Deploy your JSON API

Do you need a server to host JSON?

Only if the response changes from one request to the next. A JSON file that everyone reads the same way is a static file: any static host or CDN can serve it, and to share one document with a person, a JSON Blob link needs no hosting at all. You need a server when the API has to:

• Accept data with POST, PUT or PATCH and save it.
• Answer differently per caller: authentication, per-user data, rate limits.
• Read fresh data from a database or another API.
• Keep secrets, such as database passwords or API keys, out of the browser.

Which hosting should you choose for a JSON API?

Pick by how much of the server you want to run yourself. Managed Node.js hosting runs your code and handles the machine; a VPS gives you the whole machine; Docker on a VPS packages each service so several can share one server.

How do you deploy a Node.js JSON API on a VPS?

Validate the data, write a small Express server, then on an Ubuntu VPS install Node.js, run the app under pm2, and put Nginx with a free Let's Encrypt certificate in front. Expect 15 to 30 minutes the first time.

1. Validate the JSON you'll serve

One trailing comma makes require("./data.json") throw at startup. Run the file through the JSON validator first, or repair a hand-edited filethat won't parse.

2. Write a minimal Express API

mkdir json-api && cd json-api
npm init -y
npm install express

Save your data as data.json (an array of objects with an id) and this as server.js:

const express = require("express");
const data = require("./data.json");

const app = express();

app.get("/health", (req, res) => res.json({ ok: true }));
app.get("/api/items", (req, res) => res.json(data));
app.get("/api/items/:id", (req, res) => {
  const item = data.find((entry) => String(entry.id) === req.params.id);
  if (!item) return res.status(404).json({ error: "Not found" });
  res.json(item);
});

const port = process.env.PORT || 3000;
// 127.0.0.1 keeps the app private: only Nginx on the same server can reach it
app.listen(port, "127.0.0.1", () => console.log("JSON API on port " + port));

res.json() sets the Content-Type: application/json header for you. Run node server.js and open http://127.0.0.1:3000/api/items to check it locally, then push the project to a Git repository.

3. Create the server and connect

Order a VPS running the latest Ubuntu LTS and choose the data centre closest to your users. Hostinger VPS plans (affiliate link, opens in a new tab) come with root access and 10 locations across four continents. Then connect from your terminal:

ssh root@YOUR_SERVER_IP

For anything beyond a test, create a user with sudo rights, log in with an SSH key and turn off password logins before you go further.

4. Install Node.js LTS

curl -fsSL https://deb.nodesource.com/setup_lts.x -o nodesource_setup.sh
sudo -E bash nodesource_setup.sh
sudo apt-get install -y nodejs git
node -v

5. Upload the code and keep it running

git clone https://github.com/YOU/json-api.git
cd json-api
npm ci --omit=dev
sudo npm install -g pm2
pm2 start server.js --name json-api
pm2 startup systemd   # run the command it prints
pm2 save

pm2 restarts the API if it crashes, and pm2 startup plus pm2 save bring it back after a reboot. Check it with pm2 logs json-api.

6. Add HTTPS with Nginx and Let's Encrypt

Point an A record such as api.example.comat the server's IP address, then save this Nginx site as /etc/nginx/sites-available/json-api:

server {
    listen 80;
    server_name api.example.com;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

sudo apt-get install -y nginx certbot python3-certbot-nginx
sudo nano /etc/nginx/sites-available/json-api   # paste the block above
sudo ln -s /etc/nginx/sites-available/json-api /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d api.example.com
sudo ufw allow OpenSSH
sudo ufw allow "Nginx Full"
sudo ufw enable

certbot edits the Nginx site to serve HTTPS and renews the certificate on its own. The firewall now lets in only SSH and web traffic, so port 3000 stays private.

7. Test the live endpoint

curl -s https://api.example.com/api/items

Paste the response into the JSON formatter to read it, or check it against your contract with the JSON Schema validator.

How do you turn a JSON file into a mock REST API?

Use json-server. Point it at a JSON file and every top-level key becomes a REST resource with GET, POST, PUT, PATCH and DELETE. It is built for prototypes and front-end work, not production: it has no authentication and writes changes straight back to the file.

{
  "users": [{ "id": "1", "name": "Ada" }],
  "posts": [{ "id": "1", "title": "Hello", "userId": "1" }]
}

npx json-server db.json

That serves /users, /users/1 and /posts on port 3000. Need TypeScript types for the front end that calls it? Generate them from the same file with JSON to TypeScript.

Run the mock API on a server with Docker Compose

Put db.json in a data folder and save this as compose.yaml next to it, then run docker compose up -d. On a Hostinger Docker VPS (affiliate link, opens in a new tab) you can paste the same file into the visual Docker manager instead.

services:
  mock-api:
    image: node:lts-alpine
    # mount the folder, not the file: json-server saves by renaming a temp file
    volumes:
      - ./data:/data
    command: npx -y json-server --host 0.0.0.0 --port 3000 /data/db.json
    ports:
      # Docker publishes ports past ufw, so bind to localhost only
      - "127.0.0.1:3000:3000"
    restart: unless-stopped

json-server has no login, and Docker publishes ports straight past ufw, so the compose file binds the mock to 127.0.0.1. Reach it from your laptop through an SSH tunnel, ssh -L 3000:localhost:3000 root@YOUR_SERVER_IP, then open http://localhost:3000/users.

Is managed Node.js hosting easier than a VPS?

Yes, if your API is one Node.js app. You connect a Git repository and the host builds and runs it, so there is no Nginx, pm2 or certificate renewal to look after. The cost is control: no root shell and no extra services.

Hostinger managed Node.js hosting (affiliate link, opens in a new tab) deploys from GitHub, includes SSL, a CDN, a web application firewall and DDoS protection, and bills a flat price instead of per request. For the Express app above, drop the "127.0.0.1" argument from app.listen and keep reading the port from process.env.PORT, which most managed platforms assign for you.

How do you self-host n8n for JSON workflows?

Run n8n on a VPS, from a one-click template or with Docker, and put it behind HTTPS before you connect webhooks. Self-hosting the community edition has no execution limits, and every item n8n passes between nodes is JSON, so the tools on this site work on its data directly.

The quickest route is the Hostinger n8n VPS template (affiliate link, opens in a new tab), which installs n8n in one click, with variants for queue mode and a library of ready-made workflows. On any other server, the official Docker image runs it:

docker volume create n8n_data
docker run -d --name n8n --restart unless-stopped \
  -p 127.0.0.1:5678:5678 \
  -v n8n_data:/home/node/.n8n \
  docker.n8n.io/n8nio/n8n

Before you expose it, set N8N_HOST, N8N_PROTOCOL=https and WEBHOOK_URL so webhook URLs use your domain. The container only listens on 127.0.0.1, because Docker would otherwise publish it past ufw, so put it behind the same Nginx and Let's Encrypt setup as the API above, proxying to port 5678. Add proxy_http_version 1.1; and pass the Upgrade and Connection headers in that locationblock, or the editor shows "Connection lost".

When a node's output looks wrong, open it in the JSON viewer, test the expression you're about to write in the JSONPath tester, or reshape it with the JSON mapper.

What should you check before a JSON API goes live?

• Every response sends Content-Type: application/json, including errors.
• Responses match a schema: write one and test real payloads in the JSON Schema validator.
• CORS allows only the origins that need it, and never * for an API that uses cookies or tokens.
• Secrets live in environment variables, never in the repository or the JSON.
• Large responses are paginated and compressed (gzip on; in Nginx).
• Anything the API writes is backed up, a mock server's db.json included.
• Clients stay in sync: regenerate types from a real response with JSON to TypeScript when the shape changes.