Skip to main content
Unkey Deploy is currently in private beta. To get access, reach out on Discord or email support@unkey.com.
Custom domains let you serve your app from your own domain name (for example, api.acme.com) instead of a *.unkey.app subdomain. Unkey handles TLS certificate provisioning and renewal automatically.

​
Add a custom domain

1

Open domain settings

Navigate to your project in the dashboard and click Settings. Scroll to the Custom domains section.
2

Enter your domain

Select the environment and enter the fully qualified domain name you want to use (for example, api.acme.com).
Custom domains settings showing environment and domain input
3

Add the DNS records

Unkey generates two DNS records to add at your DNS provider:
DNS records to add for domain verification showing TXT and CNAME entries
A TXT record proves ownership of the domain. A CNAME record routes traffic to your deployment. Each domain receives a unique CNAME target.Add both records at your DNS provider. Unkey checks for them automatically and verifies within minutes once the records propagate.
Both DNS records must be verified within 24 hours. If verification doesn’t complete in time, the domain enters a failed state. Remove the domain and add it again to restart the process.

​
Certificate provisioning

After DNS verification succeeds, Unkey provisions a TLS certificate from Let’s Encrypt using an ACME HTTP-01 challenge. Frontline serves the challenge token automatically during this process. Certificates renew before expiration without any action from you.
If Let’s Encrypt rate limits are reached, certificate issuance retries automatically with backoff. This can add up to two hours of delay in rare cases.

​
DNS provider examples

  1. Open your domain in the Cloudflare dashboard.
  2. Click DNS in the sidebar.
  3. Click Add record.
  4. Add the TXT record with name _unkey.{your-subdomain} and the verification value.
  5. Add the CNAME record with name {your-subdomain} and the target from your Unkey dashboard.
  6. Set the CNAME proxy status to DNS only (gray cloud) so Unkey can terminate TLS directly.

​
Troubleshooting

Confirm your DNS records have propagated. TXT records can take up to 48 hours to propagate, depending on your DNS provider. You can check propagation with:
dig TXT _unkey.api.acme.com
Certificate provisioning starts automatically after both DNS records are verified. If the certificate isn’t issued within 30 minutes, check that your CNAME proxy status is set to DNS only (not proxied) at your DNS provider.
Last modified on March 30, 2026