Mint a secure HTTPS endpoint for your agents.
Each on its own dedicated domain.
One API call, and you have a hostname that resolves and a certificate that stays current, on a domain no other customer is on. No domain to buy, no zone to configure, no person in the loop.
For sandboxes, CI previews, containers, devices and agents: anything that comes up, serves for a while, and goes away.
$ curl -X POST https://dnsmint.com/api/v1/hostnames \ -H "Authorization: Bearer $DNSMINT_KEY" \ -d '{"ip": "34.120.50.10"}' { "id": "68ad3a1e9c4b2f0d5e6a7b8c", "hostname": "q7k4m2.a3f9c1-d4e7b8.dev", "status": "pending", "certificate": "self", "created_at": "2026-08-26T08:30:00.000Z" } $ dig +short q7k4m2.a3f9c1-d4e7b8.dev 34.120.50.10
Works with Caddy, Traefik, certbot, lego, cert-manager and acme.sh, on an API key alone, so nothing in your stack changes. Setup for each is on the integrations page.
The runtime is ready. The secure URL is not.
Everything that gets a machine a real HTTPS address assumes a person and a horizon of years: someone owns a domain, someone configures DNS, someone keeps a certificate renewed. A sandbox that lives an hour has none of those, and neither does the agent that started it.
The shortcuts each cost you something. A shared magic-DNS domain hands you its blocklist and its certificate limit along with the name. A tunnel puts someone else's network, outage and bill between your users and your machine. A hostname from your platform stays behind when you leave the platform.
A hostname, a domain and a certificate, from one call
$ POST /api/v1/hostnames {"ip": "203.0.113.10"}
The name outlives the machine
The hostname is registered to your account, not derived from the address. When the machine moves, one PUT repoints it and every client that already has the URL keeps working.
Nobody else's problems reach your URL
Your hostnames sit on a dedicated domain, yours alone, on every plan. Your certificate budget is spent by you alone, no stranger's reputation lands on your name, and a browser never sends another tenant's cookie to your hostname.
Nobody can forge an answer for your hostname
A spoofed DNS answer sends a client to somebody else's machine, and nothing about the connection looks wrong from the outside. DNSSEC is what refuses it, and every domain here is signed with its key published at the registry before the domain serves anyone, so a resolver that validates takes no answer but ours. That holds from the first query rather than from whenever somebody remembers to switch it on.
The certificate is renewed before it expires, with nothing running on your side
Point Caddy or certbot at the hostname and a certificate issues in about a minute, including for machines on private networks and for wildcards. Or ask us to hold it: we obtain it, renew it ahead of expiry, and you fetch the current one with a GET. The sandbox can be gone; its certificate is still renewed.
Hand it to your agent
There is no SDK and no integration to write. The whole reference is one plain-text file built to be read by a model, so an agent that can run curl already knows enough. Give it an API key and this prompt.
Give this runtime a public HTTPS hostname using DNSMint. Read https://dnsmint.com/llms-full.txt for the full API, register this runtime's public IP, and set up Caddy to serve HTTPS on the hostname it returns. My API key is in the DNSMINT_API_KEY environment variable.
Works in Claude Code, Codex, Cursor, or any agent that can make an HTTP request.
Running a platform?
Hold as many domains as you have customers, and put each customer on one of their own. They mint under it with a key that reaches nothing else, you never touch a registrar, and the same API that serves one hostname serves the fleet.
Before you sign up
Do I own the domain?
No, and that is what removes the work. We are the registrant, so there is no registrar account to hold, no renewal to miss and no verification step between signing up and a working hostname. The domain is exclusively yours to use for as long as your account runs, and it cannot be transferred out.
Can a machine on a private network use this?
Yes, on every plan. DNS-01 never requires the certificate authority to reach the machine, so an address nothing can route to still gets a publicly trusted certificate.
Is a card required?
Yes, on every plan. Starter's free period and what it costs afterwards are on the pricing page.
What happens if I cancel?
Your plan runs to the end of the period you paid for. After that the hostnames stop resolving, their certificates are revoked, the domain is not renewed, and because the hostnames live on a domain we hold there is no way to take them with you.
Mint your first hostname
Sign in, pick a plan, create an API key. The first hostname is one POST away. Month to month.