Control Plane

The control plane issues identity, publishes JWKS for edge token verification, stores account/team data, exposes account APIs, lists live tunnels and edges, and receives edge liveness/metering.

It is optional for self-hosted key-mode public/password/IP-token routes. It is required for account-private visitor identity and cross-device managed views.

It does not sit on the visitor request path.