Security

Auth tokens

Set AUTH_TOKEN on the server to require all agents to authenticate. Without a valid token, agents get ERR invalid or missing token and are disconnected.

server — environment variable

AUTH_TOKEN=a-long-random-string-here

agent — flag or env var

# flag
macha --port 3000 --subdomain myapp --token a-long-random-string-here

# env var
MACHA_TOKEN=a-long-random-string-here macha --port 3000 --subdomain myapp

Security note: Tokens are sent in plain text over the control channel. Always pair AUTH_TOKEN with TLS on ports 9000/9001 in production.

Rate limiting

The server applies two independent rate limits automatically — no configuration needed.

Per-subdomain request limit

Each subdomain has a token bucket: capacity 200, refill rate 100/second. Requests that exceed this are rejected with HTTP 429 Too Many Requests without reaching the agent. This protects against a single tunnel overwhelming the server.

Per-IP registration limit

Each unique IP address can register at most 5 subdomains per minute. Attempts beyond this are rejected with ERR too many registration attempts. This prevents automated subdomain squatting.

Reserved subdomains

The following subdomains cannot be registered — they are permanently blocked:

api, www, admin, root, mail, server, dashboard, status, health,
macha, app, staging, prod, beta, static, assets, cdn, auth,
login, signup, register, support, help, docs, blog, dev, test

Any attempt to register one of these returns ERR reserved subdomain.