Custom Domains

A custom domain lets an Enterprise team send share links and secure request links on a subdomain it owns, such as secure.example.com, instead of crs.sh. Recipients open the link on your domain and see your team's custom branding.

Your DNS stays with your own provider. You add one record there, and we take care of the certificate: it is issued and renewed automatically.

What a custom domain does not cover:

• The app, sign-in and the paste tool stay on CredenShare's own addresses.
• A root domain (example.com) can't be used; use a subdomain.
• A team has one custom domain.

Custom domains are on the Enterprise plan. On other plans the settings page shows an Enterprise note instead.

Set it up

1. Go to My Teams, open the team, and select Custom domain. Only the team's owner and admins see it.
2. Under Your subdomain, enter the subdomain, for example secure.example.com, and select Add domain.
3. The page shows the record to add. Each value has a copy button:

   Type	Name	Value
   CNAME	your subdomain, e.g. secure.example.com	domains.crs.sh

4. Add the record at your DNS provider. Some providers want only the first part of the name (secure) and add your domain themselves.
5. Wait for the page to move through its three steps: Waiting for DNS, Issuing certificate, then Live. It checks again on its own; Check again checks right away.

DNS changes can take a while to spread, so the first step may take a few minutes or longer, depending on your provider.

At common DNS providers

Elsewhere, look for a "CNAME" record type. If the provider shows your domain next to the name field, enter only secure.

A CNAME can't share its name with other records at most providers, so choose a subdomain that is not already in use.

Use it for new links

Once the domain is live, Use for new links is on. New share and request links from the team then use your domain:

• in the app;
• through the API: GET /v1/capabilities returns it as link_origin for a team key (null when the team has none);
• in the secure request links the MCP server creates for a team key;
• in the command-line tool from version 0.4.0, and the SDKs from 0.5.0, with a team key. Each of them can be pointed at another origin instead.

Links you have already sent keep their address. Turning Use for new links off sends new links back to crs.sh without removing the domain.

Your domain opens only your team's shares and requests. Any other link opened on it looks like a link that doesn't exist.

Remove it

Remove domain asks you to confirm.

• If the domain was live, links already sent on it keep working for 30 days: they redirect to crs.sh, and the link still opens. After 30 days, links on the domain stop working.
• If it never went live, it is removed right away.

You can then delete the CNAME record at your provider.

The same happens if the team leaves the Enterprise plan or is deleted.

Troubleshooting

Related

• Custom branding: the logo, colours and copy recipients see
• Teams and contexts: which links belong to a team