API 101: General API, Hostinger API & Hostinger MCP

🤔 General API Fundamentals

What is an API?

API stands for Application Programming Interface. It is a defined way for one software application to request data or actions from another application.

🍽️ Real-world analogy: a restaurant

Imagine a restaurant. You do not enter the kitchen and prepare the food yourself. You tell the waiter what you want, the waiter communicates with the kitchen, and the result comes back to you.

You / your app = the client
The waiter = the API
The kitchen = the server or service

Why do APIs exist?

🔒

Controlled Access

Expose approved data and actions without giving direct access to internal systems.

⚡

Efficiency

Reuse existing services instead of rebuilding the same functionality in every application.

🔗

Integration

Connect different products, websites, services, and platforms together.

🤖

Automation

Perform repeatable actions programmatically instead of clicking through a user interface.

How does an API request work?

Most API interactions follow a simple request-and-response pattern.

Your App
Client

→

API Request
Method + URL + data

→

Server
Processes request

→

API Response
Status + data

Common parts of an API request

Part	Purpose	Example
Method	Tells the server what action you want to perform.	`GET`, `POST`, `PATCH`
Endpoint	The URL of the resource or action.	`/api/vps/v1/virtual-machines`
Headers	Carry metadata such as authentication and content type.	`Authorization: Bearer ...`
Path parameters	Identify a specific resource inside the URL.	`/websites/{domain}`
Query parameters	Filter, paginate, or modify a request.	`?page=2&per_page=25`
Request body	Sends structured data, commonly as JSON.	`{ "domain": "example.com" }`

HTTP request methods

HTTP methods work like verbs: they describe the intended action. Not every API supports every method.

Method	What It Does	Simple Example
`GET`	Retrieve or read data.	Look up a contact.
`POST`	Create data or trigger an action.	Create a new contact.
`PUT`	Replace or fully update a resource.	Replace all saved details for a contact.
`PATCH`	Partially update a resource.	Change only a contact's phone number.
`DELETE`	Remove a resource.	Delete a contact.
`HEAD`	Return response headers without the response body.	Check metadata without downloading the full content.
`OPTIONS`	Describe supported communication options for a resource.	Ask which methods may be allowed.
`CONNECT`	Create a tunnel, usually through an HTTP proxy.	Establish a proxy tunnel for HTTPS traffic.
`TRACE`	Diagnostic method that asks for the received request to be reflected back.	Inspect how a request reaches an HTTP server.

For most REST APIs, you will mainly work with GET, POST, PUT, PATCH, and DELETE.

Endpoint

An endpoint is the URL for a particular resource or operation. Think of it as a specific door into the API.

Different endpoints and methods = different operations

GET     /api/websites
POST    /api/websites
DELETE  /api/websites/{domain}

Authentication

Many APIs require credentials so the service can identify the caller and determine what they are allowed to access. Common approaches include API keys, bearer tokens, and OAuth.

⚠️ Keep credentials secret

Do not publish API tokens in source code, screenshots, tickets, or public repositories. Store secrets in environment variables or a secrets manager whenever possible.

JSON request and response data

Many web APIs exchange structured data using JSON (JavaScript Object Notation).

{
  "id": "server-001",
  "status": "running",
  "location": "Singapore"
}

HTTP status codes

The response status code quickly tells you what happened. Always read the response body too, because APIs often include a more specific error message.

Range	Meaning	Examples
2xx	Successful request.	200 OK, 201 Created, 204 No Content
3xx	Redirection or another location/action is involved.	301 Moved Permanently, 302 Found
4xx	The request could not be fulfilled as sent.	400 Bad Request, 401 Unauthorized, 404 Not Found, 429 Too Many Requests
5xx	The server or an upstream service failed while processing the request.	500 Internal Server Error, 502 Bad Gateway, 503 Service Unavailable

Rate limiting

APIs may limit how many requests can be made within a time window. When that limit is exceeded, a common response is 429 Too Many Requests. Good clients slow down, respect rate-limit headers, cache reusable results, and retry carefully.

🏠 The Hostinger API

The Hostinger API lets developers interact with supported Hostinger services programmatically. Instead of performing every task manually in hPanel, an application, script, integration, or automation can call an API endpoint.

💡 Important

The Hostinger API is not VPS-only. The operations available to you depend on the Hostinger products, resources, and permissions associated with your account.

What can you do with it?

🚀

Hosting & Websites

List and manage websites, deployments, hosting configuration, databases, Node.js apps, redirects, cron jobs, and other supported hosting resources.

🖥️

VPS Management

Work with VPS instances and supported VPS resources such as firewalls, backups, snapshots, public keys, and related configuration.

🌐

Domains & DNS

Manage supported domain operations, nameservers, DNS zones, DNS records, portfolio data, and related resources.

💳

Billing, Catalog & Orders

Read supported catalog and pricing information and use available ordering or subscription-related operations.

📧

Mail API

Manage supported mail resources such as mailboxes, aliases, forwarders, catch-alls, autoreplies, webhooks, passwords, and API tokens.

📢

Email Marketing

Work with supported Email Marketing resources, including operations around contacts and related marketing data.

🛒

Ecommerce

Access supported ecommerce resources and operations exposed by the Hostinger API.

✨

Hostinger Horizons

Create a Horizons website from a prompt and retrieve a link to an existing Horizons website through supported endpoints.

How Hostinger API authentication works

Hostinger API requests use a bearer token. The token is included in the HTTP Authorization header.

Authorization: Bearer YOUR_API_TOKEN

User API tokens can be created from hPanel. They inherit the permissions of the user who owns the token, so they should be protected like account credentials.

A simple Hostinger API request

For example, this request asks the Hostinger API for the websites available to the authenticated user:

curl "https://developers.hostinger.com/api/hosting/v1/websites" \
  --header "Authorization: Bearer YOUR_API_TOKEN"

Different Hostinger endpoints = different actions

        
            GET
            https://developers.hostinger.com/api/hosting/v1/websites ← List websites
          
            POST
            https://developers.hostinger.com/api/hosting/v1/websites ← Create a website
          
            DELETE
            https://developers.hostinger.com/api/hosting/v1/websites/{domain} ← Delete a website
          
            POST
            https://developers.hostinger.com/api/vps/v1/firewall/{firewallId}/activate/{virtualMachineId} ← Activate a VPS firewall

Hostinger API request rules worth remembering

Use Authorization: Bearer YOUR_API_TOKEN for authenticated requests.
Requests use application/json when a JSON content type is required.
POST, PUT, and PATCH requests may include JSON request bodies.
Some endpoints use path parameters inside {curly braces}.
List endpoints may use pagination such as ?page=2.
Errors may include a correlation_id, which is useful when investigating a specific failed request.

How to get started

Generate an API token
Open hPanel → Account → API, create a token, and choose an appropriate expiration date.
Store the token safely
Save it in a secure location and do not place it in public code, screenshots, or documentation.
Read the endpoint documentation
Use developers.hostinger.com to confirm the method, endpoint, parameters, body schema, and response codes.
Test with cURL or Postman
Start with a read-only GET request before testing actions that create, update, or delete resources.
Then automate
Once the request works manually, move it into your application, script, workflow, CLI, SDK, or MCP integration.

🧰 SDKs & tools

Hostinger's API documentation links to tools and integrations including PHP, Python, Node/TypeScript, CLI, Ansible, Terraform, n8n, MCP, Postman, and WHMCS resources.

🤖 Hostinger MCP

Once you understand the Hostinger API, Hostinger MCP is much easier to understand. The API provides the actual Hostinger operations, while the Hostinger MCP server exposes supported API capabilities as tools that an MCP-compatible AI assistant can use.

💡 A simple mental model

Hostinger API = the engine
Hostinger MCP Server = the bridge
AI assistant = the driver

What is MCP?

MCP stands for Model Context Protocol. It is a standard that allows compatible AI applications to discover and call external tools in a structured way.

Without MCP vs with MCP

Without MCP	With Hostinger MCP
You select an API endpoint and HTTP method.	The AI can select an available Hostinger MCP tool based on your instruction.
You construct headers, parameters, and request bodies.	The AI can map your request into the tool's required parameters.
You read and interpret the raw API response.	The AI can use the tool result and explain it in natural language.
Your script or application drives the workflow.	An MCP-compatible AI client drives the workflow using exposed tools.

How the pieces connect

You
  ↓ natural-language instruction
AI Assistant / MCP Client
  ↓ MCP tool call
Hostinger MCP Server
  ↓ Hostinger API
Hostinger Services

MCP does not replace the Hostinger API. The MCP server connects AI clients to supported Hostinger API actions.

What does the Hostinger API MCP server expose?

Hostinger's current MCP documentation lists the following product areas for the account-level MCP server:

🚀

Websites

Supported website and hosting-related tools.

🖥️

VPS

Supported VPS information and management tools.

🌐

Domains & DNS

Domain tools, with DNS tools grouped under the Domains product area.

📢

Email Marketing

Supported Email Marketing tools, including capabilities around contacts and related resources.

💳

Subscriptions & Payments

Supported account billing, subscription, payment, and related tools.

🛒

Ecommerce

Supported ecommerce tools exposed through the MCP server.

📌 API coverage and MCP coverage are not identical

The Hostinger Developer API contains additional API families. The MCP support article specifically lists Websites, VPS, Domains (including DNS), Email Marketing, Subscriptions & Payments, and Ecommerce for the account-level MCP configuration. WordPress sites can also appear as individual MCPs.

Per-product MCP configuration

Hostinger allows product MCPs to be enabled or disabled individually. For example, you might enable only VPS and Domains instead of exposing every available product tool to the AI client.

This also helps keep the number of available tools manageable in AI development environments.

Per-site WordPress MCPs

WordPress sites can appear as individual MCPs rather than being represented only by one global Websites toggle. This allows access to be controlled on a per-site basis.

Hostinger MCP
├── Websites
├── VPS
├── Domains
├── Email Marketing
├── Subscriptions & Payments
├── Ecommerce
├── WordPress: example.com
└── WordPress: shop.example.com

Two ways to connect

Connection	How It Works	Good Choice When...
Remote MCP	Connect your MCP-compatible client to Hostinger's hosted MCP endpoint and authorize through OAuth.	You want the fastest setup without maintaining a local MCP process.
Local MCP Server	Install the Hostinger API MCP CLI locally and connect it to your AI client.	You want a locally managed MCP setup or API-token-based configuration.

Option 1: Remote MCP server

Hostinger provides a hosted remote MCP endpoint:

https://mcp.hostinger.com

With the remote option, there is no local MCP server process to install or keep running. Authentication is handled through an OAuth authorization flow in the browser.

Example for Claude Code:

claude mcp add --transport http hostinger https://mcp.hostinger.com

Option 2: Local Hostinger API MCP server

The current Hostinger MCP installation guide requires Node.js 24+ for the local setup.

npm install -g hostinger-api-mcp

The installed command is hostinger-api-mcp. It can then be referenced in the MCP configuration of a compatible client.

MCP authentication

Method	How It Works	Typical Use
OAuth	Authorize the MCP connection in the browser without manually pasting an API token into the remote connection.	Recommended for AI agents, external tools, and multi-user or production-style integrations.
API Token	Pass a Hostinger API token to the local MCP server through the `API_TOKEN` environment variable.	Personal use and simpler single-user configurations.

🔐 Token security

Treat an API token like a password. Do not publish it in GitHub, screenshots, documentation, or chat messages. Use environment variables or another secure secrets mechanism.

Example instructions you could give an MCP-connected AI

"Show me my websites."
"Check my VPS information."
"Add this DNS record to my domain."
"Show my Email Marketing contacts."
"Check my supported subscription information."

🎯 The key concept

General API concepts explain how software communicates.
The Hostinger API applies those concepts to Hostinger services.
Hostinger MCP lets compatible AI tools use supported Hostinger API capabilities as tools.

🛠️ API Troubleshooting

When an API call fails, avoid guessing from the status code alone. Check the HTTP method, endpoint, authentication, parameters, request body, response body, and any request or correlation ID returned by the API.

Common errors and what to check

Error	Usually Means	What to Check
400 Bad Request	The request syntax, fields, or values are not accepted.	Check JSON syntax, data types, required fields, headers, and parameters.
401 Unauthorized	Authentication is missing or invalid.	Check the bearer token, expiration, and Authorization header.
403 Forbidden	The request is understood but access is not allowed.	Check account access, resource ownership, permissions, policy restrictions, and the response message.
404 Not Found	The endpoint or requested resource could not be found.	Verify the path, resource identifier, domain, API version, and whether the resource still exists.
409 Conflict	The requested operation conflicts with the current resource state.	Read the response body and check whether the resource already exists or is in an incompatible state.
422 Unprocessable Content	The request format may be valid, but one or more supplied values fail validation.	Compare the submitted fields against the endpoint schema and validation rules.
429 Too Many Requests	The client has exceeded a rate limit.	Inspect rate-limit headers, reduce request frequency, add backoff, and avoid unnecessary repeated calls.
500 Internal Server Error	The service failed while handling the request.	Capture the response, correlation/request ID, endpoint, method, and timestamp; retry only when appropriate.
502 Bad Gateway	A gateway or proxy received an invalid response from an upstream service.	Retry carefully and check whether the failure is temporary or consistently reproducible.
503 Service Unavailable	The service is temporarily unavailable or cannot currently handle the request.	Retry later and check service status if the problem persists.
504 Gateway Timeout	A gateway did not receive an upstream response in time.	Retry carefully and capture timing details if the problem is reproducible.

Debugging workflow

Read the response body
The status code gives the category; the response body often gives the real reason.
Confirm the method and endpoint
Make sure the exact method and URL match the latest API documentation.
Check authentication
Verify the token is valid and the Authorization header is formed correctly.
Validate parameters and JSON
Check path parameters, query parameters, required fields, JSON syntax, and data types.
Reproduce with cURL or Postman
A minimal reproducible request makes it easier to separate API behavior from application code.
Capture evidence before escalating
Record the UTC timestamp, endpoint, method, status code, response body, and correlation/request ID. Never include the secret token.

✅ Quick Checklist

Before escalating an API problem, confirm the following:

The API token is valid and has not expired.
The Authorization header uses the required format.
The correct HTTP method is being used.
The endpoint URL and API version match the documentation.
Path and query parameters are correct.
The JSON request body is valid and contains the required fields.
The response body has been reviewed for a specific error message.
Rate-limit information has been checked for 429 responses.
The request has been reproduced with a minimal cURL or Postman test where possible.
The UTC timestamp and correlation/request ID were captured for escalation.

📚 Useful resources

Hostinger API documentation: developers.hostinger.com
Hostinger API MCP guide: Hostinger API MCP Server
Hostinger API GitHub: github.com/hostinger