Every action the Boottify dashboard performs is also callable from your own code. Provision tenants, roll out deploys, rotate keys, and wire billing events into your product — all under your brand.
Session-cookie auth (Lucia v3). OAuth callbacks below. All API requests require a valid session unless marked public.
/api/auth/sign-inPublicEmail + password sign-in.
Request
{ "email": "you@acme.dev", "password": "••••" }Response
{ "user": { "id": "...", "email": "...", "role": "..." } }// noteSets a session cookie. Respects auth rate limits from auth_settings.
/api/auth/heartbeatSession cookieCheck the current session (null if signed out).
Response
{ "id": "...", "email": "...", "firstName": "...", "role": "CLIENT" }/api/auth/sign-outSession cookieInvalidate the current session.
Response
{ "ok": true }Manage deployed apps. App-scoped endpoints are enforced by owner/collaborator role.
/api/client/quick-deploySession cookieOne-click ForgeHub workspace (free tier).
Request
// no bodyResponse
{ "deploymentId": "...", "appId": "...", "subdomain": "you.boottify.com" }// noteRate limited 1 per 10 minutes per user. Requires a verified email. Returns 503 with Retry-After if the cluster is at the free-tier concurrency cap.
/api/deploySession cookieFull deploy via the wizard (marketplace template + paid plan).
Request
{
"appTemplateId": "...",
"appName": "my-shop",
"domainType": "subdomain" | "custom",
"subdomain": "my-shop",
"customDomain": "shop.example.com",
"planId": "...",
"paymentMethod": "stripe" | "paypal" | "wire" | "free"
}Response
{ "deploymentId": "...", "checkoutUrl"?: "..." }/api/client/appsSession cookieList apps owned by or shared with the authenticated user.
Response
{ "apps": [ { "id": "...", "name": "...", "status": "ACTIVE", "subdomain": "..." } ] }Invite collaborators to an app. Invitation tokens are signed and single-use — see `/docs/security` for the threat model.
/api/client/team/inviteSession + app ownerSend a signed invitation email.
Request
{ "email": "teammate@acme.dev", "appId": "...", "role": "viewer" | "editor" | "admin" }Response
{ "invitationId": "...", "expiresAt": "2026-05-04T00:00:00Z" }// noteUniform response — the endpoint does not leak whether the invitee already has an account.
/api/client/team/acceptSession cookieAccept an invitation after clicking the emailed link.
Request
{ "token": "..." }Response
{ "appId": "...", "role": "editor" }// noteSession email MUST match the email the invite was sent to. Single-use, expires in 14 days.
Stripe-backed. All subscription lifecycle events flow through our webhook.
/api/client/billing/subscriptionsSession cookieList active subscriptions for the current user.
Response
{ "subscriptions": [ { "id": "...", "plan": "professional", "status": "ACTIVE", "renewsAt": "..." } ] }/api/webhooks/stripeSigned tokenStripe webhook receiver.
Response
{ "received": true }// noteVerified via Stripe signature header. Do not call directly. Handles customer.subscription.created/updated/deleted and invoice lifecycle events.
Browse templates. Pass `curated=true` for the agency-focused shortlist; omit to see the full catalog.
/api/marketplace/appsPublicList marketplace templates.
Request
// query: ?search=ghost&category=cms&curated=true&page=1&limit=24Response
{ "templates": [ ... ], "categories": [ ... ], "pagination": { ... } }Unauthenticated endpoints used by the marketing surface.
/api/public/uptimePublicCluster uptime for the landing trust bar.
Response
{ "percent": 99.97, "status": "operational", "windowDays": 30, "updatedAt": "..." }/api/unsubscribe?t=<token>Signed tokenRFC 8058 one-click unsubscribe.
Request
// body: List-Unsubscribe=One-ClickResponse
{ "ok": true }// noteHonored by Gmail, Yahoo, Apple Mail. Required to stay out of the spam folder for bulk campaigns.
This is the shortlist. If you're integrating Boottify into your own product and need something that isn't here, ask — we'll expose it if it's a reasonable primitive.
Request an endpoint →