Quickstart

This walkthrough uses curl and a single domain, shop.example.com. You’ll create the domain, add one DNS record, verify it, and watch the certificate go active. The whole path usually takes a few minutes.

1. Get an API key

Open the dashboard and create an API key under Settings → API keys. Keys look like ac_live_… and are shown in full only once, so copy it somewhere safe. API access requires Business Pro or Scale. Export it so the rest of the commands can use it:

# Paste the ac_live_… key you created in the dashboard.
export AUTOCERTIFY_TOKEN="ac_live_9c1f4a2b7e6d0583a1c2"

2. Create a domain

Register the hostname you want to secure. AutoCertify returns the domain along with the delegationRecord you’ll add to DNS.

curl -X POST https://api.autocertify.net/v1/domains \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "apex": "shop.example.com" }'

{
  "id": "dom_8Qp3v1c7",
  "apex": "shop.example.com",
  "status": "pending",
  "validationStatus": "pending",
  "delegationRecord": {
    "type": "CNAME",
    "host": "_acme-challenge.shop.example.com",
    "value": "shop.example.com.a1b2c3d4.dcv.cloudflare.com",
    "ttl": 300
  },
  "tags": [],
  "createdAt": "2026-02-04T18:22:10Z"
}

The same call from Node using fetch:

const res = await fetch("https://api.autocertify.net/v1/domains", {
  method: "POST",
  headers: {
    Authorization: "Bearer " + process.env.AUTOCERTIFY_TOKEN,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ apex: "shop.example.com" }),
});

const domain = await res.json();
console.log(domain.delegationRecord);
// { type: "CNAME", host: "_acme-challenge.shop.example.com",
//   value: "shop.example.com.a1b2c3d4.dcv.cloudflare.com", ttl: 300 }

3. Add the CNAME at your registrar

Copy the delegationRecord from the response into your DNS provider. It’s a single CNAME that points _acme-challenge.shop.example.com at the Cloudflare DCV target — the one record that lets AutoCertify prove control and re-validate every future renewal.

Type    CNAME
Name    _acme-challenge.shop.example.com
Value   shop.example.com.a1b2c3d4.dcv.cloudflare.com
TTL     300

Use a low TTL of 300 seconds so changes propagate quickly. You add this record once; you never have to touch it again. Prefer to hand it off? Create a verification link (see the API reference) and your DNS admin adds it without account access.

4. Verify delegation

Once the record is live, ask AutoCertify to check it. A successful verification auto-triggers certificate issuance — you don’t need a separate issue call.

curl -X POST https://api.autocertify.net/v1/domains/dom_8Qp3v1c7/verify-delegation \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN"

{
  "status": "verified",
  "checkedAt": "2026-02-04T18:41:52Z",
  "message": "Delegation confirmed. Certificate issuance has started.",
  "certificate": {
    "certificateId": "crt_5Nb2Kq9w",
    "status": "pending",
    "nextRenewalAt": null,
    "message": "Issuance started via Cloudflare for SaaS."
  }
}

If the record isn’t visible yet, status comes back as pending with a message explaining what’s missing. DNS can take a little while to propagate — wait a moment and call it again.

5. Poll certificate status

Fetch the certificate by the certificateId from the previous step and poll until status becomes active.

curl https://api.autocertify.net/v1/certificates/crt_5Nb2Kq9w \
  -H "Authorization: Bearer $AUTOCERTIFY_TOKEN"

{
  "id": "crt_5Nb2Kq9w",
  "domainId": "dom_8Qp3v1c7",
  "status": "active",
  "issuer": "Cloudflare for SaaS Managed CA",
  "notBefore": "2026-02-04T18:43:07Z",
  "notAfter": "2026-05-05T18:43:07Z",
  "nextRenewalAt": "2026-04-21T00:00:00Z"
}

The certificate is DV and publicly-trusted, issued via Cloudflare for SaaS. notAfter is the expiry and nextRenewalAt is when AutoCertify will renew it automatically — comfortably ahead of expiry.

6. You’re done — it renews itself

That’s the whole job. The “Not Secure” warning disappears, the site loads over trusted HTTPS, and from here the certificate renews automatically against the record you already added. There’s nothing else to run.

Rather than polling in step 5, subscribe to webhooks and let AutoCertify tell you the instant the certificate goes active or ever needs attention. For every endpoint and object shape, see the API reference.