Endpoints
Creating an Endpoint
Open Endpoints in the dashboard and click Create endpoint. The form picks a root domain; everything else (TLS, agent provisioning, traffic policies) defaults sensibly and can be tuned per-endpoint after creation.
Root domain
The Root domain dropdown decides where your endpoint is published and whether you can pick a custom endpoint name.
| Option | When you'd pick it | Endpoint name |
|---|---|---|
| Default (<your-plan's-domain>, shared) | No setup needed — you just want a public URL. This is the domain your plan provisions on; the dashboard shows it in the option label. | Auto-generated (memorable word-word-word identity). Custom names are not available on shared domains. |
| <other-system-domain> (shared) | Your plan also grants access to additional shared domains. Pick one if you want a different public TLD than the plan default. | Auto-generated (same rule — the (shared) tag means you don't own the domain). |
| <your-custom-domain> (no tag) | You added the domain under Domains, verified it via DNS, and want your endpoint at app.yourcompany.com. Requires a plan that allows custom subdomains. |
Custom — type the subdomain (or @ for the root) when the field appears. |
Why “Default” is also (shared): the dropdown's first option represents your plan's default system domain. You don't own the domain — the platform does — so it's still a shared domain. The Default qualifier just tells you “this is what you'd get if you didn't pick anything”; shared tells you “name is auto-generated, custom names require a domain you own.”
Where the default comes from. Admins set a default system domain per plan; if a plan has no default configured, endpoints created without picking a domain fall back to the service's base host. The dropdown always reflects whatever is current for your plan.
Endpoint Overview
The endpoint Overview tab provides quick toggles and health monitoring.
Quick Toggles
- Force HTTPS — Redirect HTTP → HTTPS (301). Enabled by default.
- Response Cache — Enable edge caching with configurable path regex. Shows active cache entries count. Use the Purge button to clear cached responses.
Endpoint Health
Health monitoring sends a periodic HTTPS GET to a path on your endpoint and records the response. The dashboard surfaces uptime, latency and the latest probe verdict so you can spot issues without external monitoring.
Disabled by default. Each endpoint starts with health checks off; enable per-endpoint from the Overview tab when you want monitoring.
HTTP only. Health checks currently support HTTP/HTTPS endpoints. TCP and UDP endpoints show a "not available" notice in place of the settings — we can't sensibly HTTP-probe a non-HTTP service.
Settings
| Field | What it does | Default / Range |
|---|---|---|
| Enable health checks | Turns probing on/off for this endpoint. When off, no probes are sent and existing uptime cards are hidden. | Off |
| Probe path | The HTTP path each probe requests. Expose a lightweight endpoint such as /health if you don't want probes hitting your home page. |
/ — must start with /, max 255 chars |
| Interval | How often a probe runs, in seconds. Each endpoint is probed independently — one probe failing doesn't block the next. | 60 s — minimum 60, maximum 86 400 (1 day) |
Changes take effect within about 30 seconds — the worker reconciles its schedule against the database on that cadence.
Status badge
The badge in the Endpoint Health card shows the current verdict:
- Healthy — last probe returned 2xx, 401, or 403 (401/403 still count as up — the endpoint is reachable, it just requires auth).
- Unhealthy — last probe returned a 4xx (other than 401/403) or 5xx.
- Error — the probe didn't get an HTTP response (connection refused, TLS error, timeout).
- No Agent Connected — no tunnel agent is currently online for this endpoint. Probing is paused until an agent reconnects. The badge takes precedence over the last probe verdict in this state.
- Awaiting first probe — health checks were just enabled; the first probe hasn't run yet.
Metrics
- 24h / 7d / 30d Uptime — Percentage of probes in the window that returned a healthy verdict. Colored green (≥99%), amber (≥95%), or red (<95%).
- Avg Latency — Mean response time across healthy probes in the last 24 hours.
- Last check — Status, HTTP code, latency, timestamp, and (on failure) the error message from the most recent probe.
Probes are signed internally so they bypass the endpoint's traffic policies, rate limits, and traffic logging — they don't count against your usage and won't appear in your traffic log.
Traffic Policy
Define rules to control, modify, and route traffic at different lifecycle phases. Traffic policies are configured per-endpoint in the dashboard under Endpoint Settings → Traffic Policy.
Lifecycle Phases
Rules are organized into four phases, each evaluated at a different point in the request lifecycle:
| Phase | When | Available Rules |
|---|---|---|
| on_tcp_connect | TCP connection established | IP Restriction, Rate Limit, Terminate TLS |
| on_udp_connect | UDP stream begins | IP Restriction, Rate Limit |
| on_http_request | HTTP request received, before forwarding to backend | All rules except Custom Error |
| on_http_response | Response received from backend, before sending to client | Add/Remove Headers, Webhook, Custom Error |
Rule Evaluation
- Rules within a phase are evaluated in priority order (lowest number first)
- Each rule can be toggled ON or OFF independently
- Rules are enforced at the edge before traffic reaches your service
Endpoint API Keys
Manage API keys for edge-level validation. Use with the API Key Validation traffic policy rule. Configured in Endpoint Settings → API Keys. Keys are prefixed etk_ and hashed with SHA-256. Maximum 50 keys per endpoint.
Creating Keys
| Field | Description |
|---|---|
| Name | Descriptive label (e.g., "Production Key") |
| Rate Limit | Max requests/second. 0 = no per-key limit. |
| Expires In | Days until expiry. Empty = no expiry. |
X-API-Key header, api_key query parameter, or cookie — depending on the rule's key_location setting.
Dedicated Ports
Reserve fixed TCP/UDP ports for your endpoint. Your tunnels will always use the same port, even after restart. Configure in Endpoint Settings → Dedicated Ports.