# CustomDomain docs


- **Get started**
- [Introduction](/docs): CustomDomain™ lets your users connect a domain they already own: it finds the DNS provider, writes or shows the records, verifies them and issues TLS.
- [Quickstart](/docs/getting-started/quickstart): Connect your first domain end to end in test mode: create a test application, connect a .test name, watch it go live and open the widget. No card needed.
- [Which path are you on?](/docs/getting-started/overview): CustomDomain™ has four front doors: the console, the API, the embeddable widget and the MCP server. Pick yours, then read the truths every path shares.
- [Console, connect your own domain](/docs/getting-started/console): Connect your own domain with no code: sign up, tell us who the domains are for, add the DNS records, verify, and see the domain serving your app over HTTPS.
- [API, provision domains from your server](/docs/getting-started/api): Provision custom domains from your server with an API key: pre-flight check, create, apply records, verify and react, plus mistakes integrators actually make.
- [Widget, let your customers connect their domains](/docs/getting-started/widget): Let your customers connect domains inside your product: mint a widget token on your server, open the modal, and see what customers get per DNS provider.
- [MCP: drive it from an agent](/docs/getting-started/mcp): Let an AI agent discover providers, start domain connections and read their status through the hosted MCP server, with API key or scoped agent token access.
- [Test mode](/docs/guides/test-mode): Run the widget, the API and your webhooks end to end on made up .test names, before a customer has a domain. Nothing is looked up, served, billed or counted.

- **Use cases**
- [SaaS platforms](/docs/use-cases/saas-platforms): Let your users connect a domain they already own inside your product: embed the widget, mint tokens on your server, and serve every customer domain.
- [Agencies](/docs/use-cases/agencies): Set up and look after many client domains from one workspace: paste a list, label each domain with its client, and send a setup link to whoever holds the DNS.
- [Your own domain](/docs/use-cases/your-own-domain): Point a domain you own at something you run, with no code: connect it in the console, add or authorize the DNS records, and get HTTPS issued and renewed.
- [AI agents](/docs/use-cases/ai-agents): Let an AI agent find, connect, check and diagnose domains through the hosted CustomDomain™ MCP server, with human-approved scopes and no DNS records as input.
- [Choosing a custom-domain solution (2026)](/docs/guides/choosing-a-custom-domain-solution): An evaluation guide for custom-domain onboarding: build vs. buy, what "provider coverage" really means, and the questions to ask any vendor including us.
- [User journeys](/docs/user-journeys): Map every user-facing CustomDomain™ flow to the surface that implements it: widget for end customers, console and API for developers, and MCP for AI agents.

- **Connect flow**
- [How the connect flow works](/docs/connect-flow/overview): How a domain goes from create to apply to live, and the six ways in: provider sign-in, one-click setup, secure sign-in, an API key, the records or DNS hosting.
- [Create a connection](/docs/connect-flow/create-a-connection): POST /v1/connections creates a connection for a domain, replays safely if you retry, returns the DNS records to apply, and accepts a record set you supply.
- [Apply records & go live](/docs/connect-flow/verify-and-go-live): Apply a domain's records by provider sign-in, one-click setup, secure sign-in, an API key, by hand or DNS hosting, then watch it go live with its certificate.
- [End user notices](/docs/connect-flow/end-user-notices): Give CustomDomain™ the end user's email, from your server or the widget: after a Move they get one email with the new DNS records, and a reconnect email when their provider's API key needs them, sent on your behalf.
- [Domain forwarding](/docs/connect-flow/forwarding): Redirect a connected domain to another URL, or send the apex to www, with a 301 issued at the edge that keeps the path and query and never contacts your origin.
- [Managed connections](/docs/connect-flow/managed-connections): Opt a connection into managed mode so the control plane can re-apply and revert its records with a stored, encrypted grant, and see which providers support it.
- [Provider accounts](/docs/connect-flow/provider-accounts): Connect a DNS provider or registrar account once, for some or all of its domains, with one time or continuous access, see who on your team can manage it, and find every change in the audit log.
- [Certificates](/docs/connect-flow/certificates): How the edge issues and renews each domain's HTTPS certificate, how to read its status through the API, and which alerts tell you when one needs attention.
- [Monitoring and services](/docs/connect-flow/monitoring): Every live domain is checked hourly against its records. Drift is confirmed first, and records CustomDomain™ wrote are put back where it has continuous access.
- [Removing a domain](/docs/connect-flow/offboarding): Remove a connected domain and choose what happens to the DNS records CustomDomain™ added: take them out and restore what they replaced, keep them, or go manual.
- [How to connect a custom domain](/docs/guides/connect-a-custom-domain): Connect a custom domain to your SaaS product: which records you need on a subdomain or the root, why certificates fail separately, and how long it really takes.
- [How to set up a custom domain](/docs/guides/set-up-a-custom-domain): Connect a custom domain to your app end to end: pick the right record, handle the apex, clear CAA and conflicting records, and know when it is actually live.
- [Secure sign-in](/docs/guides/secure-sign-in): How secure sign-in connects a domain at a DNS provider with no sign-in you can use: what your customer sees, the lasting API key it makes, reconnecting, what we never see, and the API.

- **DNS and serving**
- [Connection paths by provider](/docs/dns/providers): How CustomDomain™ picks the way in for each domain: provider sign-in, one-click setup, secure sign-in, an API key, records added by hand or DNS hosting.
- [Provider setup](/docs/dns/provider-setup): What to create at each DNS provider so the records can be written for you, which server address to allow, and what each provider requires before you start.
- [Root domains (apex)](/docs/dns/root-domains): Why acme.com differs from www.acme.com, what each DNS provider can hold at the root, and how CustomDomain™ connects it with ALIAS-style records or A records.
- [Bring your own records](/docs/dns/bring-your-own-records): Connect a domain with records only you know, such as email (SES, Workspace) and verification tokens, and see what such a connection does and does not get.
- [Email DNS & SPF merge](/docs/dns/email-dns): Add MX, SPF, DKIM and DMARC records with a domain connection. SPFM merges your SPF mechanisms into the published record, so the domain keeps one SPF record.
- [Managed DNS](/docs/dns/managed-dns): Point a domain's nameservers at CustomDomain™ once and every later record is written for you. How DNS hosting works, the API and the limits.
- [Domain verification: publish another service's TXT record](/docs/guides/domain-verification): When your app asks customers to add a TXT record for another service (single sign-on, Search Console, a Bluesky handle), hand that record to CustomDomain™: written or shown exactly, checked, then a webhook.
- [Domain maintenance (nameserver migration)](/docs/guides/nameserver-migration): Keep your users' domains working for them: with their consent, one setting where they bought the domain hands its DNS to you. Setup, the registrar, the copy, steps, DNSSEC, moving back, the API.
- [Where domains point](/docs/connect-flow/routing): Send customer domains through the CustomDomain™ edge with automatic SSL, or point them straight at your own infrastructure, and see how the DNS records differ.
- [Serve customer domains from your app (reverse-proxy edge)](/docs/guides/serve-customer-domains-from-your-app): Turn on edge serving so customer domains reach your app: set an origin, use X-Forwarded-Host to tell domains apart, and debug 421, 502 and 402 errors and loops.
- [Buying a domain](/docs/sell/buying-a-domain): Buy a new domain in the console with live pricing: the money-safe flow that authorizes, registers, then captures payment, and how it becomes a connected domain.

- **Widget**
- [How the widget works](/docs/widget-sdk/overview): Learn how customdomain-js adds a drop-in modal for connecting a domain, how a widget JWT keeps keys out of the browser, and the screens a customer sees.
- [Installation & embed](/docs/widget-sdk/installation-and-embed): Install customdomain-js, mint a widget token on your server, open the connect modal in the browser, and use React, embedded mode and white-label theming.
- [Reference](/docs/widget-sdk/reference): Reference for the eight window.customdomain methods, window events and callbacks, the open() config, widget statuses, white-label options and theming tokens.
- [Widget tokens](/docs/authentication/widget-tokens): Mint short-lived widget JWTs with POST /v1/tokens, choose between the connect and app scopes, and keep a long browser session alive without exposing an API key.

- **Webhooks**
- [Webhook events and delivery](/docs/webhooks/overview): Register HTTPS endpoints to receive signed webhook events as connections progress, with the event catalog, the payload envelope and how delivery retries work.
- [Verifying signatures](/docs/webhooks/verifying-signatures): Verify webhook deliveries with the X-JE-Signature HMAC-SHA256 header and the timestamp, and reject replayed requests using a recommended five minute window.

- **Agents and MCP**
- [MCP server](/docs/mcp/overview): The CustomDomain™ Model Context Protocol server: twenty-three tools an AI agent can call to search, connect and manage domains, plus scopes, transports and auth.
- [Agent access](/docs/agents/overview): How an AI agent gets human-approved, scoped and revocable access to your domains through the MCP server using OAuth with PKCE, and where owners manage it.
- [The OAuth flow](/docs/agents/oauth-flow): The agent authorization endpoints: client metadata documents or DCR, authorize with PKCE, consent, token, refresh, revoke, plus JWKS and RFC 8414 discovery.
- [Managing access](/docs/agents/managing-access): Learn how an owner approves an agent grant, sets monthly spend caps for purchases, receives owner emails, and reviews or revokes agent access from the console.
- [Agent skill](/docs/agents/skills): An installable Agent Skill that teaches an AI agent to connect a domain, check status and read DNS records through the MCP server, with safety rules built in.

- **Concepts**
- [Architecture](/docs/concepts/architecture): How tenants, applications, the connect plane and the edge plane fit together, sharing one database over HTTP, and why the TLS hot path never waits on billing.
- [Connections](/docs/concepts/connections): How a connection moves through pending, propagating, live and failed, the authoritative record set, how tenancy and idempotency work, and how drift is checked.
- [Setup types & the ask gate](/docs/concepts/ownership-and-setup-types): How a domain is classified as automatic or manual, how async one-click setup fits in, what proves control for each rail, and how the ask gate guards the edge.
- [Glossary](/docs/concepts/glossary): The words the CustomDomain™ console uses, one name per thing, each with a plain definition and where to read more.

- **Account and security**
- [Authentication and API keys](/docs/authentication/overview): The four credential types (API keys, widget JWTs, agent tokens and operator secrets), their blast radius, member roles, and the unauthenticated surfaces.
- [Security model](/docs/security/overview): CustomDomain™ security model: tenant isolation, credentials and roles, value-checked DNS verification, provider credentials and unauthenticated surfaces.
- [CustomDomainBot](/docs/security/domain-checks): What CustomDomainBot requests from a domain when someone enters it in CustomDomain™, what data we keep, and how to ask us to stop checking your domain.
- [Plans & quotas](/docs/billing/plans-and-quotas): The plan catalog and entitlements, trials and subscriptions, how metered monthly domain usage and quotas work, and how Stripe checkout and the portal fit in.
- [Notifications](/docs/guides/notifications): See which CustomDomain™ notifications reach the console bell and browser push, like domains going live or certificate problems, which emails we send and who gets them, and how to turn each off.

- **Help**
- [Troubleshooting](/docs/troubleshooting): Fix stuck connections and common failures: pending or propagating domains, DNS mistakes, rail errors, provider tokens, certificate issues and DNS drift.
- [FAQ](/docs/faq): Short answers to common questions about connecting domains: which providers connect automatically, how records get written, whether keys are stored, and apex domains.
- [Reference](/docs/reference): Lookup tables for CustomDomain™: enums, DNS record types, webhook events, error codes, environment variables, webhook signatures and the default edge record.
- [Changelog](/docs/changelog): How CustomDomain™ ships updates without numbered releases, the additive-only /v1 API versioning policy, and a running list of notable product milestones.

- **Providers**
- Providers
  - [Connect a domain by DNS provider](/docs/providers): Step by step guides to connect a custom domain from each supported DNS provider, with the exact DNS records and how each provider's setup works end to end.
  - [Connect a Cloudflare domain](/docs/providers/cloudflare): Put a custom domain from Cloudflare on your app with automatic HTTPS. One-click (OAuth) setup, the exact DNS records, and how to verify the domain went live.
  - [Connect a DigitalOcean domain](/docs/providers/digitalocean): Put a custom domain from DigitalOcean on your app with automatic HTTPS. One-click (OAuth) setup, the exact DNS records, and how to verify it went live.
  - [Connect a DNSimple domain](/docs/providers/dnsimple): Put a custom domain from DNSimple on your app with automatic HTTPS. One-click (OAuth) setup, the exact DNS records, and how to verify the domain went live.
  - [Connect a GoDaddy domain](/docs/providers/godaddy): Put a custom domain from GoDaddy on your app with automatic HTTPS. Automatic (API token) setup, the exact DNS records, and how to verify it went live.
  - [Connect a Namecheap domain](/docs/providers/namecheap): Connect a Namecheap domain: add the exact records in Advanced DNS (the default), use an API key if your account qualifies, and check the domain is live.
  - [Connect a Netlify domain](/docs/providers/netlify): Put a custom domain from Netlify on your app with automatic HTTPS. One-click (OAuth) setup, the exact DNS records, and how to verify the domain went live.
  - [Connect an Amazon Route 53 domain](/docs/providers/route53): Put a custom domain from Amazon Route 53 on your app with HTTPS. Automatic setup with an access role or IAM key, the exact DNS records, and how to verify it.
  - [Connect a Vercel domain](/docs/providers/vercel): Put a custom domain from Vercel on your app with automatic HTTPS. One-click (sign-in) setup, the exact DNS records, and how to verify the domain went live.
  - [Connect a WordPress.com domain](/docs/providers/wordpresscom): Put a custom domain from WordPress.com on your app with automatic HTTPS. One-click (OAuth) setup, the exact DNS records, and how to verify it went live.

- **API reference**
- API reference
  - [API reference](/docs/api-reference): Base URL, the four token types and how to send them, API versioning, the error envelope and conventions, plus the full generated operation reference below.
  - Tokens
    - [Exchange application credentials for a short-lived widget JWT](/docs/api-reference/tokens/createWidgetToken)
  - Agents
    - [Register an agent as an OAuth client](/docs/api-reference/agents/registerAgentClient)
    - [Start an agent authorization (code with PKCE)](/docs/api-reference/agents/authorizeAgent)
    - [Exchange an authorization code or a refresh token for an access token](/docs/api-reference/agents/exchangeAgentToken)
    - [Revoke an agent's access with its refresh token](/docs/api-reference/agents/revokeAgentToken)
    - [Read a pending agent authorization, for the consent screen](/docs/api-reference/agents/getAgentConsentRequest)
    - [Deny a pending agent authorization](/docs/api-reference/agents/cancelAgentConsentRequest)
    - [Approve an agent and mint its authorization code](/docs/api-reference/agents/approveAgent)
    - [List the workspace's agent grants](/docs/api-reference/agents/listAgentGrants)
    - [Revoke an agent's access](/docs/api-reference/agents/revokeAgentGrant)
  - Domains
    - [Detect where a domain's DNS lives and how it will be set up](/docs/api-reference/domains/checkDomain)
    - [Check one-click setup support for a domain (public)](/docs/api-reference/domains/publicDomainConnectCheck)
  - Connections
    - [Create a domain connection (idempotent per app + domain)](/docs/api-reference/connections/createConnection)
    - [Create connections for a set of domains in one call](/docs/api-reference/connections/bulkCreateConnections)
    - [List connections](/docs/api-reference/connections/listConnections)
    - [Count the tenant's connections (no rows)](/docs/api-reference/connections/countConnections)
    - [Get a connection with its authoritative record set](/docs/api-reference/connections/getConnection)
    - [Change a domain's client name, www redirect or forwarding](/docs/api-reference/connections/updateConnection)
    - [Remove a domain, removing or keeping the DNS records we added](/docs/api-reference/connections/disconnectConnection)
    - [What removing a domain would do with its DNS records](/docs/api-reference/connections/getRemovalPlan)
    - [Remove a domain, optionally authorizing the record removal once with a key](/docs/api-reference/connections/disconnectConnectionWithChoice)
    - [Find your connection for a domain](/docs/api-reference/connections/lookupConnection)
    - [Authoritative desired DNS record set for a connection](/docs/api-reference/connections/getConnectionRecords)
    - [Supply the connection's desired DNS record set](/docs/api-reference/connections/setConnectionRecords)
    - [Leave the end user's email address on a connection](/docs/api-reference/connections/setConnectionEndUserEmail)
    - [Write a connection's records through the customer's provider (BYO token, used once)](/docs/api-reference/connections/applyConnection)
    - [Re-apply a managed connection's desired records (async one-click, no re-consent)](/docs/api-reference/connections/reapplyConnection)
    - [Check a connection's DNS now, and report what public DNS answered](/docs/api-reference/connections/recheckConnection)
    - [Move a domain to its application's current routing, or back to the edge](/docs/api-reference/connections/retargetConnection)
    - [What public DNS shows for each record, and what is left to do](/docs/api-reference/connections/diagnoseConnection)
    - [The CustomDomain™ services the domain uses](/docs/api-reference/connections/getConnectionServices)
    - [How many domains use each service, per application and workspace](/docs/api-reference/connections/getServicesSummary)
    - [The domain's certificate, its renewal and its history](/docs/api-reference/connections/getDomainCertificate)
    - [The domain's timeline](/docs/api-reference/connections/listConnectionEvents)
    - [Turn managed mode OFF without disconnecting](/docs/api-reference/connections/disableManagedConnection)
    - [Begin the sign-in to the DNS provider for a connection](/docs/api-reference/connections/startConnectionOAuth)
    - [OAuth redirect target (public; authenticated by the signed state)](/docs/api-reference/connections/oauthCallback)
    - [Async one-click setup redirect target (public; authenticated by the signed state)](/docs/api-reference/connections/dcCallback)
    - [One-click sync return (public; authenticated by the signed state)](/docs/api-reference/connections/dcSyncReturn)
    - [One-click sync return with the state as a query parameter](/docs/api-reference/connections/dcSyncReturnQuery)
    - [Build the one-click apply URL (sync) or start the managed async rail](/docs/api-reference/connections/startDomainConnect)
    - [Start connecting a Route 53 domain through a limited IAM role instead of an access key](/docs/api-reference/connections/startRoute53Role)
    - [Verify the customer's Route 53 access role and write the connection's records with it](/docs/api-reference/connections/completeRoute53Role)
  - Managed DNS
    - [Start managed DNS for a connection's domain](/docs/api-reference/managed-dns/startManagedDNS)
    - [The connection's managed DNS zone](/docs/api-reference/managed-dns/getManagedDNS)
    - [Import a zone file or add records to the managed zone](/docs/api-reference/managed-dns/addManagedDNSRecords)
    - [Remove one record from the managed zone](/docs/api-reference/managed-dns/deleteManagedDNSRecord)
  - Nameservers
    - [Move the domain's nameservers, with the end user's consent](/docs/api-reference/nameservers/migrateNameservers)
    - [The connection's latest nameserver migration](/docs/api-reference/nameservers/getNameserverMigration)
    - [Whether the domain's nameservers can move now, and how](/docs/api-reference/nameservers/getNameserverOffer)
    - [Move the domain's nameservers back](/docs/api-reference/nameservers/rollbackNameservers)
    - [One application's nameserver migrations and their analytics](/docs/api-reference/nameservers/listNameserverMigrations)
  - Provider accounts
    - [Connect a provider account with a key](/docs/api-reference/provider-accounts/createProviderAccount)
    - [Add a provider account by secure sign in (the console only)](/docs/api-reference/provider-accounts/startProviderAccountSignIn)
    - [Add a provider account by signing in with the company (the console only)](/docs/api-reference/provider-accounts/startProviderAccountOAuth)
    - [Confirm the domains and keep the key of an account sign in](/docs/api-reference/provider-accounts/keepBrowserSessionAccount)
    - [Every connected account, with the kept sign-ins and Domain Connect grants](/docs/api-reference/provider-accounts/listProviderAccounts)
    - [One provider account with its domains](/docs/api-reference/provider-accounts/getProviderAccount)
    - [Change an account's label, access, scope or the applications it is shared with](/docs/api-reference/provider-accounts/updateProviderAccount)
    - [The domains the account's key can reach](/docs/api-reference/provider-accounts/listProviderAccountZones)
    - [Connect domains with the account](/docs/api-reference/provider-accounts/connectWithProviderAccount)
    - [Give an account a new key](/docs/api-reference/provider-accounts/reconnectProviderAccount)
    - [Check an account's key now](/docs/api-reference/provider-accounts/checkProviderAccount)
    - [Revoke an account](/docs/api-reference/provider-accounts/revokeProviderAccount)
    - [The kept keys that may act for the domain, for you](/docs/api-reference/provider-accounts/getConnectionSavedAccess)
    - [Write the domain's records with a kept key](/docs/api-reference/provider-accounts/useConnectionSavedAccess)
  - Cloud browser
    - [Begin the cloud browser sign in for a connection](/docs/api-reference/cloud-browser/startConnectionBrowser)
    - [Hand the cloud browser sign in to a new popup](/docs/api-reference/cloud-browser/resumeConnectionBrowser)
    - [A link the end user opens to renew the domain's lasting API key](/docs/api-reference/cloud-browser/createConnectionReconnectLink)
    - [Trade the bootstrap code for the session token](/docs/api-reference/cloud-browser/redeemBrowserSession)
    - [Read a cloud browser session](/docs/api-reference/cloud-browser/getBrowserSession)
    - [Tell the server the popup's new size](/docs/api-reference/cloud-browser/browserSessionViewport)
    - [Report a step of the sign in window](/docs/api-reference/cloud-browser/browserSessionEvent)
    - [Sign in with an identity provider through the vendor's managed sign in](/docs/api-reference/cloud-browser/idpBrowserSession)
    - [Leave the identity provider's sign in for the provider's own form](/docs/api-reference/cloud-browser/idpCancelBrowserSession)
    - [The customer says they are signed in](/docs/api-reference/cloud-browser/signedInBrowserSession)
    - [Sign in with another account](/docs/api-reference/cloud-browser/switchAccountBrowserSession)
    - [Send the code a provider's frame asked for](/docs/api-reference/cloud-browser/codeBrowserSession)
    - [Approve the exact plan](/docs/api-reference/cloud-browser/approveBrowserSession)
    - [The customer finished by hand](/docs/api-reference/cloud-browser/finishManualBrowserSession)
    - [End the session and release the browser](/docs/api-reference/cloud-browser/cancelBrowserSession)
  - Analytics
    - [Connect funnel and connection outcomes](/docs/api-reference/analytics/getConnectAnalytics)
    - [Secure sign-in funnel, time per stage and where sessions stop](/docs/api-reference/analytics/getSecureSignInFlow)
    - [The newest secure sign-in sessions](/docs/api-reference/analytics/listSecureSignInSessions)
    - [One secure sign-in session's steps](/docs/api-reference/analytics/getSecureSignInTimeline)
    - [Edge traffic for the workspace or one application, with its busiest domains](/docs/api-reference/analytics/getTrafficSummary)
    - [Edge traffic for one domain](/docs/api-reference/analytics/getConnectionTraffic)
    - [Widget funnel beacon (fire-and-forget)](/docs/api-reference/analytics/recordConnectTelemetry)
  - Secure
    - [Read the mirrored TLS certificate status for a connection's domain](/docs/api-reference/secure/getConnectionCertificate)
    - [Whether a certificate can be issued for this connection yet](/docs/api-reference/secure/getConnectionCertificateEligibility)
    - [Record intent to issue an edge-managed certificate](/docs/api-reference/secure/provisionConnectionCertificate)
    - [Mark a connection's certificate for renewal](/docs/api-reference/secure/renewConnectionCertificate)
    - [Record an operator-supplied (externally obtained) certificate's metadata](/docs/api-reference/secure/importConnectionCertificate)
    - [Deprovision a connection's certificate (drop the mirror, stop managing)](/docs/api-reference/secure/deprovisionConnectionCertificate)
    - [List the certificates tracked for the caller's application](/docs/api-reference/secure/listCertificates)
  - Power
    - [Read a connection's Power (edge reverse-proxy) configuration](/docs/api-reference/power/getConnectionPower)
    - [Whether Power can be enabled for this connection yet](/docs/api-reference/power/getConnectionPowerEligibility)
    - [Enable Power (register the origin + redirect/root-path config)](/docs/api-reference/power/enableConnectionPower)
    - [Update an existing Power configuration](/docs/api-reference/power/repowerConnection)
    - [Remove Power (drop the origin, clear config, tear down the cert)](/docs/api-reference/power/disableConnectionPower)
    - [List the caller app's powered connections](/docs/api-reference/power/listPoweredConnections)
    - [The application-wide default origin](/docs/api-reference/power/getApplicationDefaultOrigin)
    - [Set or clear the application-wide default origin](/docs/api-reference/power/setApplicationDefaultOrigin)
  - Sharing
    - [Mint a share link that resumes a connect flow from a server-side prefill](/docs/api-reference/sharing/createSharedFlow)
    - [Read a share link's server-side prefill (token is the bearer credential)](/docs/api-reference/sharing/getSharedFlow)
  - Applications
    - [Create an application (client_secret returned once)](/docs/api-reference/applications/createApplication)
    - [List applications](/docs/api-reference/applications/listApplications)
    - [Get an application](/docs/api-reference/applications/getApplication)
    - [Rename an application or change its settings](/docs/api-reference/applications/updateApplication)
    - [Delete an application](/docs/api-reference/applications/deleteApplication)
    - [Where this application's customer domains point](/docs/api-reference/applications/getConnectTarget)
    - [Point this application's customer domains at your own infrastructure](/docs/api-reference/applications/setConnectTarget)
    - [How an application's end user notices are sent](/docs/api-reference/applications/getEmailSender)
    - [Set how an application's end user notices are sent](/docs/api-reference/applications/putEmailSender)
    - [Send one test message through an application's mail server](/docs/api-reference/applications/testEmailSender)
    - [Rotate an application's widget client_secret (new secret returned once)](/docs/api-reference/applications/rotateClientSecret)
    - [Rotate an application's edge auth secret](/docs/api-reference/applications/rotateEdgeSecret)
    - [Issue an API key for an application (key returned once)](/docs/api-reference/applications/createApiKey)
    - [List an application's API keys (secrets omitted)](/docs/api-reference/applications/listApiKeys)
    - [Revoke an API key](/docs/api-reference/applications/revokeApiKey)
  - Members
    - [Invite a member to the caller's tenant](/docs/api-reference/members/inviteMember)
    - [List the caller tenant's members](/docs/api-reference/members/listMembers)
    - [Preview an invite by its token, without accepting it](/docs/api-reference/members/previewInvite)
    - [Accept an invite (single-use token)](/docs/api-reference/members/acceptMember)
    - [Get a pending member's current invite token](/docs/api-reference/members/getMemberInvite)
    - [Re-issue a pending invite with a fresh link](/docs/api-reference/members/resendMemberInvite)
    - [Change a member's role (owner-protected)](/docs/api-reference/members/updateMemberRole)
    - [Remove a member or revoke a pending invite (owner-protected)](/docs/api-reference/members/removeMember)
    - [Send a test push to the signed in person's devices (console server)](/docs/api-reference/members/sendTestNotification)
    - [A member's email change was confirmed (console server)](/docs/api-reference/members/memberEmailChanged)
  - Tenancy
    - [Create a tenant](/docs/api-reference/tenancy/createTenant)
    - [Get a tenant](/docs/api-reference/tenancy/getTenant)
    - [Rename your workspace](/docs/api-reference/tenancy/updateTenant)
    - [One-call signup provisioning (tenant + owner + app + API key)](/docs/api-reference/tenancy/provisionTenant)
    - [Ensure the workspace default key exists (secret returned only when created)](/docs/api-reference/tenancy/ensureDefaultApiKey)
    - [Rotate the workspace default key (new secret returned once)](/docs/api-reference/tenancy/rotateDefaultApiKey)
    - [Aggregate counts across all tenants (operator)](/docs/api-reference/tenancy/getStats)
  - Providers
    - [List the DNS providers the Connect engine can detect and automate](/docs/api-reference/providers/listProviders)
    - [Full parity census (every target provider routed to its working mode)](/docs/api-reference/providers/providerCensus)
    - [Enumerate the connectable domains a provider credential controls](/docs/api-reference/providers/listProviderZones)
  - Templates
    - [List one-click setup service templates](/docs/api-reference/templates/listTemplates)
    - [Get one setup template](/docs/api-reference/templates/getTemplate)
    - [Build the one-click apply URL for a domain](/docs/api-reference/templates/buildTemplateApplyUrl)
  - Registrar
    - [Search domain availability and pricing](/docs/api-reference/registrar/searchDomains)
    - [Cheapest real-time price for a domain](/docs/api-reference/registrar/quoteDomain)
    - [Register a domain (fail-closed; requires Idempotency-Key)](/docs/api-reference/registrar/purchaseDomain)
    - [Start an embedded payment to buy a domain at retail](/docs/api-reference/registrar/startDomainCheckout)
    - [Finalize a domain purchase after the embedded payment completes](/docs/api-reference/registrar/fulfillDomainPurchase)
    - [Read a persisted domain-purchase order's status by id](/docs/api-reference/registrar/getSellOrder)
    - [List the calling application's domain-purchase orders, newest first](/docs/api-reference/registrar/listSellOrders)
  - Monitor
    - [What the drift monitor last found for the domain, and what was done](/docs/api-reference/monitor/getConnectionMonitor)
    - [Every domain of the workspace with its last drift check](/docs/api-reference/monitor/listMonitoredDomains)
    - [Check declared baseline records against live public DNS](/docs/api-reference/monitor/checkRecords)
  - Webhooks
    - [Register a webhook endpoint (secret returned once)](/docs/api-reference/webhooks/createWebhook)
    - [List webhook endpoints](/docs/api-reference/webhooks/listWebhooks)
    - [Delete a webhook endpoint](/docs/api-reference/webhooks/deleteWebhook)
    - [Recent webhook delivery attempts for the caller's tenant](/docs/api-reference/webhooks/listWebhookDeliveries)
  - Billing
    - [Public plan catalog (plus billing {configured, mode})](/docs/api-reference/billing/listPlans)
    - [Metered domain usage, plan, and quota for the caller's tenant](/docs/api-reference/billing/getUsage)
    - [Whether billing needs attention (every member)](/docs/api-reference/billing/getBillingNotice)
    - [Whether the workspace may connect new domains](/docs/api-reference/billing/getBillingStanding)
    - [The workspace's subscription (owners and admins)](/docs/api-reference/billing/getBillingStatus)
    - [The workspace's recent invoices (owners and admins)](/docs/api-reference/billing/listBillingInvoices)
    - [Start a Stripe Checkout session for a self-serve plan](/docs/api-reference/billing/createCheckout)
    - [Record a completed plan checkout now (owners and admins)](/docs/api-reference/billing/confirmBillingCheckout)
    - [Move a running subscription to another self-serve plan](/docs/api-reference/billing/changeBillingPlan)
    - [Apply a promotion code to the running subscription](/docs/api-reference/billing/applyBillingPromotionCode)
    - [Open a Stripe Billing Portal session](/docs/api-reference/billing/createPortalSession)
    - [Start a legacy Free workspace's grace period (owners and admins)](/docs/api-reference/billing/startBillingGrace)
    - [Start a Stripe Checkout session to save a payment method](/docs/api-reference/billing/startCardSetup)
  - Enterprise
    - [Role / permission matrix (static reference)](/docs/api-reference/enterprise/getRbac)
    - [Audit log (tenant-scoped for tenant credentials; full log for the management key)](/docs/api-reference/enterprise/getAudit)
    - [Record an audit event for a change made in the console](/docs/api-reference/enterprise/recordAuditEvent)
  - Meta
    - [Public service discovery (advertised products and version)](/docs/api-reference/meta/getConfig)
    - [This OpenAPI document](/docs/api-reference/meta/getOpenAPISpec)