Turn on or rotate the origin secret

POST /v1/origin-secret

Generates a new origin secret for your workspace, replacing any existing one. From then on every request we proxy to your origins carries it in the x-domainee-origin-secret header. See Verifying requests came through Domainee for how to check it.

The secret is returned only in this response. Store it in your secret manager before closing.

Request

curl -X POST https://api.domainee.dev/v1/origin-secret \
  -H "Authorization: Bearer $DOMAINEE_API_KEY"

No body.

Response: 200 OK

{
  "enabled": true,
  "originSecret": "dos_aBcDeF…"
}

Rotating

Calling this again replaces the secret. The edge picks up the new value within about a minute, so for a minute or two some requests still carry the old one. Accept both values on your origin, rotate, then drop the old value.