Authentication
View as MarkdownThe Node.js Hosting API uses a Personal Access Token (PAT). Create one in the developer portal, send it as Authorization: Bearer <TOKEN>, and select only the scopes each operation requires.
The Node.js Hosting API uses a Personal Access Token (PAT) for authentication. Every operation expects an Authorization: Bearer <token> header, and every operation requires a specific scope that you select when creating the token.
Create a token
The following procedure creates a PAT for the Node.js Hosting API.
- Go to Personal Access Tokens.
- Click Generate Token.
- Give the token a name, set an expiration, and select the scopes your integration needs. See Scopes reference for the full list.
- Click Generate token and copy the value immediately — it is shown only once.
Use the token
Send the token as a bearer header on every request:
curl "$BASE_URL/v1/hosting/nodejs/apps" \
-H "Authorization: Bearer $GODADDY_PAT"Set BASE_URL to the API gateway host provided when you request access.
Scopes reference
Each operation requires a specific scope. Select only the scopes your integration needs — narrower tokens are easier to reason about when something goes wrong.
| Scope | What it unlocks |
|---|---|
hosting.paas.apps:read | List apps, read app detail, read deployments, read runtime status |
hosting.paas.apps:create | Create apps and poll creation job status |
hosting.paas.apps:update | Update app metadata (name, root path) |
hosting.paas.apps:delete | Delete apps |
hosting.paas.code:write | Upload zip source and poll upload jobs |
hosting.paas.deploy:execute | Publish and roll back deployments |
hosting.paas.secrets:write | List and manage per-variant secrets |
hosting.paas.logs:read | Read application and build logs |
hosting.paas.analytics:read, hosting.paas.code:read, hosting.paas.github:execute, and hosting.paas.health:read appear in the scope selector but do not currently gate any endpoint in this API. Do not select them unless a future release documents corresponding operations.
Best practices
- Never commit your token to version control. Store it in a secrets manager or your platform's secret store (CI environment variable, Kubernetes secret, and so on).
- Revoke a token immediately if it is exposed. Create a replacement with the same scopes.
- PATs expire. Create a new one before the old one lapses — check the expiry date in the Personal Access Tokens portal.
- Treat
401as an expired or revoked token, or a missing scope. Check the token expiry first, then verify the required scope is included. - Log the scope required by a failed operation so you know exactly which scope to add to the next token.
Agent & Automation Notes
hosting.paas.apps:read, hosting.paas.apps:create, hosting.paas.apps:update, hosting.paas.apps:delete, hosting.paas.code:write, hosting.paas.deploy:execute, hosting.paas.secrets:write, hosting.paas.logs:readRelated
Last updated on
How is this guide?