Public Web Endpoints

By default a function is invoked with a project API key, which keeps it private to your project. A public web endpoint opts a function into a URL that anyone on the internet can call without a project key — the right shape for webhooks (GitHub, Stripe, and the like), browser callers, and third-party integrations that can't hold your API key. You enable it per function, and can optionally protect it with a per-function bearer token so only callers who know the token can invoke it.

Enabling a public endpoint

Turn on the public endpoint with set_public. When you enable it with a token requirement, Daytona mints a bearer token and returns it once — store it, because it isn't retrievable again. Without a token requirement, the endpoint is open to anyone who knows the URL.

from rlp import Daytona
 
daytona = Daytona()
 
# Enable a public endpoint protected by a bearer token.
result = daytona.fn.set_public("webhook", enabled=True, require_token=True)
print(result["url"])    # /fn/<project>/webhook
print(result["token"])  # shown once — store it now

import { Daytona } from '@rlp/sdk'
 
const daytona = new Daytona()
 
const result = await daytona.fn.setPublic('webhook', true, true)
console.log(result.url, result.token) // token shown once

curl -X POST https://api.rl.trydaytona.com/fns/webhook/public \
  -H "Authorization: Bearer $RLP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "enabled": true, "require_token": true }'

The response reports the public url, whether it requires_token, and the token (present only when you enabled the token requirement). To disable the endpoint again, call with enabled: false.

Calling the public URL

A public endpoint is invoked at POST https://api.rl.trydaytona.com/fn/:project/:name — with no project API key. If the endpoint requires a token, the caller passes it as a bearer token. The request body is forwarded to the handler as POST /, and the handler's response comes back, exactly like a keyed invoke.

curl -X POST https://api.rl.trydaytona.com/fn/<project>/webhook \
  -H "Authorization: Bearer <function-token>" \
  -H "Content-Type: application/json" \
  -d '{ "event": "push", "ref": "refs/heads/main" }'

If the endpoint has no token requirement, omit the Authorization header entirely. A wrong or missing token when one is required is rejected, and a function that isn't public returns 404 on the public host — its existence is never revealed there.

Security

A public endpoint exposes your function to the entire internet, so treat it accordingly. Require a token for anything that isn't meant to be world-callable, and rotate it by disabling and re-enabling the endpoint. Keep the handler defensive regardless: validate and authenticate payloads (for webhooks, verify the provider's signature), and don't trust the request body. Public invocations run through the same managed instances, timeouts, and scaling as keyed invocations.

For the full request and response shapes, see the Functions API reference.