired. v5.57.0 shipped on October 7, 2026, the 44th release of the 5.x line since January. Strapi 4 reached end of life on April 30, 2026; its final release, v4.26.2 on June 9, patched a critical data exposure flaw (CVE-2026-27886). Moving to v5 combines an upgrade tool that runs codemods with manual fixes to code hit by breaking changes.