The Throne Room

What it is

The Throne Room puts a Zipper sign-in in front of an internal app. Only people in your workspace (with MFA if you require it) get through. The origin stays off the public internet.

Cloudflare analogue: Cloudflare Access (Zero Trust). SLA 99.95% · p99 70ms. Admins attach apps. Operators review grants.

• ▸Sign-in in front
• ▸MFA grants
• ▸Signed cookies
• ▸Audit trail

How it works

Attach an internal app and an email allow-list. The origin is never on the public internet.

MFA is required. Grants are HMAC cookies (HttpOnly, SameSite=Strict). Every grant is written to Watchtower.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Throne Room. Attach application + allowed emails.

API

Control-plane: GET|POST|DELETE /api/v1/throne/apps. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/services/throne \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/throne/apps", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Do not also publish the origin on a public A record.

• ▸SOC 2
• ▸HMAC grants
• ▸MFA

Runbook

Do not expose the origin publicly. Require MFA on every grant. Log each admission.