Build your own hosting brand on AtoZNode

How it works

Reseller access is self-service and instant — no waiting for approval. Sign in to your client area, open Account → Reseller API and press "Activate API access". Every order you place through the API is paid at once from your own wallet, at the same prices shown in the panel, and you resell them under your own brand. What you charge your own customers, and how you bill them, is entirely up to you — AtoZNode never sees or contacts them. A wholesale discount off the list price is a separate, manual step: once you are up and running, contact us and we can apply one to your account.

1. Register an AtoZNode account, then open Account → Reseller API and press "Activate API access". This takes effect immediately.
2. Top up your AtoZNode wallet with Razorpay, the same as any customer.
3. Make an API key in Account → Reseller API. It is shown once — store it safely.
4. Call the API from your own server or app to order and manage servers.

Authentication

Send your key as a bearer token on every request. Keys start with az_live_. Treat a key like a password: anyone who has it can spend your wallet balance. Keep it on your own server, never in a browser or a mobile app.

curl https://atoznode.com/api/v1/me \
  -H "Authorization: Bearer az_live_xxxxxxxxxxxxxxxxxxxxxxxx"

A revoked or wrong key gets 401. An account without reseller access gets 403. Too many requests gets 429 (300 requests / 5 minutes per key; a few endpoints, such as ordering, are limited further — the error message says the limit).

Locking a key down

When you make a key you choose two things, and both are enforced on every request, not just suggested:

• Scope — which groups of endpoints the key may call: Read, Read root logins, Place orders, Manage servers, Terminate servers. Give a key only what it needs. A key without the "terminate" scope gets 403 on that endpoint even with a perfectly valid key.
• IP address allowlist — restrict a key to one or more addresses or CIDR ranges (for example 203.0.113.10 or 203.0.113.0/24). A call from anywhere else gets 403, before your key or wallet are even looked at. Leave it empty to allow any address.

We’d suggest one key per app or server, each scoped to only what that app does and, where the calling address is fixed, locked to that address. That way a leaked key only ever costs you as much as its own scope allows, and revoking it never affects anything else.

Order a server

The order is paid at once from your wallet. If your balance is too low you get 402 back and nothing is created — top up and try again.

curl -X POST https://atoznode.com/api/v1/servers \
  -H "Authorization: Bearer az_live_xxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "plan": "AE02",
    "cycle": "monthly",
    "hostname": "customer1-web",
    "os": "ubuntu-24.04",
    "client_ref": "your-customer-id-123"
  }'

client_ref is optional free text — use it to attach your own customer’s name, email or ID to the server, so you can tell your servers apart. It is never shown to anyone but you.

Endpoints

Errors

Every response is JSON. A successful call has "ok": true. A failed call has "ok": false and an "error" message, with one of these HTTP status codes:

• 400 – something in your request was invalid (see the error message).
• 401 – missing, wrong or revoked API key.
• 402 – your wallet balance is too low for this order.
• 403 – this account does not have reseller access.
• 404 – that server, or that endpoint, does not exist.
• 409 – the server is not in the right state for that action (for example, not active yet).
• 429 – you are calling too fast; slow down and retry after a pause.
• 502 – the action failed at the server level; safe to retry.

Safety and limits

• Terminating a server is permanent. You must send confirm set to the server’s exact hostname, the same safety check the client panel uses for a rebuild.
• Rebuilding a server erases everything on it.
• The API only ever affects servers that belong to your own account — checked on every single request, not just at login.
• Scope and the IP allowlist are checked on every request too, by the server, for every endpoint. There is no endpoint that skips this check.
• Nothing here bypasses billing, GST or the same provisioning checks the client panel itself uses — it is the same code underneath.

Getting access

Register an account, sign in, and turn it on yourself in Account → Reseller API — there is no approval to wait for. If you want a wholesale discount off the list price, contact us once you are set up and we’ll apply one to your account.