Your control panel has a REST API. Use it when you want a script or a scheduled job to do what you would otherwise click through in the panel, such as checking your domains, databases or FTP accounts.
To connect an AI assistant such as Claude, see Connect an AI assistant. It uses the same tokens.
Get a token
phas signs you in to the control panel with one click (see Open your control panel), so you have no panel password. The API uses an access token instead. Tokens are made on the control panel's AI Assistant (MCP) page, and a token from there works for the API too.
- Go to Hosting, open the plan, and click Open control panel.
- Go to Account → AI Assistant (MCP).
- Enter a Name that says where the token will be used, for example
Deploy script - office PC. - Choose when it expires: Never expires, Expires in 30 days, Expires in 90 days or Expires in 1 year.
- Tick Read-only if the job only needs to look things up.
- Click Generate new token.
- Copy the token straight away. It starts with
op_mcp_and is shown only once.
If you lose a token, you can't view it again. Revoke it and generate a new one.
Read-only or full access
| Token | What it can do |
|---|---|
| Read-only ticked | GET requests only: list and look things up. Anything else is refused. |
| Read-only not ticked | Everything the API offers on your plan, including changes and deletions |
Start with read-only. Make a full-access token only for a job that has to change something.
For expiry, pick the shortest that suits the job: 30 days for a one-off task, 90 days or a year for something that runs on a schedule. The token list shows each expiry date, so you can swap in a new token before the old one runs out.
Base URL
Every request goes to your server on port 2083, under /api/:
https://<server>:2083/api/...
Your server's name is shown under Server on the plan's page in phas, for
example mel02.phas.au.
Make a request
Send the token in an Authorization header with every request. In a terminal
on macOS or Linux, put the token in a variable first, so it isn't saved in
your shell history:
read -rs PANEL_TOKEN
Paste the token and press Enter. Nothing shows as you paste.
List your domains:
curl -s https://mel02.phas.au:2083/api/domains \
-H "Authorization: Bearer $PANEL_TOKEN"
See your databases:
curl -s https://mel02.phas.au:2083/api/mysql/info \
-H "Authorization: Bearer $PANEL_TOKEN"
Replace mel02.phas.au with your own server.
Responses are JSON. Errors are JSON too, with an error field and a standard
HTTP status code:
| Status | Usually means |
|---|---|
| 401 | The token wasn't accepted, for example because it has been revoked |
| 403 | A read-only token tried to change something |
| 403 or 404 | The feature isn't on your plan |
A read-only token that tries anything other than GET gets:
{"error":"This token is read-only","hint":"Generate a token without the read-only option to make changes"}
In scripts, add --fail-with-body to curl (version 7.76 or later). It then
exits with an error on any 4xx or 5xx response, and still prints the JSON
message.
API reference and OpenAPI spec
In the control panel, go to Account → API for an interactive reference.
Try it out runs the request live against your account, already signed in as you. A delete there is a real delete.
Download spec saves the OpenAPI file. It is also at
https://<server>:2083/static/openapi.yaml, to import into tools that read
OpenAPI.
Two things to know about the spec:
- It lists about 370 endpoints. Each only works if its feature is on your plan. The rest return 403 or 404.
- Ignore
POST /api/login. It swaps a panel username and password for a token, and phas accounts have no panel password. Use a token from AI Assistant (MCP) instead.
Changes are permanent
A token acts on your live hosting account. Delete a database, file or domain through the API and it is gone, unless you have a backup.
Take a copy before running anything that changes or deletes. With the Premium Backups add-on on the plan, take a backup first. Plans don't include backups, so without the add-on you're relying on copies you take yourself.
Keep tokens safe
Treat a token like a password. Anyone who has it can use your account, up to what the token allows.
- Never commit a token to Git, put it in a shared file, or send it by email or chat. Keep it in an environment variable or a secrets manager.
- Make a separate token for each script or tool, named for where it's used. Then you can revoke one without breaking the others.
- Give each token only what it needs: Read-only if the job only reads, and an expiry rather than Never expires.
- Revoke tokens you no longer need: Account → AI Assistant (MCP), then Revoke next to the token. It stops working immediately. The list shows when each token was last used, which helps you find the stale ones.
If a token leaks, revoke it straight away. Then look for changes you didn't make: check your sites, files and databases, and Account → Activity Log in the control panel, which records actions on the account.
What the API doesn't cover
The API manages your hosting account on the server. These are only in your phas account:
- billing, invoices and payment methods
- domain registration and renewals
- DNS records for domains on phas DNS
- add-ons
- support tickets
Still stuck? Contact support.