Custom login domain

✅ Verified

Against Axowl.Auth/EndPoints/OrgSettingsEndpoints.cs (/domains, /domains/verify, /domains/auto-configure), Axowl.Auth/Services/OrganizationSettingsService.cs (VerifyDnsAsync) and Axowl.Auth/Services/CustomDomainServingService.cs. End-to-end checked on a live domain — 2026-08-26.

By default your users sign in at axowl.com/login/{your-slug}. A custom login domain serves the same portal from a hostname you own, so axowl.com never appears in the address bar.

This is optional. It changes nothing about how login works — only where it is served.

Custom login domains require the Pro plan. Removing one is always free.

Pick a hostname

A subdomain such as auth.yourbrand.com is the usual choice.

An apex domain (yourbrand.com) also works. Note that most DNS providers cannot store a real CNAME at the apex and will flatten it into A records instead — Axowl’s verification accounts for this and compares the flattened addresses, so an apex domain verifies normally.

Before choosing the apex, check what already answers on it. A marketing site, a landing page, or anything else served from that exact hostname cannot coexist with the login portal — one host serves one thing. A subdomain avoids the question entirely.

Two DNS records

Step	Type	Name	Value
Ownership	TXT	_axowl-challenge.{your-domain}	the token shown in the dashboard
Routing	CNAME	{your-domain}	cname.axowl.com

The TXT record proves you control the zone. Without it, a hostname that merely points at us could be claimed by whoever pointed it — including a previous tenant of an abandoned CNAME.

If your DNS provider offers a proxy/CDN toggle (Cloudflare’s orange cloud, for example), leave the CNAME set to DNS only. A proxied record keeps traffic inside your own zone and it never reaches us.

Automatic setup on Cloudflare

If your domain is on Cloudflare you do not have to touch DNS at all.

Create a Cloudflare API token with Zone → DNS → Edit on that zone, paste it into the dashboard, and Axowl writes both records for you.

POST /api/org/{slug}/settings/domains/auto-configure
Content-Type: application/json

{ "apiToken": "<cloudflare-api-token>", "appGroupId": "<app-group-id>" }

{ "ok": true, "error": null, "zoneName": "yourbrand.com" }

The token is used for that single request and is never stored. Scope it to the one zone — Axowl needs nothing else, and a token limited that way cannot reach the rest of your Cloudflare account.

Caution

Cloudflare API tokens can be restricted to specific zones. A token that does not include this domain’s zone returns zone-not-found — the zone is invisible to the token rather than missing.

Verify

POST /api/org/{slug}/settings/domains/verify?appGroupId={id}

{ "verified": true, "served": true, "servingError": null }

The two flags mean different things:

• verified — the TXT challenge matched and the hostname routes to us.
• served — the hostname is attached to the login portal and its certificate is on the way.

verified: true, served: false means DNS is correct but the domain will not load yet. The dashboard reports this separately rather than showing a green check, because a green check on a domain that returns an error is worse than an honest pending state.

DNS propagation usually takes a few minutes and can take up to 24 hours. Certificate issuance starts once verification succeeds and is typically done within minutes.

Removing a domain

Clearing the domain field releases the hostname, removes its certificate, and returns your users to axowl.com/login/{your-slug}. The DNS records in your own zone are left alone — Axowl does not delete records from a zone it does not own, even when it created them.