Platform API

If you are building a product where your customers publish something — a site builder, an agency tool, an app platform — this lets your backend provision hosting for them. Your customer clicks publish, your server calls us, their app is live. They never see our name.

It is the same hosting the panel and the MCP tools drive, reached a different way. Anything you can do in the panel, your backend can do over HTTP.

Create one under Platform in the panel. You choose what it can do at creation — a key that provisions and deploys does not need to be able to delete, and most integrations never delete, because a customer cancelling means suspending rather than destroying.

The secret is shown once and stored only as a hash. If you lose it, rotate the key: the old secret keeps working for 24 hours so you can roll the new one out without taking your customers offline.

SPOCKET_CLIENT_ID=spk_live_...
SPOCKET_CLIENT_SECRET=sk_...

Exchange the client id and secret for an access token, then send that token as a bearer on every call. Tokens last an hour; mint another whenever you need one.

curl -X POST https://www.spocket.dev/api/v1/token \
  -H "content-type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "$SPOCKET_CLIENT_ID",
    "client_secret": "$SPOCKET_CLIENT_SECRET"
  }'

One call creates the app and deploys its first version. Pass sub_account_ref with your own id for the customer, and their apps are grouped and kept apart from your other customers.

curl -X POST https://www.spocket.dev/api/v1/apps \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -H "idempotency-key: $YOUR_REQUEST_ID" \
  -d '{
    "name": "acme-site",
    "kind": "site",
    "sub_account_ref": "cus_your_customer_id",
    "files": [
      { "path": "index.html", "content": "PGgxPkhlbGxvPC9oMT4=" }
    ]
  }'

File contents are base64. Send an idempotency key: if the call times out and you retry, you get the app that was already created rather than a second one you would also be billed for.

GET /api/v1/apps/:id returns a diagnosis alongside the status when we can tell what went wrong — a missing package named, a rejected token, memory exhausted. Show it to your customer and most support never reaches you.

Deleting through the API is reversible. The app stops immediately and billing stops with it, but nothing is destroyed for seven days, so a loop that deleted the wrong thing can be undone.

You are charged $2 per app per month, for however many are running. Provisioning and deleting adjust it immediately and the difference is prorated — there is no tier to outgrow and no plan to change as you add customers.

How you charge your own customers is entirely yours. We never touch that.