Developer API

Drive your servers from your own code with an API key.

Anything you can do on a server's page you can do over HTTP: check status, start and stop, send console commands, manage players, take backups, install plugins and edit files. People use it for Discord bots, status pages, scheduled jobs and AI agents.

Get a key

  1. Open API keys in the panel.
  2. Name the key after the thing that will use it, so you know what you are revoking later.
  3. Pick what it may do: Read only, Control, or Full access.
  4. Optionally restrict it to a single server.

The key is shown once and never again: we store only a hash of it. If you lose it, create another and revoke the old one.

Make a request

Send the key as a bearer token. The base URL is https://flashhosting.net/api/v1 and every response is JSON: successes carry a data field, failures carry an error with a code and a message.

curl -H "Authorization: Bearer flash_sk_your_key" https://flashhosting.net/api/v1/servers
POST /api/v1/servers/SERVER_ID/power
Authorization: Bearer flash_sk_your_key
Content-Type: application/json

{ "action": "restart" }

What you can call

  • GET /servers and GET /servers/{id}: your servers and their live status.
  • POST /servers/{id}/power: start, stop, restart, kill, freeze, thaw.
  • POST /servers/{id}/command: run a console command.
  • GET and POST /servers/{id}/players: who is online; kick, ban, unban, op, deop.
  • GET and POST /servers/{id}/backups: list backups, take a new one.
  • GET and POST /servers/{id}/plugins: list plugins, install one by URL.
  • GET /servers/{id}/files and /files/contents: browse and read files.
  • PUT /servers/{id}/files/contents: write a file, up to 1 MB.

Limits

  • 120 requests per minute per key.
  • 20 power actions per minute per server.
  • 10 backups per hour per server.
  • A 429 response means you hit one of these; wait and try again.

What a key can and cannot do

A key can never do more than the person who created it. Its permissions are checked against your own access to that server on every request, so if your access changes or is removed, the key follows.

A key is a password. Anyone holding it can do everything it allows to your servers, and that is your responsibility, not ours. Keep it out of public repositories and screenshots, give automated agents the narrowest tier that does the job, and revoke a key the moment you suspect it has leaked.