Status Pages

Custom Domain Configuration

You can host your status pages on a custom domain by configuring the APP_STATUS_PAGE_DOMAIN environment variable.

Setup Steps

You can only have slugs on this domain. If you want a status page without a slug you need to use a different domain

Configure Environment Variable

Add the following to your .env file:

APP_STATUS_PAGE_DOMAIN=status.example.com

Replace status.example.com with your desired status pages domain.

Configure DNS

Point your custom domain to your UptimeKit installation:

Add an A record pointing to your status-page server’s IP address

Restart Application

Restart your UptimeKit instance to apply the changes:

docker compose down
docker compose up -d

If you don’t configure a custom domain, status pages will be accessible via the default the domain reverse proxying the status page.

Slug-Based Routing

Each status page can have a unique slug that makes it accessible via a clean URL path.

How It Works

When you create or edit a status page, you can set a custom slug in the status page settings. The slug will be used in the URL:

https://status.example.com/your-slug

Best Practices

Use lowercase letters, numbers, and hyphens
Keep slugs short and memorable
Use descriptive names (e.g., api, website, services)
Avoid special characters or spaces

Slugs must be unique across all status pages in your UptimeKit instance.

JSON Status Summary

Every public status page exposes a read-only JSON summary that can be fetched from the browser without an API key, for example to show a banner in your own app when an incident or maintenance is in progress.

https://status.example.com/summary.json
https://status.example.com/your-slug/summary.json

The response includes the overall page status, the status of each component (monitor) on the page, and incidents and maintenances that are active, upcoming, or were resolved within the last 24 hours. Only data that is already visible on the status page is included.

{
    "page": { "id": "...", "name": "Example", "url": "https://status.example.com/" },
    "status": "maintenance",
    "updatedAt": "2026-10-20T19:00:00.000Z",
    "components": [
        { "id": "3f2c9a1e-...", "name": "API", "group": "Core", "status": "maintenance" }
    ],
    "incidents": [],
    "maintenances": [
        {
            "id": "...",
            "title": "Database upgrade",
            "description": "Short read-only window",
            "status": "in_progress",
            "startAt": "2026-10-20T19:00:00.000Z",
            "endAt": "2026-10-20T20:00:00.000Z",
            "url": "https://status.example.com/incidents/...",
            "componentIds": ["3f2c9a1e-..."]
        }
    ]
}

Field	Values
`status`	`operational`, `degraded`, `outage`, `maintenance`, `unknown`
`components[].status`	`up`, `down`, `degraded`, `maintenance`, `pending`
`incidents[].status`	`investigating`, `identified`, `monitoring`, `resolved`
`incidents[].severity`	`minor`, `major`, `critical`
`maintenances[].status`	`scheduled`, `in_progress`, `completed`

Component IDs are monitor IDs, and componentIds on incidents and maintenances reference them. All timestamps are ISO 8601 in UTC. A page status of unknown means UptimeKit has no health data for it yet, so it should not be treated as operational. The endpoint sends Access-Control-Allow-Origin: * and is cached for 30 seconds. Password-protected status pages return 404.

Password Protection

You can make status pages private by enabling password protection. This is useful for internal status pages or pages with sensitive information.

Enabling Password Protection

Configure Secret Key (Optional)

Optionally add a dedicated secret for status page access tokens to your .env file:

STATUS_PAGE_ACCESS_SECRET=your_secure_secret_here

This environment variable is optional. If not set, UptimeKit will use BETTER_AUTH_SECRET as a fallback. The secret is used to sign session tokens, not for the actual status page passwords (those are set per-page in the dashboard).

To generate a secure secret:

openssl rand -base64 32

Enable Protection in Dashboard

Navigate to your status page settings
Toggle the “Make private” option
Set a password for the status page
Save your changes

Access Protected Page

When users visit your status page, they’ll be prompted to enter the password. After successful authentication, they’ll have access for 24 hours via a secure session token.

Security Features

Password-protected status pages include several security features:

Feature	Description
Argon2id Hashing	Passwords are hashed using Argon2id, a modern password hashing algorithm resistant to GPU and side-channel attacks
Session Tokens	Users receive a 24-hour session token after successful authentication
Rate Limiting	Built-in protection against brute-force attacks
Secure Storage	Passwords are never stored in plain text

Always use strong, unique passwords for protected status pages. Either STATUS_PAGE_ACCESS_SECRET or BETTER_AUTH_SECRET must be configured for password protection to work.

User Authentication Flow

User visits the protected status page URL
UptimeKit displays a password prompt
User enters the status page password
Password is verified against the Argon2id hash
Upon success, a secure session token is issued for 24 hours
User can access the status page without re-authentication during the session period

Example Configuration

Here’s a complete example of status page configuration in your .env file:

# Status Page Configuration
APP_STATUS_PAGE_DOMAIN=status.uptimekit.dev
STATUS_PAGE_ACCESS_SECRET=dGhpcyBpcyBhIHZlcnkgc2VjdXJlIHNlY3JldCBrZXk=  # Optional, falls back to BETTER_AUTH_SECRET

# Dashboard Configuration
BETTER_AUTH_SECRET=change_me_to_a_secure_secret  # Also used as fallback for STATUS_PAGE_ACCESS_SECRET
BETTER_AUTH_URL=http://localhost:3000
NEXT_PUBLIC_URL=http://localhost:3000

Remember to restart your UptimeKit instance after making changes to environment variables.

Getting started

Installation

Configuration

Features

Integrations

Custom Domain Configuration

Setup Steps

Slug-Based Routing

How It Works

Best Practices

JSON Status Summary

Password Protection

Enabling Password Protection

Security Features

User Authentication Flow

Example Configuration

​Custom Domain Configuration

​Setup Steps

​Slug-Based Routing

​How It Works

​Best Practices

​JSON Status Summary

​Password Protection

​Enabling Password Protection

​Security Features

​User Authentication Flow

​Example Configuration

Custom Domain Configuration

Setup Steps

Slug-Based Routing

How It Works

Best Practices

JSON Status Summary

Password Protection

Enabling Password Protection

Security Features

User Authentication Flow

Example Configuration