# Enabling the public namespace

> Turn on token-less, ephemeral claims under one designated subdomain.

The public namespace lets anyone claim a public route under one designated label
without a token. It is how the hosted `routeup.dev` offers token-less URLs under
`*.try.routeup.dev`.
It is **off by default** on self-hosted servers.

## Enable it

Pick a label and pass it when starting the server:

```bash
routeup server --domain tunnel.example.com \
  --public-namespace try \
  --reserved edge
```

Add `*.try.tunnel.example.com` to DNS. In static certificate mode, the supplied
certificate must also cover `*.try.tunnel.example.com`.

Now clients can claim under `try.tunnel.example.com` without a token:

```bash
routeup serve --random --port 8080 --server https://edge.tunnel.example.com --expose
# -> https://happy-fox.try.tunnel.example.com

routeup serve demo --port 8080 --server https://edge.tunnel.example.com --expose
# -> https://demo.try.tunnel.example.com
```

The chosen label is automatically added to the reserved-subdomain list so no
token holder can claim it at the root tier.

## Semantics

Public-namespace claims are deliberately lightweight:

```txt
session-only      released as soon as the client disconnects
no grace window   no 30s resume; the name frees immediately
no persistence    nothing is stored across restarts
first-come        a held name returns 409; --random generates a client-side name
```

## Disable it

Omit the flag when no config enables it, or remove/set `public_namespace` to an
empty string in `routeup-server.json`. With it disabled, every public claim
requires a [token](/docs/self-hosting/minting-tokens), and token-less claims are
refused.

## Abuse considerations

With no token to attribute claims to, anonymous limits protect claim creation.
Configure `rate_limit.anon_rate` and `rate_limit.anon_burst` in
`routeup-server.json` before enabling the namespace on an internet-facing server.