Custom domains

api.yourcompany.com in front of a proxy, certificate included.

Claim the hostname on the proxy's page and you are given two DNS records:

api.yourcompany.com.               CNAME  amber-heron.openapi-proxy.com.
_apip-verify.api.yourcompany.com.  TXT    "<a token, shown to you>"

We poll until both resolve. Verification, certificate issuance and renewal follow on their own - usually minutes once the records are live.

Verification always precedes issuance

The TXT record is not a formality and it is not skippable. A service that issues certificates for hostnames without proving they belong to the person asking is a service that has become somebody else's phishing infrastructure, and it only has to happen once.

The key

The private key is sealed before it touches our database, so a dump of the database alone cannot produce a servable certificate. It is unsealed only in the path that hands it to the edge that terminates TLS.

Removing a domain revokes the certificate and drops the hostname from the fleet on its next poll.

Renewal

Automatic, and it does not loop. If the certificate authority rate-limits us, we record when we may try again and wait - their limits are per account, and a retry storm from one customer's domain would spend everybody's budget.

Plans

Custom domains start on the Starter plan: one there, five on Team, unlimited on Business. The pricing page has the table.