Self-serve keys
Customers create and revoke keys in their dashboard. Keys are shown once, then stored as peppered hashes.
Developer products
Sell your API, metered per call.
A versioned /v1 REST API with self-serve bearer keys, per-key rate limits and a credit cost on each call — managed from a member dashboard your customers already understand.
- Keys hashed and peppered at rest
- Per-key rate limits
- Credit cost per call
.env
SITE_PROFILE="api-product"one line picks this site typeWhat you don't have to build.
Rate limits
Per-key rate-limit buckets protect your server and are visible in the admin.
A credit per call
Calls spend credits through the same ledger as the rest of the app, with plans granting the allowance.
/v1 JSON envelopes
Consistent request and error shapes on a versioned path — copy the example resource for your own.
Revoke from the admin
Operators can revoke any key or block an account; blocked users' keys stop working immediately.
Docs your agent can extend
API_PRODUCT.md explains the endpoints and how to add a resource safely.
From first click to working product.
- 1
Create a key
The customer creates a key and copies it once.
- 2
Call /v1
Each request sends the key as a bearer token.
- 3
Check & meter
The key is verified, rate-limited and the call's credits spent.
- 4
Respond
A consistent JSON envelope comes back, errors included.
Not a mock-up. The shipped screens.
Screenshots of the template running locally with sample data, on the house design. Switch SITE_DESIGN and the public pages wear any of the other designs.
Set it up
A few lines of config. Then it's live.
SITE_PROFILE="api-product" API_KEY_PEPPER="…" STRIPE_SECRET_KEY="sk_live_…" STRIPE_PRICE_PRO_MONTHLY="price_…"
- 1
Unzip and install
Copy the folder and run the installer — it creates the database and secrets.
php scripts/install.php - 2
Add your keys, run the doctor
It checks every key, extension and permission and names anything missing.
php scripts/doctor.php - 3
Deploy to your server
NGINX + PHP on any small VPS, with the step-by-step deploy guide and nightly backups.
Good for
- Data & enrichment APIs
- AI wrapper APIs
- Conversion & rendering APIs
- Internal APIs with billing
- Developer tools
API Product, answered.
Only a peppered hash is stored. The full key is shown once when created; after that it can be revoked but not read back.
Yes. The /v1 example resource shows the auth, metering and response shape to copy for your own.
Per-key rate limits, credit costs per call, and operator controls to revoke keys or block accounts.
Every other site type comes with it.
All seven site types. One price.
Full source, every site type, the admin, the CMS, 43 designs and the deploy guides — £49, once. Unlimited own and client projects.