> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Get oriented with DelegatedSSL — the app's purpose, architecture, authentication model, API surface, and public integration points.

# Quickstart

DelegatedSSL is a domain-control-validation-as-a-service platform for agencies and MSPs. It manages SSL certificate validation for client domains through delegated `_acme-challenge` CNAME records, using Cloudflare for SaaS for certificate issuance.

## Architecture at a glance

| Component | Technology | Domain |
| - | - | - |
| Public marketing site | React 19 + Vite | `delegatedssl.com` |
| Authenticated portal | React 19 + Vite | `app.delegatedssl.com` |
| API | Hono (Cloudflare Worker) | `api.delegatedssl.com` |
| Database | PostgreSQL | — |

## Authentication

* All `/v1/*` routes require `Authorization: Bearer <token>`, except the public verification-link routes and the portal token-exchange route (see below).
* Tokens can be Auth0 access tokens (PKCE flow) or DelegatedSSL API keys (prefix `dssl_`).
* API keys are scoped per route family: `domains:read`, `domains:write`, `clients:read`, `clients:write`, `reports:read`, `webhooks:write`.
* Session, organization, team, usage, audit, billing, white-label, support, security, verification-link management, and API-key administration routes require a user session (API keys cannot access them).
* The following routes are public and do not require a bearer token: `GET /v1/verification-links/by-token/:token` (open a client verification link), `POST /v1/verification-links/by-token/:token/verify` (check DNS for the linked domain), and `POST /v1/auth/oidc/token` (portal token exchange).

## API surface

The complete API is documented in the [API reference](https://docs.pcnaid.com/nodes/web-apps/delegatedssl/developer/api/index.md). Key resource areas:

* **Domains** — CRUD, bulk create, delegation records, DNS verification, certificate issuance
* **Clients** — CRUD with tags and notes
* **Certificates** — status and bundle download
* **Verification links** — create, remind, query
* **Webhooks** — subscribe to domain and certificate lifecycle events
* **Team** — members, invitations, role management
* **Billing** — plans, subscription, trial, checkout

## Rate limits

* Authenticated `/v1/*` traffic is limited to 240 requests per 60-second window.
* Public verification endpoints are limited to 30 requests per 60-second window.
* Rate limit headers: `Retry-After`, `X-RateLimit-Remaining`, `X-RateLimit-Reset`.

## Idempotency

Supply an `Idempotency-Key` header (16–160 characters, letters/digits/./\_/:/-) on authenticated `POST`, `PUT`, `PATCH`, or `DELETE` requests for retry-safe operations. Keys are stored for 24 hours.

## Integration points

* **REST API** at `https://api.delegatedssl.com/v1/*`
* **Public verification portal** — white-label client pages at `/verify/:token` (no auth required)
* **Webhooks** — receive real-time events for domain and certificate lifecycle
* **API keys** — scoped bearer tokens for server-to-server integration


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.