Skip to main content

​
KeylessSSL quickstart

​
What is KeylessSSL?

KeylessSSL is a delegated domain control validation and Cloudflare for SaaS certificate automation platform. It allows you to verify domain ownership and request TLS certificates without giving KeylessSSL your DNS provider credentials. The workflow uses DNS-01 delegation through CNAME and TXT records.

​
Who is this for?

  • Integrators — developers who want to automate domain verification and certificate issuance using the KeylessSSL API.
  • Contributors — developers working on the KeylessSSL codebase.

​
Integration overview

KeylessSSL is a web application, not a Shopify app. There are no Shopify scopes, extensions, or TOML configuration files. The public integration surface is an HTTP REST API at https://api.keylessssl.dev.

​
Sign-in model

  • Human users — sign in through the portal at https://app.keylessssl.dev using Auth0 Authorization Code with PKCE. The portal uses a backend-for-frontend code exchange.
  • Programmatic access — use API keys in the Authorization: Bearer header. Keys are scoped per organization.

​
Core integration flow

  1. Create an API key from the portal with only the scopes you need.
  2. Create a base domain with POST /v1/domains.
  3. Read the delegation record with GET /v1/domains/{domainId}/delegation-record and publish the provided TXT and CNAME at your DNS provider.
  4. Verify with POST /v1/domains/{domainId}/verify-delegation.
  5. Issue a certificate with POST /v1/domains/{domainId}/certificates/issue.
  6. Sync provider state with POST /v1/certificates/{certificateId}/sync or subscribe to webhooks.

​
Public integration points

API reference: see /nodes/web-apps/keylessssl/developer/api for the full route table including domain, certificate, API key, webhook, audit, billing, and team routes. Webhook events: the backend emits domain.verified, cert.requested, and cert.issued to registered HTTPS endpoints.

​
Rate limits

Default rate limit is 120 requests per minute per client IP across all /v1 routes, enforced before authentication.

​
Local development

For UI-only work without a running API, set VITE_DCV_API_MODE=mock in the portal environment. Production auth requires Auth0; for local development, you can configure the API for local password authentication.

​
Test integrations

Use the documented sign-in or API-key flow and public /v1 endpoints when testing an integration. The API reference is the complete public integration surface.

​
Production API prerequisites

To call the production API, you need:
  • A KeylessSSL account.
  • An API key created in the portal with the scopes your integration needs.
  • The production base URL: https://api.keylessssl.dev.
  • Access to manage DNS for your own domains so you can publish the delegation records returned by KeylessSSL.