The NordBastion polar-bear mascot seated at a tactical mission-control workstation with floating holographic terminal monitors showing cyan code, a mechanical keyboard with cyan-lit keycaps and the cyan-N shield leaning beside him, inside an exposed Nordic stone console room with an aurora-lit window
API.v1 · REST · MCP · API keys

Run NordBastion from code.
KYC-free, crypto-paid, fully scriptable.

Register, create a key, then test access. No deposit is required.

Quick start All endpoints
Quick start

Create your API key before paying.

Register, create a key, then test access. No deposit is required.

cURL

Use the access token from signup or login to create a scoped API key. The key is returned once in plaintext.

# bash + curl + jq
# Set NB_EMAIL and NB_PASSWORD in your environment.
set -eu
: "${NB_EMAIL:?Set NB_EMAIL}" "${NB_PASSWORD:?Set NB_PASSWORD}"
API=https://nordbastion.com/v1
TOKEN=$(jq -n '{email:env.NB_EMAIL,password:env.NB_PASSWORD}' |
  curl --fail-with-body -sS "$API/auth/register" \
    -H 'Content-Type: application/json' --data-binary @- |
  jq -er '.tokens.access_token')
KEY=$(curl --fail-with-body -sS "$API/auth/api-keys" \
  -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' \
  -d '{"name":"agent-read","scope":"read"}' |
  jq -er '.plaintext')
curl --fail-with-body -sS "$API/account/balance" \
  -H "Authorization: Bearer $KEY"
# Store KEY in your secret store. Do not print it.
unset TOKEN KEY

Python

Create your API key before paying.

import os
import requests

api = "https://nordbastion.com/v1"
with requests.Session() as client:
    signup = client.post(api + "/auth/register", json={
        "email": os.environ["NB_EMAIL"],
        "password": os.environ["NB_PASSWORD"],
    }, timeout=30)
    signup.raise_for_status()
    token = signup.json()["tokens"]["access_token"]
    created = client.post(api + "/auth/api-keys",
        headers={"Authorization": f"Bearer {token}"},
        json={"name": "agent-read", "scope": "read"},
        timeout=30)
    created.raise_for_status()
    key = created.json()["plaintext"]
    # Store key in your secret store; never log it.
    balance = client.get(api + "/account/balance",
        headers={"Authorization": f"Bearer {key}"},
        timeout=30)
    balance.raise_for_status()
    print(balance.json())

API key access is independent of payments. Maximum 10 active keys per account; revoke unused keys.

Compatibility and releases

The hosted MCP endpoint is updated here. Versioned stdio downloads include source code and SHA-256 checksums.

Hosted MCP

https://nordbastion.com/mcp
Version
1.1.0
Protocol versions
2026-07-28 · 2025-11-25 · 2025-06-18 · 2025-03-26
Last verified
2026-09-15

Send credentials in the Authorization header, or in the access_token argument when your MCP host cannot set headers.

Browser OAuth authorization is not available. Use a Bearer token or the explicit access_token argument.

Server metadata · MCP specification

MCP · register_account → create_api_key

{"name":"register_account","arguments":{
  "email":"agent@example.com",
  "password":"YOUR_STRONG_PASSWORD"
}}

{"name":"create_api_key","arguments":{
  "name":"agent-read",
  "scope":"read",
  "access_token":"ACCESS_TOKEN_FROM_SIGNUP"
}}

{"name":"get_balance","arguments":{
  "access_token":"PLAINTEXT_FROM_CREATE_API_KEY"
}}

Generate SSH keys locally. Upload only the public key; keep the private key on your device.

ssh-keygen -t ed25519 -f ~/.ssh/nordbastion_agent
# add_ssh_key: public_key = contents of the .pub file

Download MCP 0.2.0

Python ≥ 3.10 · MCP SDK 2.2.0 · MIT

Wheel · Source code · SHA-256 · Changelog

pip install https://nordbastion.com/downloads/nordbastion_mcp-0.2.0-py3-none-any.whl
nordbastion-mcp

Endpoint reference

OpenAPI 3.1 · llms-agents.txt

Python, TypeScript, Go and Rust SDKs and the CLI are planned. Use REST or MCP today.

MethodEndpointScopeStatus
POST/v1/auth/registerpublicLIVE
POST/v1/auth/loginpublicLIVE
POST/v1/auth/login/totppublicLIVE
POST/v1/auth/token/refreshpublicLIVE
POST/v1/auth/recoverpublicPLANNED
GET/v1/auth/sessionsfullLIVE
DELETE/v1/auth/sessions/{token_id}fullLIVE
POST/v1/auth/totp/setupfullLIVE
POST/v1/auth/totp/enablefullLIVE
POST/v1/auth/totp/disablefullLIVE
POST/v1/auth/passwordfullLIVE
POST/v1/auth/api-keysfullLIVE
GET/v1/auth/api-keysreadLIVE
DELETE/v1/auth/api-keys/{key_id}fullLIVE
GET/v1/accountreadLIVE
PATCH/v1/accountfullPLANNED
GET/v1/account/balancereadLIVE
GET/v1/account/usagereadLIVE
GET/v1/account/audit-logreadLIVE
GET/v1/billing/coinspublicLIVE
POST/v1/billing/topupsbillingLIVE
GET/v1/billing/topupsreadLIVE
GET/v1/billing/topups/{order_number}readLIVE
POST/v1/billing/topups/{order_number}/cancelbillingLIVE
GET/v1/billing/bonus-tierspublicLIVE
GET/v1/catalogpublicLIVE
GET/v1/catalog/vpspublicLIVE
GET/v1/catalog/dedicatedpublicLIVE
GET/v1/catalog/bastionspublicLIVE
GET/v1/catalog/imagespublicLIVE
GET/v1/catalog/{code}publicLIVE
POST/v1/serversserversLIVE
GET/v1/serversreadLIVE
GET/v1/servers/{order_number}readLIVE
PATCH/v1/servers/{order_number}serversLIVE
DELETE/v1/servers/{order_number}serversLIVE
POST/v1/ssh-keysserversLIVE
GET/v1/ssh-keysreadLIVE
GET/v1/ssh-keys/{id}readLIVE
DELETE/v1/ssh-keys/{id}serversLIVE
POST/v1/webhooksfullLIVE
GET/v1/webhooksreadLIVE
DELETE/v1/webhooks/{id}fullLIVE
POST/v1/webhooks/{id}/testfullLIVE
GET/v1/transparency/canarypublicLIVE
GET/v1/transparency/peeringpublicLIVE
GET/v1/transparency/statuspublicLIVE
GET/v1/agents/directorypublicLIVE
POST/v1/agents/directoryfullLIVE
POST/v1/oauth/registerpublicLIVE
POST/v1/oauth/tokenpublicLIVE
POST/v1/oauth/revokepublicLIVE
GET/v1/oauth/introspectpublicLIVE

Payment

Browse and test before funding. Crypto top-ups are only needed for paid services.

POST /v1/billing/topups · {"amount_usd":50,"crypto":"XMR"} · USD 30–10,000

x402 is available for signed USDC payments on Base through the top-up endpoint. Wait for confirmed balance before ordering.

x402: POST /v1/billing/topups · X-Payment-Mode: x402 · {"amount_usd":50}

Rate limits

API key: 120 / min · 3,000 / hour · public: 30 / min · HTTP 429 + Retry-After

Account activity is recorded in the API audit log. Credentials and request bodies are not included.

Get API key

Private hosting, built in the North.