Bot hosting you can control from code

Why a hosting API helps

Most bot hosts give you a web page with a start button and a console. That covers the first week. After that the same few chores keep coming back: restart the bot after pushing a fix, pull the latest code, check whether it is still running, read the last few hundred lines of output when somebody reports it went quiet.

Each of those is one HTTP request. With an API you can put them in a GitHub Actions workflow, a cron job on your own machine, a status page, or an admin command in the bot itself, and stop opening the panel to do them by hand.

Get a key

Every Silly Development account can use the API at no cost, free servers included. Create a key in the panel under Account, API keys. You can limit it to some servers, some permissions and some IP addresses, and give it an expiry date, so a key kept in a CI secret can restart one bot and do nothing else.

Keep the key in an environment variable. Anyone who has it can do whatever you allowed the key to do.

export SILLYDEV_API_KEY="sdevc_..."

# List the servers the key can reach.
curl "https://sillydev.co.uk/panel/api/client" \
  -H "Authorization: Bearer $SILLYDEV_API_KEY" \
  -H "Accept: application/json"

Restart the bot after a deploy

Each server has a short identifier, shown in the panel. A power request with the signal restart is accepted straight away and the restart happens in the background, so the request returns before the bot is back up.

If the server is linked to a Git repository, one request pulls and deploys the latest commit instead. The API docs have a ready-made GitHub Actions workflow that does this on every push.

import os
import requests

API = "https://sillydev.co.uk/panel/api/client"
headers = {"Authorization": f"Bearer {os.environ['SILLYDEV_API_KEY']}"}

response = requests.post(f"{API}/servers/1a7ce997/power", json={"signal": "restart"}, headers=headers)
response.raise_for_status()

Watch it from somewhere else

The resources endpoint says whether the server is running and how much memory and CPU it is using right now. Polling it once a minute is plenty for a status page or an uptime check, and well inside the rate limit.

For the live console, the API hands out a short-lived token for a websocket that streams the output as it is written and accepts commands. That is how a moderation bot can post the last error from another bot into a staff channel.

What it will not do

An API key can never change how you sign in: not your password, email address, two-factor or the API keys themselves. Those stay in the panel, behind your browser session, so a leaked key cannot lock you out of your own account.