Origin Connect

What it is

Origin Connect keeps the origin off the public internet. A small connector in your network dials Zipper outbound; The Throne Room and The Crown then publish the hostname. No public IP and no inbound firewall holes.

Cloudflare analogue: Cloudflare Tunnel. SLA 99.99% · p99 22ms. Admins register connectors. Operators may rotate them.

• ▸Outbound-only connector
• ▸Hostname routing
• ▸Private origins
• ▸Heartbeat health

How it works

A connector in your network dials Zipper outbound. No inbound firewall hole, no public origin IP.

Heartbeat keeps the connector in rotation. Pair hostnames with The Throne Room or The Crown.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Origin Connect. Register name + hostname. Copy the secret.

API

Control-plane: POST /api/v1/connect/heartbeat. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/connect \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"accra-origin","hostname":"origin.example.com"}'

curl -sS -X POST https://tinyzipper.com/api/v1/connect/heartbeat \
  -H "Authorization: Bearer zip_conn_YOUR_SECRET"

const res = await fetch("https://tinyzipper.com/api/v1/connect/heartbeat", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Treat zip_conn_ secrets like origin passwords. Rotate by creating a new connector.

• ▸SOC 2
• ▸Zero-trust

Runbook

Keep the connector healthy. Pair hostnames with The Throne Room. Never open inbound ports.