AI integration guide

Share this page with an AI coding agent before it integrates custom domains into your SaaS.

For AI coding agents

Give your AI the right integration instructions.

Point your coding agent here before it adds Custom Domain Kit, so it follows the secure integration path your SaaS needs.

1
Keep secrets on the server
Store the application and webhook signing secrets in server-side configuration. Never send either secret to browser code, logs, or analytics.
2
Create a signed setup session
Check the current user's tenant permission, then return a fresh short-lived setup token with Cache-Control: no-store.
3
Embed the setup UI
Render custom-domainkit-setup on the tenant's domain settings page with only browser-safe values and a token refresh URL.
4
Verify webhooks and route by hostname
Verify raw webhook signatures, store the hostname-to-tenant mapping, and resolve traffic from X-CDK-Original-Host, then forwarded host, then Host.