Skip to content
HipnoTypePanel

Getting started

The access URL & rotation

How the secret /server/panel/<token>/ URL works, how to rotate it, and what happens to sessions.

Updated Edit this page on GitHub

Every panel install gets a URL like https://hypnotype.mangocloud.cyou/server/panel/vDVB3ic7…/. The 32-character suffix is the credential that routes traffic to your VPS — the relay only knows a salted hash of it, and unknown tokens return a byte-identical 404 so URLs cannot be enumerated.

How traffic flows

  1. 1Your VPS opens an outbound WebSocket tunnel to the HipnoType relay (relay.hypnotype.mangocloud.cyou). Nothing listens publicly on the VPS.
  2. 2Your browser talks to the main domain; /server/panel/<token>/* is rewritten to the relay.
  3. 3The relay matches the token hash, finds your tunnel, and proxies the request through it.

Rotating the URL

hypno rotate                # random 32 chars
hypno rotate --custom my-secret-slug-123   # custom slug, 16–64 chars

Rotation is two-phase: the relay activates the new token first; only when the panel commits locally does the old token stop working. A failed commit rolls the relay back — you can never lock yourself out with a half-finished rotation.

  • All active sessions (web + CLI) are revoked on every rotation.
  • The old URL immediately returns the standard 404.
  • Every rotation is written to the audit log (who, when, fingerprints).

Direct mode (own domain, own TLS)

If you do not want the relay in your traffic path, the panel supports direct mode: it serves its own certificate on port 443 under a domain you control, keeping the same secret-path model. See the relay trust model.