Custom access domains

A custom access domain serves a workspace’s Stackyapper portal and MCP endpoint from a hostname your organization controls, such as stackyapper.example.com.

Custom access domains require Business and approved MSP or consultant verification. Existing configured domains remain in place.

Before you start

You need:

Workspace owner access
Permission to create a CNAME record in the hostname’s DNS zone

Choose a dedicated subdomain, such as stackyapper.example.com, that is not already serving another application. Apex domains (example.com) and wildcards are not supported. Each workspace can have one custom access domain. Stackyapper manages the TLS certificate after the DNS record is detected.

Set up the domain

Select the workspace
Open the Stackyapper portal and select the intended workspace.
Open the access domain settings
Open Settings → Identity & access → Access domain.
Start domain setup
Under Custom access domain, select Set up domain.
Enter the hostname
Enter the complete subdomain in CNAME hostname, then select Create domain.
Add the CNAME record
Add the CNAME record shown in the portal:
- Type: CNAME
- Name: the custom hostname
- Target: copy the exact target displayed by Stackyapper
Check verification
Return to the portal and select Check now, or leave the page open; status checks run automatically every 15 seconds while setup is pending.

No TXT verification record is required. Do not substitute a different CNAME target or point the hostname directly to an IP address.

Verification states

Stackyapper reports routing and certificate progress separately:

Hostname routing: Waiting for DNS: the expected CNAME has not been detected.
Hostname routing: Ready: Stackyapper can route the hostname to the workspace.
TLS certificate: Issuing automatically: the TLS certificate is being created. Issuance can take a few minutes after DNS is detected.
TLS certificate: Issued: the certificate is ready. When routing and the certificate are both ready, the portal shows Verified and portal and MCP traffic are served from the custom hostname.
This hostname needs attention: review any displayed error, correct DNS if needed, and select Check now again, or remove the hostname and start over.

DNS propagation and certificate issuance can take several minutes. Keep the CNAME record in place after verification.

Use the verified hostname

After verification:

Open the workspace portal from https://<your-hostname>.
Use the MCP URL shown under AI clients → Connect when configuring a client.
Prefer the portal-displayed URL over constructing an endpoint manually.

The hostname is bound to one workspace. Stackyapper resolves the workspace again for each request; a custom hostname does not broaden membership, app access, or tool grants.

Change or remove a domain

A workspace can have only one custom access domain, so remove the current hostname before adding a replacement. Creating a replacement requires Business and approved MSP or consultant verification, even if the workspace already has a domain. If you are unsure whether your workspace qualifies, contact support before removing the hostname. Update AI clients after a replacement hostname is verified.

To remove the domain, select Remove, then Remove domain. Removing it disables the custom portal and MCP endpoint and returns the workspace to app.stackyapper.dev for the portal and mcp.stackyapper.dev for MCP. Remove the obsolete DNS record after the portal confirms the domain has been removed.

Troubleshooting

If verification does not complete:

Confirm the DNS record is a CNAME with the exact name and target shown.
Remove conflicting A, AAAA, or CNAME records for the same hostname.
If your DNS provider flattens CNAME records, confirm it still publishes the expected target.
Select Check now after DNS changes have propagated.

If the portal reports a persistent routing or certificate error, contact support with the workspace name, hostname, approximate time, and displayed error. Do not send DNS-provider credentials or Stackyapper session data.