The Vault

What it is

The Vault gets a certificate for each hostname, renews it, and keeps the private key off the tenant dashboard. You can also upload your own certificate.

Cloudflare analogue: Cloudflare SSL/TLS. SLA 99.99% · p99 20ms. Admins set cipher policy. Private keys stay in The Vault.

• ▸Renews by itself
• ▸Your own certificates
• ▸HSTS helpers
• ▸Keys stay in The Vault

How it works

The Vault issues and renews certificates for each hostname. Private keys never leave the vault.

Minimum TLS, HSTS, OCSP stapling, and custom certificates are Policy toggles.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Vault. Automatic HTTPS is on. Upload a custom cert only if you must bring your own.

API

Control-plane: PATCH /api/v1/services/vault. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/services/vault \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/services/vault", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

TLS 1.3 only is fine for modern apps. Keep 1.2 if you still have old POS terminals.

• ▸SOC 2
• ▸PCI-ready
• ▸TLS 1.2+

Runbook

Automatic HTTPS is the default. A custom certificate replaces the issued leaf.