# Kepeink

Kepeink makes self-hosted apps reachable over HTTPS without port
forwarding. An outbound-only agent on the customer's machine holds a
tunnel open to Kepeink's router plane, which serves the public HTTPS
route.

This is the marketing site (kepeink.hu). It has no API of its own —
sign-up, tunnel management, billing, and abuse reporting are all done
through the management API at https://manage.kepeink.hu (see References
below for the LLM-facing docs).

This host also serves end-user documentation at /docs (see https://kepeink.hu/docs).
For programmatic use, prefer the management API references over scraping
the marketing docs.

## Quickstart for LLM agents (minimum viable tunnel)

Prereqs: a Kepeink API key (kpm_… — a human creates it in the dashboard
under Account & activity → Access tokens). Pass it as
Authorization: Bearer kpm_… on every management API call. Every curl
below sends only that header — no browser cookies, no extra dance.
Agent tokens (kpt_…) are bearer tokens for the tunnel data plane; keep
them out of prompts.

1. Verify the key + inspect auth context:
   curl -fsS https://manage.kepeink.hu/api/v1/me      -H "Authorization: Bearer $KEPEINK_API_KEY"
2. Create a tunnel (proxy mode — target must be reachable FROM the agent host):
   curl -fsS -X POST https://manage.kepeink.hu/api/v1/tunnels      -H "Authorization: Bearer $KEPEINK_API_KEY"      -H "Content-Type: application/json"      -d '{"target":"http://localhost:3000","backend_mode":"proxy"}'
   Response contains { tunnel_id, sni, public_url, agent_token } —
   agent_token is shown once (kpt_…); save it immediately.
3. Run the agent with that token (pick one):
   Host service: curl -fsSL https://cdn.kepeink.hu/install.sh | sudo sh -s -- --token=kpt_…
   Docker (same compose project as target): image registry.kepeink.hu/agent:2, env KEPEINK_AGENT_TOKEN=kpt_…, network so http://<service>:<port> resolves
   Foreground: curl -fsSL https://cdn.kepeink.hu/run.sh | sh -s -- --token=kpt_…
4. Verify public routing:
   curl -fsS https://<sni>/
Exact JSON shapes, roles, and error codes are in /openapi.json. Full
tunnel options (proxy vs static vs ssh, target formats, agent_config)
are in https://kepeink.hu/llms-full.txt (same content as
https://manage.kepeink.hu/llms-full.txt; use whichever host you already
have). When the local service is on a different host
than the agent, the target can be any http(s)://<lan-host>:<port>.

## Agent Rules

- Sign up and manage tunnels entirely through the management API at
  https://manage.kepeink.hu. Start there: https://manage.kepeink.hu/llms.txt
- The agent token (kpt_…) is separate from the API key (kpm_…): API key
  manages tunnels; agent token authenticates the data plane.
- Report abuse of a hosted tunnel: https://manage.kepeink.hu/report
- Public infrastructure status: https://status.kepeink.hu/llms.txt

## References

- Full agent guide (same host): https://kepeink.hu/llms-full.txt
- Management API quickstart + full agent guide: https://manage.kepeink.hu/llms-full.txt
- OpenAPI description: https://manage.kepeink.hu/openapi.json
- MCP/WebMCP tool annotations: https://manage.kepeink.hu/.well-known/mcp-tools.json
- Docs index (human tutorials + use cases, also used by onboarding intents): https://kepeink.hu/docs
- Docker agent tutorial: https://kepeink.hu/docs/run-the-agent-with-docker
- End-to-end TLS tutorial: https://kepeink.hu/docs/end-to-end-tls