Use your own domain for artifact apps

Topline can publish approved live artifact apps at a company-owned subdomain, such as apps.example.com. Your company keeps control of its registrar and DNS provider. Topline manages verification, TLS, and routing after an account admin adds the records shown in the product.

Custom domains apply only to published artifact apps. They do not change the Topline workspace address, draft or version-review routes, or the identity provider's callback domain.

Connect one or more domains

An account admin opens Account > Domains, enters a subdomain the company owns, and adds the displayed CNAME records at the company's DNS provider. Topline shows the connection moving through these states:

• DNS needed: add the ownership and routing records, then select Verify DNS.
• Provisioning: keep all displayed records in place while Topline validates and attaches TLS. A separate Validate TLS record can appear during this step.
• Connected: the domain is ready for published artifact apps.
• Needs attention: correct the displayed failure, keep the DNS records in place, and retry the connection.
• Removing: Topline is detaching TLS before it forgets the domain.

You can connect multiple owned subdomains. Select Make default on one connected domain to make it the initial choice for new artifact addresses. Changing the default does not move existing artifact apps.

Use a subdomain such as apps.example.com. Apex domains, wildcard domains, and domains under topline.build are not accepted by this workflow.

At a DNS provider that asks for a host relative to the domain, enter only the part before the domain. For example, if Topline shows a record named _topline.apps.example.com and the provider displays .example.com beside its host field, enter _topline.apps. Enter apps for apps.example.com. Copy each value/answer from Topline exactly. Check the provider's saved record list to ensure it shows the full names once, without a duplicated .example.com suffix. Keep the ownership, routing, and later TLS validation records in place.

Choose an app path

The artifact owner changes the app's page name in the Addresses section of App access: select Edit on the Topline address and change Page name. An app without a page name gets one suggested from its name, such as scheduling-job-pool, instead of its item ID. Use 1–64 letters, numbers, hyphens, or dots, starting and ending with a letter or number. Topline trims surrounding spaces and saves letters in lowercase. For example, team.stack stays team.stack.

Enter the path itself, rather than a full URL. A dotted path is the part after the domain, such as /team.stack/; choosing it does not require buying a domain or changing DNS. The path must be available, and reserved platform paths cannot be claimed. If saving fails, the editor explains how to correct the path or choose another one. Use the item ID instead of a page name removes the page name.

Claiming a path does not publish a draft. An app needs an approved live deployment before its live path can open the app.

Give a published app its address

From Account > Domains, select Connect an app on a connected domain. Choose a live app you own; Topline opens its company website editor with that domain selected. Review the full URL and select Save address. Selecting an app alone does not change its address or audience.

If you start domain setup from an artifact, use Return to app address to continue after DNS and TLS are connected. In the company website editor, the domain list includes Set up a new domain…, which opens Account > Domains.

An app's addresses are the Addresses section of App access. The owner gets there three ways: the address chip under the artifact title (it reads Add address before the app has one), the App access button, or Manage addresses in Item details. The section lists every address for the app; all of them open the same live version and follow App access. The Topline address is tagged Main unless a company website is set. Each address has Edit, and the section has Add address and a Domains and DNS setup link to Account > Domains. Address links open in a new tab and use the saved address, never an unsaved preview; each row has a copy button. Draft and live test routes lists the draft and live routes for testing.

Edit on the Topline address opens Edit address. Its Address type choice switches between Topline address and Company website (the company option opens the company website editor). The editor shows https:// [Site name] .<company host>/ [Page name] / with the editable parts highlighted: enter an optional Site name such as stack and a Page name such as sales.v2. One status line under the field says what can be changed or why extra site names are unavailable. The preview shows the new address next to the current one until you select Save address. Add another address at the bottom of the editor opens Add address.

To add another Topline site name, select Add address and choose Another Topline address. Extra site names share the app's page name and can be copied or removed with Remove. If the main address has no page name yet, Add address explains why and offers Set page name, which opens the main address editor.

Topline handles the connection for hosted company addresses; app owners do not need code or AWS access. While Topline checks, the editor's status line shows "Checking whether extra site names are ready…". If extra site names are not set up for the workspace yet, it says so and offers Check again. Another Topline address is then unavailable, so Add address opens the company website form directly. It is unavailable only when the app already has its company website. The main address editor shows only the page name. The main address and any connected company website still work. Extra site names arrive with a workspace update. The check does not start an infrastructure change. Topline’s approved setup-runner lane still owns domain provisioning and applies.

To use a company website, select Add address and choose Company website. Choose a connected domain, enter a unique path such as sales-dashboard, and select Add address. Domains still waiting on DNS are listed but cannot be chosen yet. Without a connected domain, the form lists the three setup steps (enter a subdomain such as stack.yourcompany.com, add the DNS records Topline shows, come back and pick the page name) and offers Set up a domain and DNS. Each app has one company website. Once saved, the Company website row is tagged Main and offers copy and Edit. The company website editor changes its page name without changing the website or audience, links to DNS settings, and offers Remove this address. An address whose domain is still waiting on DNS is listed with Finish DNS setup. DNS and TLS status for company domains stays in Account > Domains. Customer-owned websites still use the admin connection flow described above.

If only the page name saves, the drawer reports the partial result, retains the site-name draft, and allows a retry. No complete-address success is shown until both writes succeed.

The resulting customer-facing URL is clean:

https://apps.example.com/sales-dashboard/

Topline does not add its internal viewer token to that displayed URL. The workspace default is preselected for a new address, but the owner can choose a different connected domain. One domain can serve multiple artifact apps when each app has a different path.

Changing an artifact's custom address does not publish a draft or widen its audience. The app must already have an approved live deployment, and its App access > Live app access setting controls external sharing:

• Anyone with the link can open the live app.
• Only people added means app users must sign in with an approved email address.
• For access through Topline, add people as Viewer or Editor in Topline access, or grant workspace access. This also permits draft and version review.

See public and authenticated sharing steps for the exact controls, recipient sign-in, and revocation behavior.

Protected viewers briefly return through Topline's stable sign-in domain and then come back to the same customer URL. The custom domain never becomes an Auth0 callback or passkey domain. Access is rechecked on app requests, so removing a named viewer, workspace member, or artifact grant takes effect even if that person signed in earlier.

Move an app back or remove a domain

In App access, select Edit on the Company website row, then Remove this address, to detach that route without turning off the artifact's existing external-sharing policy. The app returns to its Topline-hosted live address when one is available. You can then choose another connected domain or path. Topline remembers this choice: editing the page name or app content does not switch the app back to the workspace's default company website. Choose a company website explicitly when you want to use one again.

A domain cannot be removed while any artifact address still uses it. Move each listed artifact back to its Topline address or to another connected domain, then return to Account > Domains and select Remove. Topline first detaches and deletes the managed TLS certificate; do not remove the DNS records until the domain finishes leaving the Removing state.

Troubleshooting

• If ownership verification fails, copy the record exactly and wait for the DNS provider's current TTL before retrying. If the domain was just registered, also confirm that its registrar has active nameservers and that public DNS can resolve the domain at all. A record visible in the provider's editor can still be unavailable publicly while registration or nameserver delegation propagates.
• If TLS remains in Provisioning, confirm that every displayed validation record still exists and is not being proxied by the DNS provider.
• If Save address reports that a path is in use, choose another path or move the artifact currently using it.
• If a protected viewer is denied, confirm the person used the approved email and still has the required viewer or workspace access.
• If Remove is disabled, move the artifacts counted on that domain first.

DNS propagation and certificate issuance are external operations. A saved DNS record or a successful ownership check is not proof that the domain is connected; wait for the product to show Connected before sharing its URL.