On the admin host, Authorization: Bearer <sk_…>. The client wraps these, but you can call them directly.
| Method & path | Body / result |
|---|---|
POST /api/frontends |
{"type":"http","domains":["app.example.com","*.example.com"]} → {id, domain, domains, url, token} (a single "domain" is also accepted) |
POST /api/frontends |
{"type":"tcp"} → {id, public_port, token} (optional ?wait=10s to block for the cert) |
GET /api/frontends · GET /api/frontends/{id} |
list / one (no tokens). Root sees all; a sub-token sees only its own (404 otherwise). |
DELETE /api/frontends/{id} |
204 (404 if not owned by the calling key) |
POST /api/apikeys · GET · DELETE /api/apikeys/{id} |
Root only (sub → 403). Create returns {id, key, role} (key shown once); delete revokes the sub-token and cascade-deletes its frontends. |
Note: Frontends are owned by the API key that created them. See multi-tenancy in the Security & FAQ.