Connect your own domain
Point a domain you already own at your funnel — HTTPS and nginx get configured with no manual work once DNS checks out.
Connecting takes one input — the hostname — and the panel figures out the rest: whether it's a subdomain or an apex, which DNS record you need, and whether the zone is already on our Cloudflare account (in which case there's nothing for you to do at your registrar at all).
Connect it
GET /api/admin/domains/detect-provider?hostname=<host> looks up the domain's nameservers
and tells you which registrar it's likely on, whether it's an apex or a subdomain, and — the
important bit — whether the zone is one we already control (our_zone). The panel calls this
automatically as you type; you don't need to know your own registrar.
POST /api/admin/domains/connect with {hostname, provider?, display_name?, source_icon?}
does the real work:
- Our zone (
our_zone: true) — a proxied A record is written for you immediately. The domain comes backstate: "active"in the same call. Nothing to add at a registrar. - External zone — a
Domainrow is created inpending_dns, and the response carries per-provider DNS instructions: a CNAME for a subdomain, an A record for an apex (CDN-fronted apexes can't take a CNAME). A per-tenantdcv_tokenis minted for the ownership proof below.
Prove you own it
Pointing DNS at us only proves someone controls that DNS — it could be a churned owner's dangling record. So before an external domain is allowed to go live, you also publish a TXT record proving you control it:
_tease-challenge.<your-domain> TXT tease-verify=<dcv_token>The token lives at _tease-challenge.<host>, not the host itself — a subdomain served via
CNAME can't carry a second record at the same name. Domains on our own Cloudflare zone skip this
step; we already control that DNS, so there's nothing to squat.
Once both records are in place, call POST /api/admin/domains/{domain_id}/verify (the
verify_url from the connect response). It resolves the CNAME/A record and, for external
domains, the TXT token; on a match it flips the domain to state: "active" and issues the
certificate. While it's still pending_dns, the response lists exactly which record is wrong —
missing, pointing at the wrong target, or (a common Cloudflare gotcha) proxied when it needs to
be DNS-only.
A fresh connect can return 409 domain_busy for up to two minutes right after you add the
address — a certificate is issuing. Wait and retry; it isn't a failure.
A background poller keeps retrying domains stuck in pending_dns on its own, so you can point
DNS first and come back later — you don't have to sit on the verify button.
What's next
Prefer not to deal with DNS at all? See Buy a domain in the panel or get a free link instead. If verify won't turn green, see Troubleshooting.