Create an API key

The quickest way is Copy setup prompt on your dashboard, which creates a key named Default and hands it to your AI agent. To create one yourself, open Settings, find API keys, give the key a name and select Create API key. The full key is shown once; copy it into your environment, for example as SHIPRUST_API_KEY. The page keeps only a short prefix so you can recognize the key later.

A key has the same access as your account. Keep it out of source control, and revoke it from the same page if it leaks. Revocation takes effect on the next request. Each account can hold ten keys, and deleting your account deletes them.

Authenticate

Send the key as a bearer token on every request. Browser sessions are not accepted by the API.

curl https://shiprust.com/api/v1/me \
  -H "Authorization: Bearer $SHIPRUST_API_KEY"

A successful response is JSON:

{"id":"…","email":"you@example.com","paid":true,"created_at":"2026-10-08T12:00:00Z"}

Every error is a JSON object with an error message and a matching status code: 401 for a missing, invalid or revoked key, 402 when your account has no lifetime access yet, 404 for a project that is not yours, 409 when a slug is already taken, 422 for invalid choices and 400 for a body that is not JSON.

Endpoints

Method and path	Purpose
`GET /api/v1/me`	The account behind the key, including whether it has paid access.
`GET /api/v1/options`	Hosting choices, capability keys, defaults and limits. No key required.
`GET /api/v1/projects`	Your projects, newest first.
`POST /api/v1/projects`	Create a project with the same choices as the new-project form.
`GET /api/v1/projects/{id}`	One project.
`GET /api/v1/projects/{id}/download`	The generated zip, identical to the site's download.
`DELETE /api/v1/projects/{id}`	Remove the project from your list. Downloaded zips are unaffected.

The full reference is generated from the code, so it always matches what the server accepts and returns:

/openapi.json is the OpenAPI 3.1 document, also available at /api/v1/openapi.json. Point code generators, Postman, Insomnia or an agent at it.
/api/v1/docs is the same document in Swagger UI. Select Authorize, paste your key, and try each endpoint from the browser. The key stays in that tab and is not saved.

Neither needs a key.

Creating and downloading require lifetime access or an active admin role, exactly like the site. Admin accounts report paid: true and receive all paid features without a purchase. Revoking the role removes this complimentary access immediately, including for existing API keys; purchased lifetime access is unaffected. Project ownership is always enforced.

Create a project

Post a JSON object. Only name is required; every other field takes the default the form shows.

Field	Type	Default	Notes
`name`	string	required	2 to 64 characters. Replaces ShipRust in the generated project.
`slug`	string	derived from `name`	Lowercase letters, digits and dashes, starting with a letter, at most 40 characters. Unique per account.
`description`	string	`""`	Up to 1000 characters, for your own reference.
`host`	string	`"none"`	`"none"` or `"caprover"`.
`include_blog`	boolean	`true`	Markdown posts and RSS.
`include_docs`	boolean	`true`	Product documentation pages.
`include_auth`	boolean	`true`	Accounts: sign-up with email verification, sign-in, passkeys, two-factor, settings, a dashboard and an admin panel. `false` generates a public site and leaves out `include_google`, `include_api`, `include_mcp`, `include_storage`, `include_stripe` and `include_qdrant`, which act for a signed-in user, whatever they say.
`include_google`	boolean	`true`	Sign in with Google: one-click sign-up and sign-in, connecting Google to an existing account from settings, and Google confirmation for accounts without a password. Bring your own Google OAuth client; hidden until configured.
`include_stripe`	boolean	`true`	Hosted Checkout, billing portal and webhooks.
`include_api`	boolean	`true`	Setup API: a way for your users to interact with your platform through an API, with personal API keys, bearer authentication, starter endpoints, and an OpenAPI document with Swagger UI generated from the code.
`include_mcp`	boolean	follows `include_api`	An MCP server in the generated app at `/mcp`, authenticated with the same keys, with a starter tool to extend. Needs `include_api`; `true` without it is a `422`.
`include_storage`	boolean	`true`	File storage for user uploads: Cloudflare R2, AWS S3 or any S3-compatible bucket once the owner sets `STORAGE_S3_*`, local disk otherwise. Ships a profile picture upload as the example.
`include_qdrant`	boolean	`false`	Vector search: a Qdrant client scoped per user, collection setup at startup and a purge job on account deletion. Bring your own embeddings.
`sentry_features`	array of strings	all five	`sentry-errors`, `sentry-traces`, `sentry-logs`, `sentry-metrics`, `sentry-replay`. An empty array turns Sentry off.
`posthog_features`	array of strings	all five	`posthog-web`, `posthog-product`, `posthog-errors`, `posthog-logs`, `posthog-traces`. An empty array turns PostHog off.

Unknown fields and unknown capabilities are rejected with 422, so a typo cannot silently change what you get. GET /api/v1/options returns the same lists with labels and descriptions.

curl https://shiprust.com/api/v1/projects \
  -H "Authorization: Bearer $SHIPRUST_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme App",
    "host": "caprover",
    "include_stripe": true,
    "sentry_features": ["sentry-errors", "sentry-traces"],
    "posthog_features": []
  }'

The response is 201 Created with the saved project, including its id, the template_version it will be generated from and a download_url:

{
  "id": "0192…",
  "name": "Acme App",
  "slug": "acme-app",
  "description": "",
  "host": "caprover",
  "include_blog": true,
  "include_docs": true,
  "include_auth": true,
  "include_google": true,
  "include_stripe": true,
  "include_api": true,
  "include_mcp": true,
  "include_storage": true,
  "include_qdrant": false,
  "sentry_features": ["sentry-errors", "sentry-traces"],
  "posthog_features": [],
  "template_version": "318d293",
  "created_at": "2026-10-08T12:00:00Z",
  "url": "/api/v1/projects/0192…",
  "download_url": "/api/v1/projects/0192…/download"
}

Download the codebase

curl -L -o acme-app.zip "https://shiprust.com$DOWNLOAD_URL" \
  -H "Authorization: Bearer $SHIPRUST_API_KEY"

The zip unpacks to a folder named after the slug and records your choices in .shiprust.toml. Continue with Download and run your codebase.

Use it from a coding agent

The easiest way is the MCP server: connect https://shiprust.com/mcp with the same key and the agent gets these operations as tools. Agents without MCP support can call the endpoints directly with curl. Give the agent the key through an environment variable rather than pasting it into a prompt, point it at GET /api/v1/options to discover the choices, and let it create, download and unzip the project before it starts working in the codebase.

Install the agent toolkit

Use the AI agent setup guide for the official skills, client-specific MCP configurations and REST fallback. Your dashboard has a copyable setup prompt.