The Throne Room

What it is

The Throne Room publishes private applications behind Zipper identity. Only signed-in teammates can reach them; the public internet never sees the origin.

Cloudflare analogue: Cloudflare Access (Zero Trust). SLA 99.95% · p99 70ms. Admins attach apps. Operators review grants.

• ▸Identity-aware proxy
• ▸Device posture hooks
• ▸Short-lived grants
• ▸Audit trail

How it works

Attach an internal app and an email allow-list. The origin is never on the public internet.

MFA can be required per app. Every grant is written to Watchtower when audit-every-grant is on.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → The Throne Room. Attach application + allowed emails.

API

Control-plane: GET|POST|DELETE /api/v1/throne/apps. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS https://tinyzipper.com/api/v1/services/throne \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN"

const res = await fetch("https://tinyzipper.com/api/v1/throne/apps", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Do not also publish the origin on a public A record.

• ▸SOC 2
• ▸SSO-ready
• ▸MFA

Runbook

Do not expose the origin publicly. Require MFA on every grant. Log each admission.