Platform/API & Webhooks

One API call. A live, logged-in WordPress.

Create a real WordPress site from your code and get back a URL that's already logged in. One token, one endpoint, every plan including the $2 sandbox.

Create a token → View the API reference

REST API on every plan Webhooks: site.create / site.delete The same API the CLI runs on

POST/api/v2/sites/template

# request Authorization: Bearer **** Content-Type: application/json { "template_slug": "woo-starter", "site_name": "acme" }

200 OKapplication/json

{ "id": 1333819, "wp_url": "https://acme.instawp.xyz", "wp_username": "admin", "s_hash": "a1c97f2e" // autologin }

One call. A real site, already logged in.

REST API

on every plan, incl. $2 sandbox

Scoped tokens

read-only or read-write

Webhooks

site.create · site.delete

Same API

the instawp CLI runs on

Call it from any stack.

Authenticate with a bearer token, POST to one endpoint, and get JSON back with a live URL and an autologin. Copy the call in curl, JavaScript, or PHP.

cURLJavaScriptPHP

POST/api/v2/sites/template

$ curl -X POST $API/sites/template \ -H "Authorization: Bearer $TOKEN" \ -d '{"template_slug":"woo-starter","site_name":"acme"}'

200 OKapplication/json

{ "wp_url": "https://acme.instawp.xyz", "wp_username": "admin", "s_hash": "a1c97f2e" // autologin }

Shell-native. Paste into CI, cron, or a script. One command.

POST/api/v2/sites/template

const res = await fetch(`${API}/sites/template`, { method: 'POST', headers: { 'Authorization': 'Bearer ' + token, 'Content-Type': 'application/json' }, body: JSON.stringify({ template_slug: 'woo-starter' }) }); const site = await res.json();

200 OKapplication/json

{ "wp_url": "https://acme.instawp.xyz", "wp_username": "admin", "s_hash": "a1c97f2e" // autologin }

Native fetch, async/await. Drop into Node, Next, or an agent.

POST/api/v2/sites/template

$res = $client->post("$api/sites/template", [ 'headers' => [ 'Authorization' => "Bearer {$token}" ], 'json' => [ 'template_slug' => 'woo-starter' ], ]); $site = json_decode($res->getBody(), true);

200 OKarray

[ 'wp_url' => 'https://acme.instawp.xyz', 'wp_username' => 'admin', 's_hash' => 'a1c97f2e' // autologin ]

Guzzle, array response. Laravel, WordPress, or standalone.

Everything the instawp CLI does, the API does. The CLI is this API with a terminal on top.

Base URL https://app.instawp.io/api/v2 · Header Authorization: Bearer <token>
Full endpoint and param list lives in the API reference.

The whole site lifecycle, over HTTP.

Token auth and scopes, full create, configure and delete, lifecycle webhooks, branded client dashboards you build on the API, and throwaway sites in CI. The same surface the CLI drives.

01 · Auth · Tokens with scopes

A token, not a password.

Create named tokens in My Account → API Token, and scope each one read-only or read-write. Drop a token into GitHub Actions, a CI runner or a service, and every request carries a Bearer header. Revoke one without touching the rest.

Bearer authread-onlyread-writenamed tokens

Create API token Account → API Token

Token name CI · deploy bot

Scope Read-onlyRead-write

Token iwp_••••••••••••••••••••3f9aCopy

Used by 2 services Create token

02 · Lifecycle · Create, configure, delete

Full CRUD over your sites.

Create from a template or from scratch, list with filters like ?type=reserved, retrieve a site's details, and delete when you're done. Mark a site reserved to keep it, or temporary to let it expire. One JSON shape in, one out.

createlist + filterretrievedeletereserved / temporary

~/ · api/v2/sitescurl

$ curl -X POST $API/sites/template -d '{…}' → 200 { "id": 1333819, "wp_url": "…", "status": 1 } $ curl $API/sites?type=reserved → 200 [ 12 sites ] $ curl -X POST $API/sites/delete -d '{ "ids": [1333819] }' → 200 { "message": "Site deletion work in progress." }

03 · Webhooks · Lifecycle events Live

Your system finds out the moment a site does.

Register a destination URL and pick an event, site.create or site.delete. InstaWP POSTs JSON to you, with an optional secret so you can verify it's really us. Every attempt shows up in Event Deliveries with the HTTP code, response time and timestamp.

site.createsite.deletesecretdelivery log

Webhooks Active

https://hooks.northlight.dev/instawpevent: site.create · secret set Edit

Event	Code	Response	Attempts	When
site.create	200	142ms	1	12:04:11
site.delete	200	118ms	1	11:58:02
site.create	200	96ms	1	11:51:47

04 · White-label · Branded client dashboards

A client dashboard with your name on it, not ours.

Call the same REST API from your own app to list, spin up, and manage every client's WordPress, all under your domain and your brand. InstaWP never appears. In WaaS Custom API mode you run your own checkout and keep 100% of the revenue. You own the UI and the login; the API just provisions and operates the sites.

GET /api/v2/sitesPOST /api/v2/sitesDELETE /api/v2/site/{id}your brand · your domainWaaS Custom API · 0% cut

AAcme Studio New client site

Client site	Plan	Status
Northwind Studionorthwind.studio	Growth	Live
Belle & Co.belleandco.com	Starter	Live
Harbor Yogaharboryoga.app	Growth	Provisioning

12 client sites · app.acmestudio.com Your brand

05 · CI & QA · Real sites over HTTP

Throwaway WordPress, one per pull request.

Spin up a real WordPress in CI with one authenticated POST, run your suite against the returned wp_url, then tear it down on merge. It's plain HTTP, no SDK and no CLI required, so the same call works from a GitHub Action, a bash script, or an AI agent that needs a real site to build on, not a mock. The instawp CLI runs on this exact API.

POST /api/v2/sites/snapshottest the wp_urlPOST /sites/deleteper-PR sitesagent-callable

ci · pull_requestcurl

$ curl -X POST $API/sites/snapshot \ -H "Authorization: Bearer $TOKEN" \ -d '{"snapshot_slug":"acme-app"}' → 200 { "id": 1333902, "wp_url": "https://pr-482.instawp.xyz" } $ npx playwright test --base-url $WP_URL ✓ 142 passing (28.4s) $ curl -X POST $API/sites/delete -d '{"ids":[1333902]}' → 200 { "message": "Site deletion work in progress." } # real WordPress, gone on merge

Also in the API

List & filter sites

Query your sites with filters like ?type=reserved and page through the results.

PHP & WP on create

Set php_version and wp_version per site at creation.

Configuration presets

Pass a configuration_id to apply a saved preset.

CLI parity

instawp login --token and every command runs on this same API.

Teams & account scoping

Tokens scoped to your team and account.

Status polling

Poll a provisioning site by its task_id until it's ready.

The same API on every single site.

The API isn't an enterprise upsell. The cheapest sandbox and production speak the same endpoints, the same JSON and the same webhooks, so you build your integration against a $2 box and promote it with a plan change. Your cost scales with sites, not seats or an API add-on.

Sandbox

$2/mo · per site

≈ $0.07/day · billed daily

A fully real WordPress box with the complete API surface: token auth, create / configure / delete, and site.create / site.delete webhooks. Promote it to a live tier with one plan change, same URL, same data, no re-pointing your integration.

REST API on every tierToken-auth create, configure and delete, from any plan.
Build against a $2 sandboxSame endpoints, same JSON, same webhooks as production.
Promote with a plan changeNo re-pointing your integration, same site, same URL, same data.

Scripting installs yourself, or a gated host API, vs one POST.

The two real alternatives a builder weighs: roll your own with WP-CLI on servers you manage, or a managed host's API that's usually locked to a top plan and hands back a queue, not a URL.

What you actually needTypical managed hostInstaWP

Create a real site from codeTop plan, or not at allOne POST, any plan

Live URL backQueue / manual stepwp_url + autologin in the response

Lifecycle webhooksNone / limitedsite.create / site.delete + delivery logs

Token scopesSingle account keyRead-only or read-write

Test automation cheaplyFull-price site$2 sandbox, same API

One tool from the terminalBespoke scriptsThe instawp CLI is the same API

More than an endpoint.

The API provisions the site. The rest of the platform is what you do with it next. Keep exploring:

Staging →

Clone, test, push live

Dev Tools →

SSH, CLI, Git deploy, MCP

API & Webhooks →

Provision sites by API

Snapshots →

Save sites & reusable presets

Hosting →

Managed WordPress, per site

Domains →

Buy, connect, or resell

Migrations →

Bring sites in, free

Integrations →

Connect your stack

Manage →

Every site, one dashboard

WaaS →

Resell hosting, your brand

Portal →

Panel for your clients

Templates →

Sell ready-made sites

AI & MCP

An in-site WordPress MCP your AI agent can drive, across every feature.

Explore AI →

The whole platform

See how every piece of InstaWP fits together, from sandbox to production.

Explore the platform →

Create a token. Ship your first site from code.

One authenticated POST and a real, logged-in WordPress comes back. The API is the on-ramp; reselling and Portal are where it scales.

Create a token → View the API reference

✓ REST API on every plan · ✓ Webhooks live · ✓ Read-only or read-write tokens · ✓ No API add-on, no annual lock-in