What's new

If you are already signed in to the console, opening Veloxa Build now lands you in the builder signed in: no popup, no account picker, no consent dialog. If you are not, the sign-in button takes you to the console login in the same tab and brings you back to the page you were on. An expired session is renewed silently.

Signing out of Veloxa Build no longer signs you straight back in, and there is a "Sign out of VeloxaHost too" option. The builder also now uses the console's look.

Veloxa Build is an AI website and app builder for VeloxaHost customers. You sign in with your VeloxaHost account ("Sign in with VeloxaHost" is now an OpenID Connect provider) and turn it on per organization from Settings → Add-ons. Published sites get a yourname.veloxa.site address. It moved to build.veloxahost.com on 2026-10-07. Read more on the Veloxa Build page.

• Login redirects refuse look-alike targets (backslashes, control characters, protocol-relative URLs), closing an open redirect.
• A DNS zone can only be created for a domain you have proved you own: an active domain on your account, a verified site, or a _veloxa-verify TXT record.
• Server-wide service identities are no longer visible to tenants.
• Werkzeug updated to 3.1.9 for CVE-2026-102598.

Git deploys for websites now run in the background instead of in the request, so long builds no longer time out; the deploy webhook answers 202 Accepted, or 409 while a deploy is already running. www. versions of your domains now get their own certificate and redirect to the main name.

Buckets created under a managed hosting plan are now included in the plan, up to the plan's disk allowance in total, instead of also being metered per GB-month. Pay-as-you-go and cloud plans keep per-GB-month billing for buckets.

Every server now gets a block of ports on a shared public IPv4 address, included in the price. SSH is the first port of the block, and you can add your own port mappings inside it from the console or the API (/api/v1/instances/<name>/ports). IPv6 is planned; it is not available in US East yet.

Need a whole address? A dedicated IPv4 is an add-on chosen when you create the server, when available: the region's pool of addresses is limited. Add-ons are metered hourly and capped at their monthly price.

• A backup can be restored into a brand-new server, from the console or the API.
• Firewalls (network ACLs) can be attached to a server's network card.
• SSH keys and user-data now work together: #cloud-config is merged, and servers that need cloud-init get an image that has it.
• CPU alerts measure real utilisation; before, long-running servers could read 100%.
• Marketplace apps get one generated password per placeholder, stored encrypted. Owners and admins can reveal it, and every reveal is recorded in the audit log.

• API keys can have an expiry date and an IP allow-list, and can be revoked from the console. The key list shows who created each key.
• Every error under /api/ is JSON, and 429 responses carry Retry-After. Rate limits are counted per key, then per user, then per address.
• Webhook events such as instance.started and instance.stopped now fire from one shared event catalogue.
• The v2 API reference (Swagger UI) is self-hosted, and the API, CLI and Terraform examples in the docs match the real API.

• Pay as you go: activate billing with a card and pay for servers by the hour. Hosting packages can be bought from the console too.
• Sign-up: your organization is created only after your email address is verified, and sign-up and password reset are protected by Cloudflare Turnstile.