Domains

Every project is reachable from the first deploy at a free address:

https://<slug>.camplax.app

That address is the project's primary domain — it always works, it already has a certificate, and it cannot be removed. Add your own domain when you want one.

Add a custom domain

In the console, open Domains and add the hostname — example.com, www.example.com or app.example.com. Then at your DNS provider:

CNAME  example.com  →  edge.camplax.app

edge.camplax.app is the Camplax edge your hostname points at. For an apex name (example.com with no subdomain) you need a DNS provider that supports CNAME flattening or an ALIAS/ANAME record — most do. A subdomain is a plain CNAME either way.

Back in the console, press Verify. Camplax asks Cloudflare for the hostname's live state and updates the row. A domain is active only when two things are both done: Cloudflare accepts the hostname and the certificate is issued. Until then the row reads pending — pressing Verify again is safe and is the normal way to watch it finish.

If Cloudflare needs proof you own the domain, it asks for a TXT record — the console shows the exact name and value to paste at your DNS provider, and Verify picks it up once it resolves.

www and apex are a pair

Add example.com and Camplax creates both records — one canonical host that serves, and its twin that redirects to it. Adding www.example.com does the same in reverse. You choose which side is canonical when you add the domain; the default is www if you typed a www. hostname, otherwise the apex.

A subdomain like app.example.com is not paired with anything — it just serves.

Two rules worth knowing:

• A hostname belongs to one project. Adding a name another project already claims fails with hostname_taken.
• Platform names are refused. You cannot add a camplax.app or camplax.dev address, or a hostname that impersonates Camplax.

Adding, verifying and deleting domains is owner-only — a teammate role can look, but cannot move your traffic.

The rest of the Domains page

The same page carries the edge controls that sit in front of every hostname on the project — *.camplax.app and custom domains alike.

Firewall

Rules evaluated at the edge, before your app is woken. Start with the switches:

Switch	What it does
Known bots and scrapers	Challenges clients with a Cloudflare threat score of 10 or more — on for new projects
High-risk IPs	Blocks requests with a threat score of 40 or more
SQL injection and XSS patterns	Blocks obvious attack patterns in the query string
Requests with no user agent	Blocks requests that present no User-Agent at all — on for new projects
Countries you do not serve	Blocks a list of ISO country codes you pick
Under Attack Mode	Challenges every visitor — the emergency switch

Below the switches you can write custom rules — an expression like http.request.uri.path matches "^/internal" with an action (block, challenge, managed_challenge, js_challenge, skip or log). Rules run in order and the first match wins. Health checks are exempt, so the firewall cannot take down the monitor that would tell you it did.

Rate limits

A limit is one sentence: N requests per period from the same caller, then block for a while. You pick the path, the count, the period, what counts as "the same caller" (IP address, an API-key header, a signed-in person, or IP plus path) and how long the block lasts — up to 10,000 requests per period and a day each for the period and the block. Because limits run at the edge, a limit on a sign-in route stops most credential stuffing before it costs you anything.

Maintenance

One switch puts up a holding page — your own title and message, served as 503 (or 200 if you prefer). Three options matter: let your own addresses through so you can check the fix on the real site, keep /api/* serving so mobile apps and webhooks keep working, and set an auto-off timer (up to 24 hours) so the page cannot outlive the outage by being forgotten. Deploys, migrations and this console keep working while it is on, and every window is recorded in a history list.

Preview gate

The switch that password-locks previews lives under Settings → Password-protect previews, because it is about the app, not a hostname. It is documented in Previews.

The API

Everything above is on the API under /v1/projects/:slug/domains:

Method	Path	What it does
GET	/domains	List the project's domains plus the CNAME target
POST	/domains	Add a hostname (owner only)
POST	/domains/:id/verify	Re-check hostname and certificate status
DELETE	/domains/:id	Remove a custom hostname (not the primary)
GET/POST	/domains/firewall	List and create firewall rules
PUT	/domains/firewall/presets	Toggle the preset switches
GET/POST	/domains/rate-limits	List and create rate limits
GET/PUT	/domains/maintenance	Read and set maintenance mode
GET/PUT	/domains/preview-gate	The preview password gate — see Previews

Under the hood: custom domains are Cloudflare custom hostnames — Cloudflare issues the certificate and proves ownership, and edge.camplax.app is the fallback origin your CNAME points at.