Key facts
- Small PHP and Node.js APIs run on the £1 a day + VAT plan
- Free SSL and HTTPS enforced for every endpoint
- Secrets stored in environment variables, outside the web root
- Cloudflare rate limiting and firewall rules available
- Webhook endpoints for Stripe, payment gateways and other services
- High-volume or worker-heavy APIs quoted on managed VPS
What fits on the £1 a day plan
dijitul Complete Hosting suits small APIs and backends such as:
- A PHP or Laravel endpoint your website or mobile app calls.
- A Node.js service run through Plesk's Node.js support.
- Webhook receivers for Stripe, PayPal, Shopify or your CRM.
- A backend that calls a hosted AI API, keeping the key secret. See AI chatbot hosting.
- Simple JSON feeds for partners or a product catalogue.
You get free SSL, Cloudflare DNS, daily backups and a Plesk login to view logs and manage cron jobs.
Getting the basics right
- HTTPS only. Every API should refuse plain HTTP. We enforce it.
- Secrets on the server. API keys and database passwords live in environment variables or config files outside the public folder, never in Git.
- Authentication. API keys, signed requests or tokens, checked on every call.
- Verify webhooks. Check the signature that services like Stripe send, so fake requests are rejected.
- Rate limits. In your app and at Cloudflare, to stop abuse.
- Logging. Enough to debug failures without logging passwords or card data.
When an API needs its own server
We'll recommend a quoted managed VPS when your API:
- Handles high request volumes or must respond consistently fast.
- Needs long-running workers or queues, for example AI processing jobs.
- Is written in Python (FastAPI, Django REST Framework) or Go and needs a custom stack.
- Runs in Docker containers. See Docker hosting.
- Needs Redis, PostgreSQL or a vector database.
Questions we'll ask
- What language and framework?
- Who calls the API, and how often?
- Does it call other APIs, such as AI or payment providers?
- Does it need background jobs or scheduled tasks?
- Is there any personal or payment data involved?
Order or ask
For a small API, order at clients.dijitul.uk/order. For anything bigger, or if you'd like dijitul's agency at dijitul.uk to build the API, call 01623 650333 or email info@dijitul.uk. Related: PHP hosting, Node.js hosting.
Frequently asked questions
Where can I host a small API in the UK?
dijitul hosts small PHP and Node.js APIs and webhook endpoints on its £1 a day + VAT plan, with free SSL, Cloudflare in front and secrets kept server-side. Larger or worker-heavy APIs are quoted on managed servers.
Can I host a Node.js API on shared hosting?
On some platforms, yes. Plesk supports Node.js applications, so small Node APIs can run on dijitul Complete Hosting. APIs with heavy traffic or long-running workers are better on a managed VPS.
How do I secure a webhook endpoint?
Use HTTPS, verify the signature the sending service includes with each request, reject old timestamps to stop replays, and respond quickly by queuing heavy work. Log failures without storing sensitive data.
Where should I store API keys on my server?
In environment variables or a configuration file outside the public web folder, with restricted permissions, and never committed to Git. dijitul sets hosting up this way for API and AI projects.
Do I need a VPS to host an API?
Not for small APIs. A VPS is worth it when you need high throughput, background workers, Docker, Python stacks or databases such as PostgreSQL or Redis. dijitul quotes managed VPS hosting for those.
Can I rate limit my API with Cloudflare?
Yes. Cloudflare can apply rate limiting and firewall rules to API paths, blocking abusive clients before they reach your server. Combine it with rate limiting in your application for best results.
Related
Set it up and forget about it
Managed hosting, Plesk, Cloudflare DNS, daily backups and your domain for £1 a day + VAT. We move your site for you.