Learn
From the app to a WireGuard node.
The browser and the Windows app talk to the public API. The API talks to the control plane. The control plane talks to the node. You never receive a server private key.
- You sign in. The session cookie stays on this site.
- The device creates a WireGuard keypair and registers the public key.
- Quick Connect, or a city you pick, asks for an eligible server.
- The API returns a client config: your private key, the server public key, the endpoint, and an address in 10.80.0.0/16.
- WireGuard brings the tunnel up. Heartbeats from the node tell the control plane whether that server is still healthy.