Ops Brief
API backend hosting — When a client's API returns 500, the partner rings you
An API has an audience you have never met, and when it stops answering they will find your support address before they find your client's.
Straight answer first
Put a modest REST backend on Business hosting and move to a VPS the moment latency guarantees, custom middleware or websockets appear, because an API repays owning the stack it runs on. The Entry VPS is where we would start anyone whose API has an external consumer.
The rest of this page is about the commercial consequences: who ends up taking the call, which controls you have to own in order to answer it, what limits to set before the first partner integrates, and what you can honestly promise in writing.
Written by the Hosting Seller staff · Checked 24 August 2026
99.9%
Uptime target we hold
24/7
People on the counter, for you and them
Free
SSL on every site you host
NVMe
Disks under every client account
A latency budget gets spent in layers: TLS, queueing, compute, database. The hosting decision sets the floor under every one of them before a single line of your client's code executes.
The difference from an ordinary website is who notices. A slow brochure site annoys the owner. A slow API annoys somebody else's engineering team, who will escalate to whoever appears to be responsible, and that is often you.
Who takes the call, and what you can answer
Decide this before the API has consumers. If a partner's integration breaks at two in the morning, does it reach your client, your out-of-hours address, or nobody at all until the morning?
Then decide what you would actually be able to do about it. Restart a service, read a log, roll back a deployment, or nothing except escalate. Whichever it is, price accordingly and say so.
The worst arrangement is the accidental one, where you are the visible address for a system you have no ability to diagnose. That is unpaid work with reputational risk attached.
The controls you have to own
Headers, CORS and TLS configuration, because an integration failure is usually a header away from being explicable. Timeouts, because a partner's client library will give up at a moment you did not choose.
Log access with enough retention to answer a question about last Tuesday. Without that, debugging an integration turns into archaeology and the conversation with the partner becomes an argument about whose fault it is.
On a managed account the panel gives you most of this. Where it does not, that is the argument for a VPS rather than a complaint about the plan.
Limits set before the first integration
Rate limit at an edge you control, through server rules or middleware on a VPS, and back it with keys and quotas inside the application. Design those limits while there are no partners, because tightening them afterwards is a negotiation.
Abuse is not the main reason. A partner's retry loop after a brief outage is far more likely to take the API down than anybody malicious, and a sensible limit turns that from an incident into a graph.
Consumers feel the p95, not the homepage average. Whatever you measure, measure it at the tail, because that is the number the partner's engineers will quote back at you.
What you can honestly write down
The plan for this is the Entry VPS. One flat price, root access, and the essentials such as SSL, migration, backups and mail already included rather than added at checkout.
Be careful about the uptime figure you pass onward. Our platform target is 99.9% with a pro-rated credit on any month that falls short because of a fault at our end, and we call it a target rather than a contractual SLA on purpose. Promising a client more than your supplier promises you is a liability you have written yourself.
SSL comes free with every plan and reissues before it lapses, so nobody has to diary the padlock. On an API that is not a convenience: a lapsed certificate breaks every consumer at once, silently, and usually overnight.
The promise we will not make
We publish a 99.9% target with a credit rather than a contractual SLA, because we would rather you priced your own commitments off a real number than off a marketing one. A reseller who over-promises upstream reliability carries the difference personally.
Order an annual plan and the first year of your domain registration is on the house.
- Root access where the controls have to be yours
- Certificates renewed before a consumer notices
- A published uptime target with a credit attached
- Escalation that comes back to you, not to the partner
Why Hosting Seller
On every plan, as standard
The plan behind this page
The Entry VPS gives root access at one flat price, with SSL, migration, backups and mail already in it.
Certificates that never lapse
Free SSL on every plan, reissued automatically. On an API a lapsed certificate breaks every consumer at once and usually overnight.
A number you can quote
A published 99.9% uptime target with a pro-rated credit, so your own commitments can be priced off something real.
Controls you can reach
Headers, timeouts and TLS configuration in your hands rather than behind a support ticket.
A supplier you can name
IGI Security Services Ltd, registered in England and Wales, with terms published under English law.
Margin that survives renewal
The order price is the renewal price, so a long-lived integration does not get more expensive to host over time.
First Steps
From choosing to live
- 1
Name the on-call address before there are partners
Decide who a broken integration reaches at two in the morning, and what that person can actually do. An accidental on-call rota is unpaid work with your name on it.
- 2
Set rate limits while nobody is integrated
Limits designed before the first partner are configuration. Limits introduced afterwards are a negotiation, and usually a bad-tempered one.
- 3
Check the retention on your logs
You need enough history to answer a question about last week. Without it, every integration dispute becomes an argument about whose fault it was.
In the Box
Packed with every plan
- Root access on the VPS range, with the controls in your hands
- Free SSL on every site you host, reissued before it lapses
- A 99.9% uptime target, watched by monitoring day and night
- DDoS filtering handled out at the network edge
- NVMe SSD storage on every shelf, not just the top one
- Daily backups with restores you run yourself
- Upgrades apply to the account in place, with no move between plans
- Site migration handled by our staff at no charge
- Real people on the counter, every hour of every day
- A 30-day money-back guarantee on hosting plans, 7 days on reseller
Across the Counter
Things people ask us all the time
Can a managed shared account carry a client's production API?
A modest internal or low-volume public API, yes: PHP or Node endpoints with sensible latency. Contractual service levels, spiky partner traffic or websockets are what justify the step up to a VPS, and they are also what change your support obligations.
What uptime can I promise a client's integration partners?
Never more than your supplier promises you. Our platform target is 99.9% with a pro-rated credit on any month that falls short because of a fault at our end, described as a target rather than a contractual SLA. Anything stronger that you promise onward, you are underwriting yourself.
Where should rate limiting actually live?
At an edge you control, through server rules or middleware on a VPS, backed by keys and quotas inside the application. Design it before the first partner integrates. The usual cause of an outage is not abuse but a partner's retry loop after a brief blip.
What do I need in order to diagnose an integration failure?
Header and CORS control, timeouts you set rather than inherit, and logs with enough retention to answer a question about last week. If the plan does not give you those, that is the argument for a VPS rather than a complaint to support.
Read next
Hosting for Nonprofit Projects
The client counting every pound twice, and how to keep the account worth having anyway.
Static HTML Site Hosting
The quietest accounts on your shelf, and why they are also the best margin you will bill.
VPS Hosting
KVM virtual servers with root access, DDoS filtering and one flat price.
Web Hosting
cPanel accounts on NVMe disks, with SSL, the move-in and year-one domain included.
Moving your site to another host? Start with this checklist.
A step-by-step order of work for a move your visitors never spot: which files to copy first, how to carry email across without losing one message, the right moment to repoint DNS, and the two mistakes behind nearly every hour of downtime people ring us about.
Own the stack the API answers from.
KVM virtual servers with root access, DDoS filtering, free certificates and one flat price at renewal.
See VPS Hosting plans