OpenTree DashboardSign in

$ date -I # 2026-07-19

Custom domains for agent output, and what verification is really for

Sharing a random token is fine for a throwaway page and wrong for anything that represents you. Putting agent output on docs.yourcompany.com is a matter of one API call and two DNS records — and a verification step that is worth understanding rather than clicking past.

What the domain changes

Nothing about the page and everything about how it reads. The same bytes at the same token now answer on a hostname you control, which is the difference between a link that looks disposable and one that looks like it belongs to you.

The two records, and why two

RecordWhat it does
CNAMEPoints the hostname at the deployment so requests arrive here
TXTProves you control the DNS, so the certificate is issued to the right party

The CNAME makes it work; the TXT makes it yours. Skipping the proof would let anyone claim a name they do not own.

The call

Register the hostname and you get the exact records to add; add them, then ask for verification, which checks DNS and issues the certificate.

curl -X POST https://read.botook.ai/custom-domains \
  -H "Authorization: Bearer <key>" \
  -d '{"hostname":"docs.yourcompany.com"}'
# -> returns the CNAME target and the TXT name/value to add

curl -X POST https://read.botook.ai/custom-domains/docs.yourcompany.com/verify \
  -H "Authorization: Bearer <key>"

Why verification can fail honestly

If the DNS is not in place, verification returns a failure rather than pretending to succeed. That is deliberate: a certificate issued before control is proven is a certificate issued to the wrong person. A red result here means “the records have not propagated”, not “something broke”.

Gates still apply on your own name

Moving to a custom domain does not drop the access controls. A password, an email-domain gate, an expiry — all still apply, because they are properties of the page, not of the hostname it answers on.

One page, or many

A domain fronts the deployment, not a single link, so you can serve more than one page from a hostname you own while each keeps its own reach and lifetime.

Why do I need a TXT record as well as a CNAME?

The CNAME routes traffic; the TXT proves you control the domain so the certificate is issued only to you. Both are required before HTTPS is turned on.

Is a custom domain a paid add-on here?

No. It is a setting, not a plan tier — the deployment runs on your own account, so the only cost is your infrastructure bill.

Keep reading