Visitor Queue

What it is

Visitor Queue is Zipper’s waiting room — it sits in front of your site on protected paths. When a path runs over its limit, extra visitors land on a holding page carrying your own brand: headline, message, accent colour, logo, their position in line, and an estimated wait. An admissions-per-minute cap paces the door so the origin sees a trickle instead of a stampede. A bot screen guards the line: real browsers queue normally, automation must solve a one-second proof-of-work, and hostile traffic — scanners, exploit probes, failed proofs — is held in a penalty box for a cool-off window. Signed-in teammates can skip the line.

Cloudflare analogue: Cloudflare Waiting Room. SLA 99.99% · p99 12ms. Operators tune the budget, pacing, and branding. Admins attach queues to paths.

• ▸Branded holding page (headline, message, accent, logo)
• ▸Position + estimated wait
• ▸Admissions per minute pacing
• ▸Bot screen with proof-of-work
• ▸Penalty box for hostile IPs
• ▸Bypass for teammates
• ▸Protects origin

How it works

When concurrent origin sessions exceed the budget, extra visitors see a branded holding page with their position and estimated wait. Each room carries its own headline, message, accent colour, and logo.

An admissions-per-minute cap paces new seats during a surge, so origin intake stays flat while the line drains.

The bot screen guards the line: normal browsers queue, automation solves a one-second proof-of-work, and hostile traffic (scanners, exploit probes, repeated failed proofs) is held in a penalty box for a cool-off window. Signed-in operators can bypass. Attach one queue per path.

Use cases

Concrete ways teams use this service on day one.

Set it up in the dashboard

Dashboard → Services → Visitor Queue. Name, path, seats (0 = budget), admits/min, headline, message, logo URL, accent colour, progress bar, live switch.

API

Control-plane: GET|POST /api/v1/waiting. Send Authorization: Bearer tz_live_YOUR_TOKEN.

Creates count against the plan quota. A 402 plan_limit means you are at the cap — upgrade or delete an unused resource.

curl -sS -X POST https://tinyzipper.com/api/v1/waiting \
  -H "Authorization: Bearer tz_live_YOUR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{"name":"Checkout","path":"/checkout","queue_size":0,"admit_per_minute":600,"headline":"High demand — thanks for waiting"}'

const res = await fetch("https://tinyzipper.com/api/v1/waiting", {
  method: "GET",
  headers: {
    Authorization: `Bearer ${process.env.ZIPPER_TOKEN}`,
    "Content-Type": "application/json"
  }
});
const json = await res.json();
if (!res.ok) throw new Error(json.error ?? res.statusText);
console.log(json);

Tips

Set the budget to measured origin capacity, not a guess. Watchtower shows queue depth.

Screen strictness and the penalty-box hold length are Visitor Queue settings; Balanced + 30 minutes is the sane default.

• ▸SOC 2
• ▸Queue fairness

Runbook

Set the session budget to origin capacity and the admits/min cap to the intake rate the origin can absorb. Brand the holding page (headline, message, accent, logo) so the line still looks like the site. Leave the bot screen on Balanced — hostile IPs cool off in the penalty box for the IP-hold minutes. Bypass only signed-in operators.