Build on duckerhub.

Quickstart

From zero to a live PocketBase API in about a minute.

1 · Create an account

Sign up at /signup with a username and password — no email required. You will be shown a recovery code exactly once; save it. It is the only way back in if you lose your password.

2 · Create a ducker

On the dashboard, pick a name (3–40 lowercase letters, digits, dashes). Your ducker is live seconds later at https://<slug>.duckerhub.com.

3 · Create the PocketBase superuser

Open https://<slug>.duckerhub.com/_/ and complete the PocketBase installer. Then create your collections in the admin UI — this is plain PocketBase, so the PocketBase docs apply from here on.

4 · Make your first API call

$ curl https://<slug>.duckerhub.com/api/collections/posts/records
{"page":1,"perPage":30,"totalItems":0,"items":[]}

That's it — your frontend can now read and write against that URL.

Frontend hosting

Your ducker can serve your built static site alongside the API — one origin, no CORS.

Pack your build output

tar czf site.tar.gz -C dist .

Then use Deploy site on the ducker card in the dashboard — or the API directly:

curl -X PUT https://duckerhub.com/api/duckers/<id>/frontend \
  -H "Authorization: Bearer <api-key>" \
  -H "Content-Type: application/gzip" \
  --data-binary @site.tar.gz

• Files are served at https://<slug>.duckerhub.com/ with SPA fallback to index.html.
• /api/* and /_/* always route to PocketBase — a deploy never shadows them.
• Archive rules: gzipped tar, ≤ 25 MB, ≤ 5000 entries, regular files and directories only, relative paths (no ..).

REST API reference

The duckerhub management API at https://duckerhub.com/api — for your ducker's own PocketBase API, see the PocketBase docs.

Authenticate with Authorization: Bearer <api-key> (or the X-API-Key header). Your key is on the dashboard. Bodies are JSON unless noted.

Shape of a ducker object

{
  "id": 7, "slug": "my-app",
  "url": "https://my-app.duckerhub.com",
  "adminUrl": "https://my-app.duckerhub.com/_/",
  "status": "running",
  "createdAt": 1752800000000, "lastAccessAt": 1752800000000
}

MCP setup

Backends as a tool call — let your coding agent provision and operate duckers itself.

Remote MCP (recommended)

Server URL https://duckerhub.com/mcp, authenticated with your API key as a bearer token. Example client config:

{
  "mcpServers": {
    "duckerhub": {
      "url": "https://duckerhub.com/mcp",
      "headers": { "Authorization": "Bearer <api-key>" }
    }
  }
}

Stdio bridge

For clients that can't speak remote MCP, run the local bridge:

curl -O https://duckerhub.com/ducker-mcp.mjs
DUCKER_API_KEY=<api-key> node ducker-mcp.mjs

Tools exposed

create_ducker · list_duckers · get_ducker · start_ducker · stop_ducker · restart_ducker · delete_ducker · setup_ducker

setup_ducker creates (or resets) the PocketBase superuser and returns the credentials once — they are not stored by duckerhub.

Limits & lifecycle

The honest fine print.

• 5 duckers per account.
• After 15 minutes without HTTP traffic a ducker goes to sleep — the container stops, the data stays.
• Any request to its URL wakes a sleeping ducker automatically; the first request takes a couple of seconds.
• A ducker you stop manually is offline and stays that way until you start it again — requests will not wake it.
• Data always persists across sleeps, restarts and redeploys. Delete is the only destructive action, and it asks you to type the name.

Account & recovery

No email on file — by design. That changes how account recovery works.

• At signup you get a recovery code, shown once. With no email address, it is the only reset path — store it somewhere safe.
• Lost your password? Go to /recover with your username and recovery code to set a new one. Using a code rotates it — you get a fresh one, shown once.
• You can rotate the recovery code anytime from the dashboard; the old code stops working immediately.
• Your API key lives on the dashboard. Regenerating it invalidates the old key at once — update any MCP configs that use it.
• Deleting your account removes every ducker and all of their data. It asks for your password, and there is no undo.