Platform API

If you are building a product where your customers publish something — a site builder, an agency tool, an app platform — this lets your backend provision hosting for them. Your customer clicks publish, your server calls us, their app is live. They never see our name.

It is the same hosting the panel and the MCP tools drive, reached a different way. Anything you can do in the panel, your backend can do over HTTP.

The platform API runs on a Fleet plan, so the key page unlocks once the account is on Fleet. Create a key under Platform in the panel and choose what it can do at creation — a key that provisions and deploys does not need to be able to delete, and most integrations never delete, because a customer cancelling means suspending rather than destroying.

The secret is shown once and stored only as a hash. If you lose it, rotate the key: the old secret keeps working for 24 hours so you can roll the new one out without taking your customers offline.

SPOCKET_CLIENT_ID=spk_live_...
SPOCKET_CLIENT_SECRET=sk_...

Exchange the client id and secret for an access token, then send that token as a bearer on every call. Tokens last an hour; mint another whenever you need one.

curl -X POST https://www.spocket.dev/api/v1/token \
  -H "content-type: application/json" \
  -d '{
    "grant_type": "client_credentials",
    "client_id": "$SPOCKET_CLIENT_ID",
    "client_secret": "$SPOCKET_CLIENT_SECRET"
  }'

One call creates the app and deploys its first version. Pass sub_account_ref with your own id for the customer, and their apps are grouped and kept apart from your other customers.

curl -X POST https://www.spocket.dev/api/v1/apps \
  -H "authorization: Bearer $TOKEN" \
  -H "content-type: application/json" \
  -H "idempotency-key: $YOUR_REQUEST_ID" \
  -d '{
    "name": "acme-site",
    "kind": "site",
    "sub_account_ref": "cus_your_customer_id",
    "files": [
      { "path": "index.html", "content": "PGgxPkhlbGxvPC9oMT4=" }
    ]
  }'

File contents are base64. Send an idempotency key: if the call times out and you retry, you get the app that was already created rather than a second one you would also be billed for.

GET /api/v1/apps/:id returns a diagnosis alongside the status when we can tell what went wrong — a missing package named, a rejected token, memory exhausted. Show it to your customer and most support never reaches you.

Deleting through the API is reversible. The app stops immediately and billing stops with it, but nothing is destroyed for seven days, so a loop that deleted the wrong thing can be undone.

The platform API runs on a Fleet plan, which covers twenty apps. Every app beyond that is $2.45 a month — the rate Fleet itself works out at, so your cost per app is the same at twenty apps and at a thousand. Provisioning and deleting adjust the count immediately and the difference is prorated.

How you charge your own customers is entirely yours. We never touch that.