Getting started

This guide takes a domain from "registered elsewhere" to "served and protected by GreenProxy" in five steps.

1. Create your account

Sign up in the panel, or with the API:

curl -s https://api.greenproxy.cfd/api/v1/auth/signup \
  -H 'Content-Type: application/json' \
  -d '{"email":"you@example.com","password":"a long passphrase","accept_tos":true}'

• Passwords are 12-128 characters and must not be your email address.
• If the platform requires email verification, follow the link we email you (valid 24 hours) before signing in. Lost it? Request a new one from the sign-in page.
• Turn on two-factor authentication or add a passkey straight away under Settings → Security. See API tokens and authentication.

2. Add your domain

Domains → Add domain, then enter the registered domain (example.com, not www.example.com). API: POST /api/v1/domains with {"name": "example.com"}.

• A domain can exist in only one account on the platform. Creating a zone nested under, or above, another account's zone is refused with 409.
• The wizard can scan your current DNS provider and import the records it finds, so the switch-over does not drop anything. See DNS → Importing records.

The domain starts in status pending_ns. Our nameservers already answer for it, so you can check records with dig @ns1.greenproxy.cfd example.com A, but the edge does not proxy it and no certificate is issued until you prove ownership in the next step.

3. Point your registrar at GreenProxy

At your registrar, replace all nameservers with the ones shown on the domain page (normally):

ns1.greenproxy.cfd
ns2.greenproxy.cfd

Remove every other entry: a delegation that mixes providers is not accepted, because resolvers would receive different answers. For Namecheap domains, Apply at registrar does this for you (DNS → Registrar integration).

The platform checks every pending domain's delegation every 5 minutes and activates it as soon as the parent zone lists exactly the expected nameservers. Check now on the domain page (POST /api/v1/domains/{domainId}/ns-check) runs the check immediately; if it fails, ns_warning says why, for example missing ns2.greenproxy.cfd.

Activation cannot be done by hand: it happens only when the delegation is verified.

4. Add records

A typical website:

curl -s -X POST https://api.greenproxy.cfd/api/v1/domains/7/records \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"type":"A","name":"@","ttl":300,"proxied":true,"origin_ip":"203.0.113.10"}'

Changes reach every nameserver and edge within about 15 seconds.

Proxied or DNS-only

Only A and AAAA records can be proxied. A proxied record carries the server address in origin_ip (or an origin pool) instead of value; the address is shown only to you. Optional per-record settings:

• origin_port — the port the edge connects to (default 80, or 443 with Full (strict) origin TLS).
• origin_host — the Host header sent to your server. Useful when a wildcard record points at shared hosting that only knows your main hostname.

Loopback, link-local and GreenProxy's own addresses are refused as origins; private ranges are refused unless enabled for your account.

5. Secure it

HTTPS works without configuration: the edge obtains a certificate the first time a visitor connects, redirects HTTP to HTTPS and sends HSTS. Next:

1. Lock down your origin so nobody can bypass the edge by connecting to your server's IP directly — Proxy and SSL → Origin protection.
2. Turn on bot protection and review the managed WAF level — Security.
3. Invite your team with the right roles — Team and access.
4. Set up alerts for attacks and downtime — Alerts and webhooks.

Domain status

Pause or resume on the domain's Settings tab (PUT /api/v1/domains/{id} with {"status": "paused"} or "active" for an already verified domain). Deleting a domain removes its records and every rule attached to it. A domain paused by the platform ("admin_hold": true) cannot be resumed or deleted from your side (403, "code": "admin_hold"); contact support.