API reference

1. 1In your dashboard, open Settings and the API Keys tab.
2. 2Create a key and give it a name you will recognise, such as the tool that uses it.
3. 3Copy the key — it starts with dpk_live_ and is shown only once. Dplooy stores a hash of it, never the key itself.

An account can have up to 5 keys at a time, on any plan.

Send the key as a Bearer token with every request:

Authorization: Bearer dpk_live_your_key_here

Sites

Forms, data, bookings and media

Request fields, full responses and examples in Node.js and Python are in the developer reference. The MCP server uses these same endpoints, so anything an AI assistant does for you, your own code can do too.

html is required. css and js are optional — they are saved as style.css and script.js and linked into the page. Each one can be up to your plan's file size (5 MB on Free, 50 MB on Plus, 100 MB on Pro) in a request of up to 50 MB. name becomes the address, so my-site is my-site.dplooy.com; it is tidied the same way as in the dashboard (lower case, hyphens).

curl -X POST https://api.dplooy.com/api/v1/deploy \  -H "Authorization: Bearer dpk_live_your_key_here" \  -H "Content-Type: application/json" \  -d '{"html":"<h1>Hello</h1>","name":"my-site"}'

{  "success": true,  "url": "https://my-site.dplooy.com",  "projectId": "a1b2c3d4-e5f6-...",  "isRedeploy": false,  "plan": "pro",  "expiresAt": null}

Deploying again with the same name updates that site in place — isRedeploy is true, and the address and analytics carry on.

Send the archive as multipart/form-data in a field named file. It needs index.html at the top (or inside one folder at the top), and folders, styles, scripts, images and fonts keep their paths. projectName sets the address and name the display name. A ZIP can be up to 50 MB on Free and 500 MB on Plus and Pro, every file in it up to your plan's file size, and the unpacked site has to fit in your storage.

curl -X POST https://api.dplooy.com/api/v1/deploy/zip \  -H "Authorization: Bearer dpk_live_your_key_here" \  -F "file=@site.zip" \  -F "projectName=my-site"

The response adds fileCount and a list of warnings to the fields above.

• Requests are limited to 30 requests a minute per IP address, on every plan. Past it the API answers 429 RATE_LIMIT_EXCEEDED; wait a minute and retry.
• Deploys — from the API or anywhere else — are limited to 15 an hour and 40 a day on Free, and 40 an hour and 150 a day on Plus and Pro. Only deploys that succeed count. Past it: 429 DEPLOY_LIMIT_REACHED.
• Reading files returns up to 2 MB per call, and one PATCH can delete up to 200 files.

Check the HTTP status first. The body comes in one of two shapes:

{  "error": "<what went wrong, in words>",  "code": "NOT_FOUND"}

{  "message": "<what went wrong, in words>",  "error": "INVALID_API_KEY"}

• Settings → API Keys lists your keys by name and last four characters, with the last 50 requests each one made.
• Revoke a key there and it stops working at once; its request log is deleted with it.
• To rotate a key: create the new one, switch your tools and secrets over, then revoke the old one.
• Lost a key? It can't be shown again — revoke it and create a new one.