Use your own domain for artifact apps

Topline can publish approved live artifact apps at a company-owned subdomain, such as apps.example.com. Your company keeps control of its registrar and DNS provider. Topline manages verification, TLS, and routing after an account admin adds the records shown in the product.

Custom domains apply only to published artifact apps. They do not change the Topline workspace address, draft or version-review routes, or the identity provider's callback domain.

Connect one or more domains

An account admin opens Account > Domains, enters a subdomain the company owns, and adds the displayed CNAME records at the company's DNS provider. Topline shows the connection moving through these states:

• DNS needed: add the ownership and routing records, then select Verify DNS.
• Provisioning: keep all displayed records in place while Topline validates and attaches TLS. A separate Validate TLS record can appear during this step.
• Connected: the domain is ready for published artifact apps.
• Needs attention: correct the displayed failure, keep the DNS records in place, and retry the connection.
• Removing: Topline is detaching TLS before it forgets the domain.

You can connect multiple owned subdomains. Select Make default on one connected domain to make it the initial choice for new artifact addresses. Changing the default does not move existing artifact apps.

Use a subdomain such as apps.example.com. Apex domains, wildcard domains, and domains under topline.build are not accepted by this workflow.

Give a published app its address

The artifact owner opens the artifact's Share drawer and finds Web address under external sharing. Choose any connected company domain, enter a unique path such as sales-dashboard, and select Save address.

The resulting customer-facing URL is clean:

https://apps.example.com/sales-dashboard/

Topline does not add its internal viewer token to that displayed URL. The workspace default is preselected for a new address, but the owner can choose a different connected domain. One domain can serve multiple artifact apps when each app has a different path.

Changing an artifact's custom address does not publish a draft or widen its audience. The app must already have an approved live deployment, and its General access setting remains authoritative:

• Anyone with the link can open the live app.
• Specific people must sign in with an approved email address.
• Topline members only must still have current workspace or artifact access.

Protected viewers briefly return through Topline's stable sign-in domain and then come back to the same customer URL. The custom domain never becomes an Auth0 callback or passkey domain. Access is rechecked on app requests, so removing a named viewer, workspace member, or artifact grant takes effect even if that person signed in earlier.

Move an app back or remove a domain

Select Use Topline address beside an artifact's current custom address to detach that route without turning off the artifact's existing external-sharing policy. The Share drawer returns to the Topline-hosted live address when one is available. You can then choose another connected domain or path.

A domain cannot be removed while any artifact address still uses it. Move each listed artifact back to its Topline address or to another connected domain, then return to Account > Domains and select Remove. Topline first detaches and deletes the managed TLS certificate; do not remove the DNS records until the domain finishes leaving the Removing state.

Troubleshooting

• If ownership verification fails, copy the record exactly and wait for the DNS provider's current TTL before retrying.
• If TLS remains in Provisioning, confirm that every displayed validation record still exists and is not being proxied by the DNS provider.
• If Save address reports that a path is in use, choose another path or move the artifact currently using it.
• If a protected viewer is denied, confirm the person used the approved email and still has the required viewer or workspace access.
• If Remove is disabled, move the artifacts counted on that domain first.

DNS propagation and certificate issuance are external operations. A saved DNS record or a successful ownership check is not proof that the domain is connected; wait for the product to show Connected before sharing its URL.