Production Checklist

Use this checklist before enabling Custom Domain Kit for real customers.

Application

• Production application exists in Custom Domain Kit.
• Origin URL uses HTTPS.
• App secret is stored only on the server.
• Webhook endpoint is configured.
• Webhook signing secret is stored only on the server.

Server Integration

• Setup-session endpoint checks tenant permissions.
• Setup-session responses use Cache-Control: no-store.
• Setup tokens are short lived.
• Webhook receiver verifies raw-body signatures.
• Webhook receiver de-duplicates by event ID.

Frontend Integration

• The setup UI is only shown to users who can manage custom domains.
• The browser receives only browser-safe values.
• setup-token-refresh-url is set.
• The page handles setup-session load errors.

Domain and DNS

• A real test hostname reaches active.
• Support can see the hostname, domainId, tenantId, and status.
• Your product stores the hostname-to-tenant mapping.
• Runtime requests resolve tenant by host.

Billing and Limits

• Your product plan allows the tenant to use custom domains.
• The account understands Testing Mode limits.
• Your app handles payment_required.
• BYO Cloudflare domains are separated from hosted-domain billing.