The Hostinger API is a mostly RESTful API over HTTPS. Every endpoint is documented under Endpoints, grouped by product — hosting, domains, DNS, email, VPS, WordPress, ecommerce, and billing.

Those pages are rendered from the same OpenAPI specification that produces the CLI, the SDKs, and the MCP server, so the reference cannot drift from the API itself.

Authentication

1. Generate an API token in hPanel → API. Tokens inherit the permissions of the user who created them and can be set to expire. See Security & Access for how they're managed.

2. Send the token as a bearer header on every request:

curl https://developers.hostinger.com/api/hosting/v1/websites \
  -H "Authorization: Bearer YOUR_API_TOKEN"

Making requests

The base URL is https://developers.hostinger.com, and every path is prefixed with /api/, the product, and a version — for example /api/hosting/v1/websites. Versions are per endpoint, so v1 paths keep working as new ones are added.

Requests must use Content-Type: application/json, and responses are always JSON.

Parameters arrive in three places:

• Path parameters identify a resource and are written in curly braces in the reference — /api/vps/v1/virtual-machines/{virtualMachineId}. Substitute the value; every path parameter is required.

• Query parameters filter, search, and paginate — ?page=2. All of them are optional. See Pagination for page and per_page.

• Request bodies carry the data for POST, PUT, and PATCH as a single JSON object. Each endpoint page documents the required structure and shows an example.

A 202 Accepted means the request was taken but completes asynchronously — the purchase endpoints return it while payment is processing. Poll the resource rather than resending. Errors covers the rest of the status codes and what a failed response looks like.

Rate limits

The API allows 90 requests per minute. Authenticated requests are counted per user — so the same token used from several machines shares one budget — and unauthenticated requests are counted per IP address. Some accounts have a custom limit; a few endpoints, such as domain availability checks, are metered separately.

Exceeding the limit returns 429 Too Many Requests. Authenticated responses carry X-RateLimit-Limit and X-RateLimit-Remaining so you can pace your calls, and a 429 adds Retry-After. Repeatedly hitting the limit can get your IP temporarily blocked.

Trying endpoints from the browser

Each endpoint page has a Test it panel. Paste an API token into it and the request runs against the live API from your browser — the same call the code samples show.

Test requests count against your rate limit and act on your real account. Prefer read-only endpoints while exploring.

Reference pages

• Endpoints — every endpoint, grouped by product

• Pagination — page, per_page, and the meta object on list endpoints

• Errors — status codes, the error response shape, and correlation IDs

• Support & feedback — where to report a bug or request an endpoint

Other ways to automate Hostinger

Besides calling the API directly, you can use these official tools. Tools & integrations describes each one and how to install it.

• Command line and code — the Hostinger CLI and the SDKs for PHP, Python, and TypeScript, plus the Email SDKs for the separate Mail API. See Generated from the specification.

• AI assistants — Hostinger Connector and Hostinger's MCP servers. See AI assistants and MCP.

• Infrastructure and workflows — Terraform, Ansible, n8n, and WHMCS. See Infrastructure as code and Workflow automation.

• Exploring the API — the Postman collection and the OpenAPI specification. See Postman.

Last updated: October 9, 2026