Custom domains map a verified hostname to an application route. Ferrite keeps domain ownership, DNS verification, route binding, and certificate lifecycle in the platform control plane.
Claim and verify
Open Domains in the Dashboard and enter docs.example.com, or call the MCP
claim_domain tool with that domain.
Add the returned DNS verification record, then run:
After publishing the returned record, use the Dashboard verification and app
binding controls. MCP clients use verify_domain with the presented token,
then bind_domain with the verified domain and app name.
The Gateway supports ACME certificate issuance and hot route-table reloads. Verify the public TLS URL after binding; a successful DNS check alone does not prove the app route or certificate is ready.
Authentication domains
Give each authentication realm its own canonical HTTPS host. Do not path-mount two identity realms beneath one cookie or WebAuthn RP-ID authority.
Agent discovery
Generate sitemap, llms.txt, OpenAPI, agent card, and MCP URLs from the
canonical origin. A preview origin must not leak into production discovery
documents.
See Agent-native Apps and Headers & Cookies.