AutoCertify API

What AutoCertify is

AutoCertify turns a domain that shows “Not Secure” into a valid, auto-renewing HTTPS certificate. It requests, validates, installs and renews publicly-trusted TLS certificates through Cloudflare for SaaS Custom Hostnames — there are no keys to generate, no CSRs to sign and no servers to touch. A domain only ever reads active once its certificate is genuinely live.

Everything the dashboard does is available over a REST API, so you can drive certificate lifecycle from your own code — one domain or many thousands.

What you can build

• Secure your own domains. Get a real certificate onto a site your platform won’t secure for you, and never think about renewal again.
• Automate SSL for a fleet. Platforms and agencies provision, validate and monitor certificates for thousands of customer domains over the API — no support tickets, no manual DNS wrangling.
• React to lifecycle events. Subscribe to signed webhooks so your systems know the instant a certificate goes active, renews, or needs attention.

The core model: delegated DCV

A certificate authority must confirm you control a domain before it issues a certificate — this is Domain Control Validation (DCV). AutoCertify uses delegated DCV: you add a single CNAME that points _acme-challenge.<domain> at a Cloudflare DCV target. Because validation is delegated to that record, every future renewal re-validates itself against it — you add the record once and the certificate renews forever, with no further DNS changes.

1. Create a domain and read back its delegation record.
2. Add the one CNAME at your registrar.
3. Verify delegation — a successful check auto-triggers issuance.
4. The certificate goes active (usually within minutes) and auto-renews ahead of expiry.

Base URL

All requests go to https://api.autocertify.net. Authenticated resources live under the /v1/ prefix. Send and receive application/json.

Authentication

Authenticate every request with a bearer token: Authorization: Bearer <token>. Two kinds of token are accepted:

• API keys — ac_live_… keys for server-to-server automation. Create and rotate them in the dashboard; the full key is shown only once at creation.
• Auth0 session tokens — the JWT issued to a signed-in user, verified against Auth0’s JWKS.

API access is a Business Pro or Scale feature. A handful of endpoints — sign-up and the public verification-link views — need no token and are marked Public in the reference.

curl https://api.autocertify.net/v1/domains/dom_8Qp3v1c7 \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN"

Responses & errors

A successful call returns the requested resource (or a small result object) directly, with an appropriate 2xx status — for example, creating a domain returns 201 with the Domain. Errors return a single, predictable envelope:

{
  "status": 400,
  "code": "validation_error",
  "message": "apex must be a valid domain name.",
  "details": [
    { "field": "apex", "issue": "invalid_hostname" }
  ]
}

status mirrors the HTTP status, code is a stable machine-readable string, message is human-readable, and details is present on some errors (for example, field-level issues on a 400 validation_error).

Rate limits

Limits are applied per token in a rolling 15-minute window. Exceeding a bucket returns 429 with the error envelope.

• auth — 20 requests / 15 min (sign-up, session, logout).
• public — 60 requests / 15 min (public verification-link views and checks).
• site-scan — 120 requests / 15 min (domain scanning and health checks).

Next steps

Pick where to go from here: