# Docs

- [Introduction](/docs): What Customdomain is, the connect → secure → serve → monitor loop, and where to go next.
- Getting started
  - [Quickstart](/docs/getting-started/quickstart): Connect your first custom domain end to end in about five minutes.
- Guides
  - [How to set up a custom domain](/docs/guides/set-up-a-custom-domain): Connect a custom domain to your app end to end — pick the right record, handle the apex, clear CAA and conflicting records, and know when it is actually live.
  - [How to connect a custom domain](/docs/guides/connect-a-custom-domain): Connect a custom domain to your SaaS product — what the CNAME points at, why the root domain needs different records, how certificates get issued, and how to tell the difference between "record added" and "actually live".
  - [Serve customer domains from your app (reverse-proxy edge)](/docs/guides/serve-customer-domains-from-your-app): Turn on edge serving so your customers' domains reach your application — what an origin is, how one app serves thousands of domains via X-Forwarded-Host, the difference between a domain resolving and a domain working, and how to debug 421 and 502.
  - [Choosing a custom-domain solution (2026)](/docs/guides/choosing-a-custom-domain-solution): An evaluation guide for custom-domain onboarding — build vs. buy, what "provider coverage" really means, and the questions to ask any vendor including us.
  - [Entri alternative (2026)](/docs/guides/entri-alternative): Evaluating an Entri alternative for custom-domain onboarding — how to compare provider coverage, apex support, certificate handling, propagation visibility and pricing, with the questions that separate vendors that look similar on a feature grid.
- Concepts
  - [Architecture](/docs/concepts/architecture): The two independent planes that share one database and talk over HTTP.
  - [Connections](/docs/concepts/connections): The connection lifecycle, the authoritative record set, tenancy, and drift.
  - [Setup types & the ask gate](/docs/concepts/ownership-and-setup-types): How a domain is classified, the four connect rails, and the status-based edge authorization gate.
- Authentication
  - [Overview](/docs/authentication/overview): The three credential types, member roles, and the unauthenticated surfaces.
  - [Widget tokens](/docs/authentication/widget-tokens): Minting short-lived JWTs via POST /v1/tokens for the browser widget.
- Connect flow
  - [Overview](/docs/connect-flow/overview): The create → apply → live pipeline and the four rails that write DNS.
  - [Create a connection](/docs/connect-flow/create-a-connection): POST /v1/connections — the request, the idempotent replay, and the record set it returns.
  - [Apply records & go live](/docs/connect-flow/verify-and-go-live): The three automatic rails, the manual fallback, propagation to live, and cert issuance.
  - [Domain forwarding](/docs/connect-flow/forwarding): Redirect a connected domain to another URL, or send the apex to www, with a 301 issued at the edge.
  - [Managed connections](/docs/connect-flow/managed-connections): Opt a connection into managed mode so the control plane can silently re-apply and revert its records with a stored, encrypted grant.
  - [Offboarding](/docs/connect-flow/offboarding): Disconnect a domain with DELETE /v1/connections/{id} — the platform reverts a managed template, then deletes the connection.
- DNS
  - [DNS providers](/docs/dns/providers): The built-in auto-write fleet, the connect rails, and the parity census.
  - [Provider setup](/docs/dns/provider-setup): Exactly what to do at each DNS provider to create the credential its adapter needs.
  - [Email DNS & SPF merge](/docs/dns/email-dns): Adding MX/SPF/DKIM/DMARC alongside a connection, and how SPFM merges SPF safely.
- Sell
  - [Buying a domain](/docs/sell/buying-a-domain): The money-safe purchase flow — authorize, register, then capture — and how a purchased domain becomes a managed, connected domain.
- Webhooks
  - [Overview](/docs/webhooks/overview): Register HTTPS endpoints to receive signed events as connections progress.
  - [Verifying signatures](/docs/webhooks/verifying-signatures): HMAC-SHA256 signature verification and replay protection.
- API reference
  - [API reference](/docs/api-reference): Base URL, auth schemes, versioning, the error envelope, and the full generated operation reference.
  - Tokens
    - [Exchange application credentials for a short-lived widget JWT](/docs/api-reference/tokens/createWidgetToken)
  - Domains
    - [Detect where a domain's DNS lives and how it will be set up](/docs/api-reference/domains/checkDomain)
  - Connections
    - [Create a domain connection (idempotent per app + domain)](/docs/api-reference/connections/createConnection)
    - [Create connections for a set of domains in one call](/docs/api-reference/connections/bulkCreateConnections)
    - [List connections](/docs/api-reference/connections/listConnections)
    - [Count the tenant's connections (no rows)](/docs/api-reference/connections/countConnections)
    - [Get a connection with its authoritative record set](/docs/api-reference/connections/getConnection)
    - [Disconnect a domain (revert managed records, then delete the connection)](/docs/api-reference/connections/disconnectConnection)
    - [Authoritative desired DNS record set for a connection](/docs/api-reference/connections/getConnectionRecords)
    - [Write a connection's records through the customer's provider (BYO token, used once)](/docs/api-reference/connections/applyConnection)
    - [Re-apply a managed connection's desired records (async one-click, no re-consent)](/docs/api-reference/connections/reapplyConnection)
    - [Check a connection's DNS now, and report what public DNS answered](/docs/api-reference/connections/recheckConnection)
    - [Turn managed mode OFF without disconnecting](/docs/api-reference/connections/disableManagedConnection)
    - [Begin the OAuth-into-DNS-provider authorization for a connection](/docs/api-reference/connections/startConnectionOAuth)
    - [OAuth redirect target (public; authenticated by the signed state)](/docs/api-reference/connections/oauthCallback)
    - [Async one-click setup redirect target (public; authenticated by the signed state)](/docs/api-reference/connections/dcCallback)
    - [Build the one-click apply URL (sync) or start the managed async rail](/docs/api-reference/connections/startDomainConnect)
  - Secure
    - [Read the mirrored TLS certificate status for a connection's domain](/docs/api-reference/secure/getConnectionCertificate)
    - [Whether a certificate can be issued for this connection yet](/docs/api-reference/secure/getConnectionCertificateEligibility)
    - [Record intent to issue an edge-managed certificate](/docs/api-reference/secure/provisionConnectionCertificate)
    - [Mark a connection's certificate for renewal](/docs/api-reference/secure/renewConnectionCertificate)
    - [Record an operator-supplied (externally obtained) certificate's metadata](/docs/api-reference/secure/importConnectionCertificate)
    - [Deprovision a connection's certificate (drop the mirror, stop managing)](/docs/api-reference/secure/deprovisionConnectionCertificate)
    - [List the certificates tracked for the caller's application](/docs/api-reference/secure/listCertificates)
  - Power
    - [Read a connection's Power (edge reverse-proxy) configuration](/docs/api-reference/power/getConnectionPower)
    - [Whether Power can be enabled for this connection yet](/docs/api-reference/power/getConnectionPowerEligibility)
    - [Enable Power — register the origin + redirect/root-path config](/docs/api-reference/power/enableConnectionPower)
    - [Update an existing Power configuration](/docs/api-reference/power/repowerConnection)
    - [Remove Power — drop the origin, clear config, tear down the cert](/docs/api-reference/power/disableConnectionPower)
    - [List the caller app's powered connections](/docs/api-reference/power/listPoweredConnections)
  - Sharing
    - [Mint a share link that resumes a connect flow from a server-side prefill](/docs/api-reference/sharing/createSharedFlow)
    - [Read a share link's server-side prefill (token is the bearer credential)](/docs/api-reference/sharing/getSharedFlow)
  - Applications
    - [Create an application (client_secret returned once)](/docs/api-reference/applications/createApplication)
    - [List applications](/docs/api-reference/applications/listApplications)
    - [Get an application](/docs/api-reference/applications/getApplication)
    - [Issue an API key for an application (key returned once)](/docs/api-reference/applications/createApiKey)
    - [List an application's API keys (secrets omitted)](/docs/api-reference/applications/listApiKeys)
    - [Revoke an API key](/docs/api-reference/applications/revokeApiKey)
  - Members
    - [Invite a member to the caller's tenant (invite_token shown once)](/docs/api-reference/members/inviteMember)
    - [List the caller tenant's members](/docs/api-reference/members/listMembers)
    - [Accept an invite (single-use token)](/docs/api-reference/members/acceptMember)
    - [Change a member's role (owner-protected)](/docs/api-reference/members/updateMemberRole)
    - [Remove a member or revoke a pending invite (owner-protected)](/docs/api-reference/members/removeMember)
  - Tenancy
    - [Create a tenant](/docs/api-reference/tenancy/createTenant)
    - [Get a tenant](/docs/api-reference/tenancy/getTenant)
    - [One-call signup provisioning (tenant + owner + app + API key)](/docs/api-reference/tenancy/provisionTenant)
  - Providers
    - [List the DNS providers the Connect engine can detect and automate](/docs/api-reference/providers/listProviders)
    - [Full parity census — every target provider routed to its working mode](/docs/api-reference/providers/providerCensus)
    - [Enumerate the connectable domains a provider credential controls](/docs/api-reference/providers/listProviderZones)
  - Templates
    - [List one-click setup service templates](/docs/api-reference/templates/listTemplates)
    - [Get one setup template](/docs/api-reference/templates/getTemplate)
    - [Build the one-click apply URL for a domain](/docs/api-reference/templates/buildTemplateApplyUrl)
  - Registrar
    - [Search domain availability and pricing](/docs/api-reference/registrar/searchDomains)
    - [Cheapest real-time price for a domain](/docs/api-reference/registrar/quoteDomain)
    - [Register a domain (fail-closed; requires Idempotency-Key)](/docs/api-reference/registrar/purchaseDomain)
    - [Start an embedded payment to buy a domain at retail](/docs/api-reference/registrar/startDomainCheckout)
    - [Finalize a domain purchase after the embedded payment completes](/docs/api-reference/registrar/fulfillDomainPurchase)
    - [Read a persisted domain-purchase order's status by id](/docs/api-reference/registrar/getSellOrder)
  - Monitor
    - [Check declared baseline records against live public DNS](/docs/api-reference/monitor/checkRecords)
  - Webhooks
    - [Register a webhook endpoint (secret returned once)](/docs/api-reference/webhooks/createWebhook)
    - [List webhook endpoints](/docs/api-reference/webhooks/listWebhooks)
    - [Delete a webhook endpoint](/docs/api-reference/webhooks/deleteWebhook)
    - [Recent webhook delivery attempts for the caller's tenant](/docs/api-reference/webhooks/listWebhookDeliveries)
  - Billing
    - [Public plan catalog (plus billing {configured, mode})](/docs/api-reference/billing/listPlans)
    - [Metered domain usage, plan, and quota for the caller's tenant](/docs/api-reference/billing/getUsage)
    - [Start a Stripe Checkout session for a self-serve plan](/docs/api-reference/billing/createCheckout)
    - [Open a Stripe Billing Portal session](/docs/api-reference/billing/createPortalSession)
  - Enterprise
    - [Role / permission matrix (static reference)](/docs/api-reference/enterprise/getRbac)
    - [Audit log (tenant-scoped for tenant credentials; full log for the management key)](/docs/api-reference/enterprise/getAudit)
  - Meta
    - [Public service discovery — advertised products and version](/docs/api-reference/meta/getConfig)
- Widget SDK
  - [Overview](/docs/widget-sdk/overview): A drop-in "Connect your domain" modal, gated by a widget JWT, with no keys in the browser.
  - [Installation & embed](/docs/widget-sdk/installation-and-embed): Install customdomain-js, mint a widget token server-side, and open the modal.
  - [Reference](/docs/widget-sdk/reference): The seven methods, the eight window events and callbacks, full config, statuses, and theming tokens.
- MCP
  - [MCP server](/docs/mcp/overview): The Model Context Protocol server — twelve domain tools an AI agent can call over JSON-RPC, its transports, and its auth.
- Agents
  - [Agent access](/docs/agents/overview): Human-first delegated access — how an AI agent gets a scoped, revocable grant to act on your domains through the MCP.
  - [The OAuth flow](/docs/agents/oauth-flow): The agent authorization endpoints — DCR, authorize + PKCE, consent, token, refresh, revoke — plus JWKS and RFC 8414 discovery.
  - [Managing access](/docs/agents/managing-access): The owner side — approving a grant, spend caps and purchases, owner emails, and revoking access from the console.
- Security
  - [Overview](/docs/security/overview): Tenancy, credential model, value-checked DNS, one-time provider tokens, and the unauthenticated surfaces.
- Billing
  - [Plans & quotas](/docs/billing/plans-and-quotas): The plan catalog, metered domain usage, and Stripe checkout.
- Self-hosting
  - [Configuration](/docs/self-hosting/configuration): Optional observability environment variables for self-hosted deployments — all opt-in, no-op when unset, and repointable to your own backends.
- [Reference](/docs/reference): Enums, environment variables, error codes, and other lookup tables.
- [Troubleshooting](/docs/troubleshooting): Common failure modes — stuck connections, propagation delays, rail errors, and drift.
- [FAQ](/docs/faq): Short answers to common questions about connecting domains.
- [User journeys](/docs/user-journeys): Every user-facing flow and the surface that implements it.
- [Changelog](/docs/changelog): How the product and API change over time.