Origin Connect

What it is

Origin Connect runs a small program on your server that dials Zipper. Zipper never needs an inbound hole. The Throne Room can then require sign-in. No public IP on the origin.

Cloudflare analogue: Cloudflare Tunnel. SLA 99.99% · p99 22ms. Admins register connectors. Operators may rotate them.

• ▸Connector dials out
• ▸Hostname routing
• ▸Private origins
• ▸Heartbeat health

How it works

A connector in your network dials Zipper outbound. No inbound firewall hole, no public origin IP.

Heartbeat keeps the connector in rotation. Pair hostnames with The Throne Room or The Crown.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Origin Connect. Register name + hostname. Copy the secret.

API

Control-plane: POST /api/v1/connect/heartbeat. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/connect \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"accra-origin","hostname":"origin.example.com"}'

curl -sS -X POST https://tinyzipper.com/api/v1/connect/heartbeat \
  -H "Authorization: Bearer zip_conn_YOUR_SECRET"

const res = await fetch("https://tinyzipper.com/api/v1/connect/heartbeat", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Treat zip_conn_ secrets like origin passwords. Rotate by creating a new connector.

• ▸SOC 2
• ▸Zero-trust

Runbook

Keep the connector healthy. Pair hostnames with The Throne Room. Never open inbound ports.