/services/{id}/capabilitiesAsk before you draw a button
Tells your UI which controls a service supports, so your panel never offers an action the server cannot do.
A machine-first partner programme for developers and small platforms. Resell KVM VPS, streaming VPS and dedicated servers under your own name, or provision servers for your own SaaS users, through a white-label VPS API. You buy at wholesale and set your own prices. Your customers never deal with us and never get a login on our platform.
Open a normal client account at my.noded.cloud.
Open Reseller programme in the client panel and apply. A person reviews every application; nothing is approved automatically.
Once approved: a dashboard, the catalogue with your wholesale prices, orders, services, customers and API settings. Ordinary checkout in the panel charges you wholesale too.
Set your own prices and sell through your own panel, storefront or product, driven by the Reseller API.
Authorization: Bearer rsk_… identifies your key. Two more headers prove the request came from you:
X-Reseller-Timestamp: the request time, Unix seconds.
X-Reseller-Signature: hmac-sha256=<hex>, where the hex is HMAC-SHA256 with your secret over the timestamp, a dot, and the raw request body.
Sign the exact bytes you send. Re-encoding the JSON after signing is the classic bug, and the test vectors catch it.
Idempotent by your own id. Put your order id in externalOrderId. A retried create returns the original order instead of charging twice. Attach your own externalCustomerId too.
BODY='{"productId":"<product id>","billingCycle":"monthly","externalOrderId":"ORD-1042","externalCustomerId":"cus_77"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" \
| openssl dgst -sha256 -hmac "$RESELLER_SECRET" | awk '{print $NF}')
curl -s https://my.noded.cloud/api/v1/reseller/orders \
-H "Authorization: Bearer rsk_…" \
-H "Content-Type: application/json" \
-H "X-Reseller-Timestamp: $TS" \
-H "X-Reseller-Signature: hmac-sha256=$SIG" \
--data-raw "$BODY"import crypto from "node:crypto";
const body = JSON.stringify({
productId: "<product id>",
billingCycle: "monthly",
externalOrderId: "ORD-1042", // your id: a retry returns this order
});
const ts = Math.floor(Date.now() / 1000).toString();
const sig = crypto
.createHmac("sha256", process.env.RESELLER_SECRET)
.update(`${ts}.${body}`)
.digest("hex");
const res = await fetch("https://my.noded.cloud/api/v1/reseller/orders", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.RESELLER_KEY}`, // rsk_…
"Content-Type": "application/json",
"X-Reseller-Timestamp": ts,
"X-Reseller-Signature": `hmac-sha256=${sig}`,
},
body, // send the exact bytes you signed
});<?php
$body = json_encode([
"productId" => "<product id>",
"billingCycle" => "monthly",
"externalOrderId" => "ORD-1042",
]);
$ts = (string) time();
$sig = hash_hmac("sha256", $ts . "." . $body, getenv("RESELLER_SECRET"));
$ch = curl_init("https://my.noded.cloud/api/v1/reseller/orders");
curl_setopt_array($ch, [
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => $body, // the exact bytes you signed
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => [
"Authorization: Bearer " . getenv("RESELLER_KEY"), // rsk_…
"Content-Type: application/json",
"X-Reseller-Timestamp: $ts",
"X-Reseller-Signature: hmac-sha256=$sig",
],
]);
$response = curl_exec($ch);import hashlib, hmac, json, os, time, urllib.request
body = json.dumps({
"productId": "<product id>",
"billingCycle": "monthly",
"externalOrderId": "ORD-1042",
}).encode()
ts = str(int(time.time()))
sig = hmac.new(os.environ["RESELLER_SECRET"].encode(),
ts.encode() + b"." + body, hashlib.sha256).hexdigest()
req = urllib.request.Request(
"https://my.noded.cloud/api/v1/reseller/orders",
data=body, # the exact bytes you signed
method="POST",
headers={
"Authorization": "Bearer " + os.environ["RESELLER_KEY"], # rsk_…
"Content-Type": "application/json",
"X-Reseller-Timestamp": ts,
"X-Reseller-Signature": "hmac-sha256=" + sig,
},
)
print(urllib.request.urlopen(req).read().decode())/services/{id}/capabilitiesTells your UI which controls a service supports, so your panel never offers an action the server cannot do.
/services/{id}/documentHardware, location, IPs, OS, add-ons and upgrade paths at your wholesale price, ready to render in your own panel.
/services/{id}/console-castReturns an expiring, revocable URL that is the console page. Iframe it or put it behind a button. Prefer your own VNC viewer? Use console-session.
# webhook event types
order.paid
order.invoiced
order.payment_failed
service.provisioned
service.provisioning_failed
service.suspended
service.unsuspended
service.terminated
webhook.testhttps://my.noded.cloud/api/v1/resellerThe Customer API is the one you want: project-bound keys, Idempotency-Key orders and cloud-init at order time, for your own account.
See the Customer APIRegister a client account, open Reseller programme in the panel and apply. A person reviews every application.