Skip to main content

​
Quickstart

DelegatedSSL is a domain-control-validation-as-a-service platform for agencies and MSPs. It manages SSL certificate validation for client domains through delegated _acme-challenge CNAME records, using Cloudflare for SaaS for certificate issuance.

​
Architecture at a glance

​
Authentication

  • All /v1/* routes require Authorization: Bearer <token>, except the public verification-link routes and the portal token-exchange route (see below).
  • Tokens can be Auth0 access tokens (PKCE flow) or DelegatedSSL API keys (prefix dssl_).
  • API keys are scoped per route family: domains:read, domains:write, clients:read, clients:write, reports:read, webhooks:write.
  • Session, organization, team, usage, audit, billing, white-label, support, security, verification-link management, and API-key administration routes require a user session (API keys cannot access them).
  • The following routes are public and do not require a bearer token: GET /v1/verification-links/by-token/:token (open a client verification link), POST /v1/verification-links/by-token/:token/verify (check DNS for the linked domain), and POST /v1/auth/oidc/token (portal token exchange).

​
API surface

The complete API is documented in the API reference. Key resource areas:
  • Domains — CRUD, bulk create, delegation records, DNS verification, certificate issuance
  • Clients — CRUD with tags and notes
  • Certificates — status and bundle download
  • Verification links — create, remind, query
  • Webhooks — subscribe to domain and certificate lifecycle events
  • Team — members, invitations, role management
  • Billing — plans, subscription, trial, checkout

​
Rate limits

  • Authenticated /v1/* traffic is limited to 240 requests per 60-second window.
  • Public verification endpoints are limited to 30 requests per 60-second window.
  • Rate limit headers: Retry-After, X-RateLimit-Remaining, X-RateLimit-Reset.

​
Idempotency

Supply an Idempotency-Key header (16–160 characters, letters/digits/./_/:/-) on authenticated POST, PUT, PATCH, or DELETE requests for retry-safe operations. Keys are stored for 24 hours.

​
Integration points

  • REST API at https://api.delegatedssl.com/v1/*
  • Public verification portal — white-label client pages at /verify/:token (no auth required)
  • Webhooks — receive real-time events for domain and certificate lifecycle
  • API keys — scoped bearer tokens for server-to-server integration