If lrok.io is the parent domain, then api.lrok.io and tcp.lrok.io are subdomains. Each can resolve to a different server, point to a different service, and have its own TLS certificate.
Reverse-tunnel services use subdomains for routing. When you run lrok http 3000, you get something like https://violet-mole.lrok.io. The lrok edge sees the Host header on incoming requests and routes them to the correct agent based on the subdomain.
Reserved subdomains are subdomains you claim once and keep. They're useful for webhook integrations because the URL stays stable across restarts — Stripe / GitHub / Auth0 won't drift. lrok includes one reserved subdomain on the free plan; ngrok charges for them on Pro+.