> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pcnaid.com/llms.txt
> Use this file to discover all available pages before exploring further.

# KeylessSSL quickstart

> Get oriented with KeylessSSL as an integrator or contributor — architecture, scopes, API surface, and local setup.

# KeylessSSL quickstart

## What is KeylessSSL?

KeylessSSL is a delegated domain control validation and Cloudflare for SaaS certificate automation platform. It allows you to verify domain ownership and request TLS certificates without giving KeylessSSL your DNS provider credentials. The workflow uses DNS-01 delegation through CNAME and TXT records.

## Who is this for?

* **Integrators** — developers who want to automate domain verification and certificate issuance using the KeylessSSL API.
* **Contributors** — developers working on the KeylessSSL codebase.

## Integration overview

KeylessSSL is a web application, not a Shopify app. There are no Shopify scopes, extensions, or TOML configuration files. The public integration surface is an HTTP REST API at `https://api.keylessssl.dev`.

### Sign-in model

* **Human users** — sign in through the portal at `https://app.keylessssl.dev` using Auth0 Authorization Code with PKCE. The portal uses a backend-for-frontend code exchange.
* **Programmatic access** — use API keys in the `Authorization: Bearer` header. Keys are scoped per organization.

### Core integration flow

1. Create an API key from the portal with only the scopes you need.
2. Create a base domain with `POST /v1/domains`.
3. Read the delegation record with `GET /v1/domains/{domainId}/delegation-record` and publish the provided TXT and CNAME at your DNS provider.
4. Verify with `POST /v1/domains/{domainId}/verify-delegation`.
5. Issue a certificate with `POST /v1/domains/{domainId}/certificates/issue`.
6. Sync provider state with `POST /v1/certificates/{certificateId}/sync` or subscribe to webhooks.

### Public integration points

**API reference:** see `/nodes/web-apps/keylessssl/developer/api` for the full route table including domain, certificate, API key, webhook, audit, billing, and team routes.

**Webhook events:** the backend emits `domain.verified`, `cert.requested`, and `cert.issued` to registered HTTPS endpoints.

### Rate limits

Default rate limit is 120 requests per minute per client IP across all `/v1` routes, enforced before authentication.

## Local development

```bash theme={null}
pnpm install
cp apps/api/.env.example apps/api/.env
cp apps/portal/.env.example apps/portal/.env.local
pnpm --filter @keylessssl/api migrate
pnpm dev:api
pnpm dev:portal
pnpm dev:marketing
```

For UI-only work without a running API, set `VITE_DCV_API_MODE=mock` in the portal environment. Production auth requires Auth0; for local development, you can configure the API for local password authentication.

### Test integrations

Use the documented sign-in or API-key flow and public `/v1` endpoints when testing an integration. The API reference is the complete public integration surface.

### Production API prerequisites

To call the production API, you need:

* A KeylessSSL account.
* An API key created in the portal with the scopes your integration needs.
* The production base URL: `https://api.keylessssl.dev`.
* Access to manage DNS for your own domains so you can publish the delegation records returned by KeylessSSL.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.