The Tanzahost API

Tanzahost has one API, and the dashboard uses it too. It lives at https://api.tanzahost.com, every address starts with /v1/, and you call it with an API token. A script can do what the dashboard does with projects, apps, databases, domains and variables, through the same permission checks. Money, people and tokens stay in the dashboard.

Make a token

Only an account's owners make tokens, so only they see the Developers tab.

1. Open your account, then Developers.

2. Under API tokens, choose New token.

3. Give it a Name, so you know where it's used, like GitHub Actions.

4. Choose What it may do: Read only, Deploy or Full.

5. Choose what it Reaches: The whole account, or one project.

6. Choose when it Ends after: 7, 30 or 90 days (the default), or 1 year.

7. Choose Make the token, copy it, then I've copied it.

A token starts with th_. It's shown once: Tanzahost keeps only its fingerprint, so nobody can show it to you again. Lost it? Revoke it and make a new one.

What each scope may do

No token manages people, tokens or webhooks, touches money, or closes the account.

A token also never does more than the person who made it. If an owner who made a token leaves the account, the token stops working.

A token limited to one project reaches only that project, its apps, databases, domains, variables and logs. Anything else answers 404, as if it didn't exist. For a deploy from CI, a Deploy token for one project is all you need.

Your first call

Asha made a Read only token for her account. She keeps it in a variable in her terminal, so it isn't typed into every command:

export TANZAHOST_TOKEN=th_paste_your_token_here
curl -s https://api.tanzahost.com/v1/token \
  -H "Authorization: Bearer $TANZAHOST_TOKEN"

The answer says which account the token acts in, its name, its scope and its end date:

{
  "id": "0199f6a2-5c1e-7b3a-9d40-2f6e8a1b7c55",
  "account_id": "0199f6a1-0b7d-7e21-8c3f-5a9d4e2b1f08",
  "name": "Asha's reports",
  "scope": "read",
  "expires_at": "2027-01-15T09:30:00Z"
}

A token for one project also has project_id. With the account's ID, she lists her projects:

curl -s https://api.tanzahost.com/v1/accounts/0199f6a1-0b7d-7e21-8c3f-5a9d4e2b1f08/projects \
  -H "Authorization: Bearer $TANZAHOST_TOKEN"

The answer has a projects list, with duka in it, each with its id and name. Every other route follows the same pattern, like /v1/accounts/{account}/apps/{app}/deploys for an app's deploys.

The rules of every call

• JSON in, JSON out: send Content-Type: application/json. Only an upload's pieces are sent as application/octet-stream.

• Errors come as application/problem+json, with the status, a code your script can check, a short title, and the fields that were wrong, like {"status": 422, "code": "invalid", "title": "…", "errors": [{"field": "name", "code": "required"}]}.

• Limits: each token may make 5 calls a second, and 30 at once. Above that the answer is 429, with Retry-After.

• Every call is kept 90 days. Open the token under Developers, then Calls, to see when, which route, the answer and the address. Every change it makes is in the account's Activity, like "Asha, with an API token".

• Last used: each token shows when and from where it was last used.

• Revoke a token under Developers at any time: programs using it stop at once.

• A person can have 25 tokens in an account.

Webhooks

A webhook tells an address of yours when something happens. Under Developers, then Webhooks, choose Add a webhook, give an https:// Address, and choose when to tell it:

Each one is a POST with a JSON body: id, type, created_at, account_id and data. An account can have 10 webhooks.

Check that it came from us. When you add the webhook, its signing secret (whsec_…) is shown once. Each request carries a Tanzahost-Signature header like t=1760692200,v1=5f2b…: v1 is the HMAC-SHA256, in hex, of the time, a dot, and the body, with that secret. Make the same HMAC and compare. Refuse a request whose time is more than 5 minutes off.

Answer with any 2xx within 10 seconds. If you don't, we try again after 1 minute, 5 minutes, 30 minutes, 2 hours and 6 hours. Open Deliveries to see each one and the answer it got.

Next

• Deploy from your terminal or from CI: the command-line tool.

• Let Cursor or Claude Code deploy for you: AI coding tools.