Platform/API & Webhooks

One API call. A live, logged-in WordPress.

Create a real WordPress site from your code and get back a URL that's already logged in. One token, one endpoint, every plan including the $2 sandbox.

Create a token → View the API reference

REST API on every plan Webhooks: site.create / site.delete The same API the CLI runs on

REST API

On every plan

4 scopes

Set per token

2 events

site.create, site.delete

HMAC signed

Retried up to 3x

Call it from any stack.

Authenticate with a bearer token, POST to one endpoint, and get JSON back with a live URL and an autologin. Copy the call in curl, JavaScript, or PHP.

cURLJavaScriptPHP

POST/api/v2/sites/template

$ curl -X POST $API/sites/template \ -H "Authorization: Bearer $TOKEN" \ -d '{"template_slug":"woo-starter","site_name":"acme"}'

200 OKapplication/json

{ "wp_url": "https://acme.instawp.xyz", "wp_username": "admin", "s_hash": "a1c97f2e" // autologin }

Shell-native. Paste into CI, cron, or a script. One command.

POST/api/v2/sites/template

const res = await fetch(`${API}/sites/template`, { method: 'POST', headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' }, body: JSON.stringify({ template_slug: 'woo-starter' }) }); const site = await res.json();

200 OKapplication/json

{ "wp_url": "https://acme.instawp.xyz", "wp_username": "admin", "s_hash": "a1c97f2e" // autologin }

Native fetch, async/await. Drop into Node, Next, or an agent.

POST/api/v2/sites/template

$res = $client->post("$api/sites/template", [ 'headers' => [ 'Authorization' => "Bearer {$token}" ], 'json' => [ 'template_slug' => 'woo-starter' ], ]); $site = json_decode($res->getBody(), true);

200 OKarray

[ 'wp_url' => 'https://acme.instawp.xyz', 'wp_username' => 'admin', 's_hash' => 'a1c97f2e' // autologin ]

Guzzle, array response. Laravel, WordPress, or standalone.

Everything the instawp CLI does, the API does. The CLI is this API with a terminal on top.

Base URL https://app.instawp.io/api/v2 · Header Authorization: Bearer <token>
Full endpoint and param list lives in the API reference.

The whole site lifecycle, over HTTP.

Token auth and scopes, full create, configure and delete, lifecycle webhooks, branded client dashboards you build on the API, and throwaway sites in CI. The same surface the CLI drives.

01 · Auth · Tokens with scopes

A token, not a password.

Create named tokens in My Account → API Token, and pick a scope for each: read-only, read-write, or a single-purpose one for Connect or a migration. Drop a token into GitHub Actions, a CI runner or a service, and every request carries a Bearer header. Revoke one without touching the rest.

Bearer authread-onlyread-writenamed tokens

02 · Lifecycle · Create, configure, delete

Full CRUD over your sites.

Create from a template or from scratch, list with filters like ?type=reserved, retrieve a site's details, and delete when you're done. Mark a site reserved to keep it, and filter the list by ?type=active, expired or reserved. One JSON shape in, one out.

createlist + filterretrievedelete?type=active / expired / reserved

03 · Webhooks · Lifecycle events Live

Your system finds out the moment a site does.

Register a destination URL and pick an event, site.create or site.delete. InstaWP POSTs JSON to you, with an optional secret so you can verify it's really us. Every attempt shows up in Event Deliveries with the HTTP code, response time and timestamp.

site.createsite.deletesecretdelivery log

04 · White-label · Branded client dashboards

A client dashboard with your name on it, not ours.

Call the same REST API from your own app to list, spin up, and manage every client's WordPress, all under your domain and your brand. InstaWP never appears. You own the UI and the login; the API just provisions and operates the sites.

GET /api/v2/sitesPOST /api/v2/sitesDELETE /api/v2/sites/{id}your brand · your domain

05 · CI & QA · Real sites over HTTP

Throwaway WordPress, one per pull request.

Spin up a real WordPress in CI with one authenticated POST, run your suite against the returned wp_url, then tear it down on merge. It's plain HTTP, no SDK and no CLI required, so the same call works from a GitHub Action, a bash script, or an AI agent that needs a real site to build on, not a mock. The instawp CLI runs on this exact API.

POST /api/v2/sites/snapshottest the wp_urlPOST /sites/delete/multipleper-PR sitesagent-callable

Also in the API

List & filter sites

Query your sites with filters like ?type=reserved and page through the results.

PHP & WP on create

Set php_version and wp_version per site at creation.

Configuration presets

Pass a configuration_id to apply a saved preset.

CLI parity

instawp login --token and every command runs on this same API.

Teams & account scoping

Tokens scoped to your team and account.

Status polling

Poll a provisioning site by its cloud_task_id until it's ready.

The same API on every single site.

The API isn't an enterprise upsell. The cheapest sandbox and production speak the same endpoints, the same JSON and the same webhooks, so you build your integration against a $2 box and promote it with a plan change. Your cost scales with sites, not seats or an API add-on.

Sandbox

$2/mo · per site

≈ $0.07/day · billed daily

A fully real WordPress box with the complete API surface: token auth, create / configure / delete, and site.create / site.delete webhooks. Promote it to a live tier with one plan change, same URL, same data, no re-pointing your integration.

REST API on every tierToken-auth create, configure and delete, from any plan.
Build against a $2 sandboxSame endpoints, same JSON, same webhooks as production.
Promote with a plan changeNo re-pointing your integration, same site, same URL, same data.

Scripting installs yourself, or a gated host API, vs one POST.

The two real alternatives a builder weighs: roll your own with WP-CLI on servers you manage, or a managed host's API that's usually locked to a top plan and hands back a queue, not a URL.

What you actually needTypical managed hostInstaWP

Create a real site from codeTop plan, or not at allOne POST, any plan

Live URL backQueue / manual stepwp_url + autologin in the response

Lifecycle webhooksNone / limitedsite.create / site.delete + delivery logs

Token scopesSingle account keyFour scopes, set per token

Test automation cheaplyFull-price site$2 sandbox, same API

One tool from the terminalBespoke scriptsThe instawp CLI is the same API

More than an endpoint.

The API provisions the site. The rest of the platform is what you do with it next. Keep exploring:

Staging →

Clone, test, push live

Dev Tools →

SSH, CLI, Git deploy, MCP

Snapshots →

Save sites & reusable presets

Hosting →

Managed WordPress, per site

Domains →

Buy, connect, or resell

Migrations →

Bring sites in, free

Integrations →

Connect your stack

Manage →

Every site, one dashboard

WaaS →

Resell hosting, your brand

Portal →

Panel for your clients

Templates →

Sell ready-made sites

AI & MCP

An in-site WordPress MCP your AI agent can drive, across every feature.

Explore AI →

The whole platform

See how every piece of InstaWP fits together, from sandbox to production.

Explore the platform →

Create a token. Ship your first site from code.

One authenticated POST and a real, logged-in WordPress comes back. The API is the on-ramp; reselling and Portal are where it scales.

Create a token → View the API reference

✓ REST API on every plan · ✓ Webhooks live · ✓ Four token scopes · ✓ No API add-on, no annual lock-in