Custom domains
api.yourcompany.com in front of a proxy, certificate included.
Claim the hostname on the proxy's page and you are given two DNS records:
api.yourcompany.com. CNAME amber-heron.openapi-proxy.com.
_apip-verify.api.yourcompany.com. TXT "<a token, shown to you>"
We poll until both resolve. Verification, certificate issuance and renewal follow on their own - usually minutes once the records are live.
Verification always precedes issuance
The TXT record is not a formality and it is not skippable. A service that issues certificates for hostnames without proving they belong to the person asking is a service that has become somebody else's phishing infrastructure, and it only has to happen once.
The key
The private key is sealed before it touches our database, so a dump of the database alone cannot produce a servable certificate. It is unsealed only in the path that hands it to the edge that terminates TLS.
Removing a domain revokes the certificate and drops the hostname from the fleet on its next poll.
Renewal
Automatic, and it does not loop. If the certificate authority rate-limits us, we record when we may try again and wait - their limits are per account, and a retry storm from one customer's domain would spend everybody's budget.
Plans
Custom domains start on the Starter plan: one there, five on Team, unlimited on Business. The pricing page has the table.