Skip to main content
Deploying applications on Unkey is in public beta. To try it, select Projects in the dashboard sidebar and create a project. Deployed resources are free until August 1, 2026. We’re eager for feedback, so let us know what you think on Discord, X, or email support@unkey.com.
This page walks through every stage a request passes through on its way to your app.

​
DNS

Unkey uses latency-based geolocation routing to resolve both *.unkey.app wildcard domains and custom domains to the closest region to the client.

​
Frontline

The request arrives at Frontline, Unkey’s global network layer. Frontline terminates TLS close to the client, so your app never needs to manage certificates. All connections enforce TLS 1.2 or higher, with TLS 1.3 preferred. HTTP requests are redirected to HTTPS automatically. Certificates are provisioned and renewed automatically for both wildcard and custom domains. After terminating TLS, Frontline resolves the requested domain to a deployment. It consults a globally replicated metadata store that maps every domain to a deployment ID. If the target deployment runs in a different region, Frontline forwards the request to that region automatically.

​
Gateway

Once it resolves the deployment, Frontline runs the gateway, which evaluates the policies configured for that deployment before the request reaches your code: Requests that fail a policy receive an error response and never reach your app. After every policy passes, the gateway forwards the request to a healthy instance of your deployment in the same region. The response flows back through Frontline to the client.

​
Request headers

Frontline adds headers to every proxied request so your app can identify the original client and request context:
Last modified on June 24, 2026