API v1 · CLI · Terraform

Deploy from code, authenticate with a key.

No OAuth flow, no email verification, no service account with a JSON blob attached to a Google identity. A scoped token derived from your access key, sent as a bearer header, over clearnet or onion. That is the whole authentication model.

CLI

Single static binary

No runtime, no package manager, no telemetry. Reproducibly built, signed, and about 9 MB.

# the installer endpoint is not published yet
curl -sSL https://vpsden.com/cli | sh
vpsden auth UMB-XXXXX-XXXXX-XXXXX
vpsden deploy --plan shade \
  --region reykjavik-iceland

Terraform

Official provider

Full resource coverage including LUKS, dead-man switch and failover configuration.

terraform {
  required_providers {
    vpsden = {
      source = "vpsden/vpsden"
    }
  }
}

REST

Everything the panel does

JSON in, JSON out. OpenAPI 3.1 spec published. Cursor pagination, idempotency keys.

curl https://api.vpsden.com/v1/instances \
  -H "Authorization: Bearer $VPSDEN_TOKEN"

# or over onion:
# http://umbraq7v2...onion/v1/instances

Deploy an instance

POST /v1/instances
Authorization: Bearer umb_tok_...
Content-Type: application/json
Idempotency-Key: 8f2c1e4a-...

{
  "plan": "shade",
  "region": "reykjavik-iceland",
  "os": "debian-13",
  "resources": {
    "vcpu": 2,
    "ram_gb": 4,
    "disk_gb": 60,
    "bandwidth_tb": 10
  },
  "addons": {
    "luks": {
      "enabled": true,
      "unlock_pubkey": "ssh-ed25519 AAAA..."
    },
    "deadman": {
      "enabled": true,
      "interval_hours": 168,
      "grace_hours": 48
    },
    "failover": {
      "enabled": true,
      "standby_region": "victoria-seychelles"
    },
    "no_metadata": { "enabled": true }
  },
  "cloud_init": "#cloud-config\npackages: [nftables]",
  "term": "m12"
}

Response:

201 Created

{
  "id": "ins_7f2a9c",
  "state": "provisioning",
  "region": "reykjavik-iceland",
  "ipv4": ["192.0.2.42"],
  "ipv6": "2a0e:97c0:1f0::/64",
  "onion": null,
  "luks": {
    "unlock_endpoint": "192.0.2.42:2222",
    "unlock_host_key_sha256": "SHA256:9f2c...a41e"
  },
  "created_at": 1785312044
}

Authentication

Tokens are derived from your access key and scoped. A token can be limited to specific instances, specific verbs, and given an expiry — so a CI pipeline can be issued a token that can create and destroy but never read your billing balance or alter your dead-man switch.

vpsden token create \
  --scope "instances:create,instances:destroy" \
  --instances "ins_7f2a9c,ins_3b81de" \
  --expires 30d \
  --label "ci-runner"

Tokens are bearer credentials

Anyone holding one can act within its scope. There is no second factor, because a second factor is an identity — a phone number, an email address, or a device we would have to recognise. Scope tokens tightly and rotate them.

Over the onion service

The API is available at the same paths on our v3 onion service. Point the CLI at it and your control-plane traffic never traverses clearnet:

vpsden config set endpoint \
  http://umbraq7v2xk4tn6jr3lz5wyhc8pfd9mgs2eab6uvn4x7ytqzk3jlqrid.onion

# with torsocks, or set ALL_PROXY=socks5h://127.0.0.1:9050
torsocks vpsden deploy --plan ghost-m --region victoria-seychelles

Rate limits

Endpoint class	Limit
Read	600 / minute
Write	60 / minute
Instance creation	20 / minute
Token operations	10 / minute

Limits are per token, not per source address — we do not track source addresses. Headers are returned on every response and 429s carry a Retry-After.

Machine-readable everything

Beyond the API itself, the following are published as stable, unauthenticated endpoints:

/api/facts — plans, prices, regions, jurisdictions and policies as JSON. Regenerated on every deploy.
/api/pricing — the pricing engine's inputs, so you can compute a quote without calling us.
/canary.json — the warrant canary, monitorable by cron.
/llms.txt and /llms-full.txt — the site as plain text.
/openapi.json — the OpenAPI 3.1 specification. Not published yet.

Questions

API questions

Does VPSDEN have an API?

Yes. A REST API authenticated with a scoped token derived from your access key, plus a Terraform provider and a single-binary CLI. Every action available in the control panel has an API equivalent, and the API is reachable over both clearnet and our v3 onion service.

Deploy your first instance from a terminal.

No console login required. Buy a server, take the access key, mint a token.

Build your server Hardening checklist

No email · No KYC · Pay in Monero · Deployed in under a minute