Custom domains

Every project is reachable at a default subdomain, and paid plans can attach one or more custom domains of their own.

The default *.pandastack.app URL

When you create a project, its name becomes its public subdomain:

https://{name}.pandastack.app

This works on every plan, including free, with TLS provisioned automatically. Because the project name is the public subdomain, names are globally unique across all organizations — see Projects overview for the naming rules.

Adding a custom domain

Custom domains are a paid feature. On a free organization, adding a domain returns a machine-readable 402 error:

{
  "success": false,
  "error": {
    "code": "quota_exceeded",
    "message": "Custom domains are available on paid plans. Upgrade to add your own domain."
  }
}

The dashboard surfaces this as an Upgrade prompt. See Plans & limits.

How it works

Custom domains use Cloudflare custom hostnames (SSL-for-SaaS). You point your domain at your project’s {project}.pandastack.app hostname; Cloudflare issues and manages the certificate for your domain.

Add a domain with a POST to the project’s domains endpoint (MEMBER+ role required):

curl -X POST "https://api.pandastack.io/v1/projects/my-app/domains" \
  -H "Authorization: Bearer $PANDASTACK_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "name": "app.acme.com" }'

A successful add returns 201.

DNS setup

Point your domain at your project’s default hostname. Create a DNS record at your registrar/DNS provider that directs app.acme.com to {project}.pandastack.app. Cloudflare then validates ownership and issues the certificate.

Verification

A custom domain has a status of pending, verified, or failed. Verification is re-checked against Cloudflare. After you create the DNS record, re-run verification:

curl -X POST "https://api.pandastack.io/v1/domains/{domainId}/verify" \
  -H "Authorization: Bearer $PANDASTACK_TOKEN"

Status	Meaning
pending	Waiting for DNS / Cloudflare validation
verified	Certificate issued; the domain serves the project
failed	Validation failed — check the DNS record and re-verify

Removing a domain

Delete a custom domain (MEMBER+ role):

curl -X DELETE "https://api.pandastack.io/v1/domains/{domainId}" \
  -H "Authorization: Bearer $PANDASTACK_TOKEN"

Endpoint summary

Endpoint	Method	Paid?	Purpose
GET /v1/projects/:name/domains	GET	Free	List custom domains on a project
POST /v1/projects/:name/domains	POST	Paid (402 for free)	Add a custom domain
POST /v1/domains/:domainId/verify	POST	—	Re-check verification vs Cloudflare
DELETE /v1/domains/:domainId	DELETE	MEMBER+	Remove a custom domain

The whole domain surface is org-scoped and ownership-gated: the project must belong to the caller’s organization.

Related

• Redirects, rewrites & headers — rules applied at the gateway
• Plans & limits — which plans include custom domains
• Projects overview