On the admin host, Authorization: Bearer <sk_…>. The client wraps these, but you can call them directly.

Method & path Body / result
POST /api/frontends {"type":"http","domains":["app.example.com","*.example.com"]}{id, domain, domains, url, token} (a single "domain" is also accepted)
POST /api/frontends {"type":"tcp"}{id, public_port, token} (optional ?wait=10s to block for the cert)
GET /api/frontends · GET /api/frontends/{id} list / one (no tokens). Root sees all; a sub-token sees only its own (404 otherwise).
DELETE /api/frontends/{id} 204 (404 if not owned by the calling key)
POST /api/apikeys · GET · DELETE /api/apikeys/{id} Root only (sub → 403). Create returns {id, key, role} (key shown once); delete revokes the sub-token and cascade-deletes its frontends.

Note: Frontends are owned by the API key that created them. See multi-tenancy in the Security & FAQ.