White-Labeling on Lovable: A Practical Guide to Vendor Custom Domains

There's a specific moment in a SaaS product's life when a customer stops using your platform and starts owning it, in their eyes: the moment their own domain shows up in the browser bar instead of yours. theirbrand.com, not theirbrand.yourapp.com.

That's what vendor custom domains deliver, and it's usually a premium-tier feature for good reason — it's genuinely more complex to build than it looks from the outside. This is the full walkthrough: what your customer does, what you configure on Cloudflare, what you build in your Lovable app, and where things typically break.

The One-Line Version

A vendor custom domain is a domain the customer already owns, connected to your platform so their traffic runs through your infrastructure while showing only their brand — no visible sign your platform exists underneath.

First, Know the Difference From Wildcard Subdomains

If wildcard subdomains aren't already live on your platform, build those first — they're the simpler path and often what customers use before upgrading to their own domain.

Step 1: What the Customer Does on Their End

This part happens entirely outside your app, in the customer's own DNS provider dashboard.

They add a CNAME record pointing their domain at your platform's fallback hostname:

theirbrand.com → cname.yourapp.com

The apex domain problem. Standard DNS rules don't technically allow a CNAME directly on a root/apex domain — only on subdomains like www. So depending on their provider, they'll need one of:

• CNAME flattening (Cloudflare and a few others do this automatically)
• ALIAS or ANAME records — a workaround record type some providers support specifically for this
• Domain forwarding — a lower-quality fallback some registrars (GoDaddy, for instance) offer when neither of the above is available

www needs its own record if they want www.theirbrand.com to also resolve — same target, separate CNAME.

Verification records. They'll likely need to publish a TXT record proving ownership, and possibly a second TXT record specifically for SSL domain-control validation, depending on how your verification is set up.

Step 2: What You Configure on Cloudflare

Turn on Cloudflare for SaaS. This add-on is what makes "custom hostnames" possible — accepting and routing traffic for domains you don't own.

Set a fallback origin. This is where Cloudflare sends traffic once it accepts it on behalf of a customer's domain.

Create the custom hostname programmatically, via the API, the moment a customer submits their domain. Use HTTP-based domain control validation where you can — it's faster than the TXT-record method and doesn't require the customer to leave a record in place forever. Set your minimum TLS version to 1.2.

Attach a Worker route per hostname, so traffic on the customer's domain runs through the same tenant-resolution logic as your regular subdomains.

Plan for deletion. When a customer removes their domain or cancels, clean up the Cloudflare-side hostname — don't let it sit there indefinitely.

Step 3: What You Build Inside Lovable

Four core functions:

• addDomain — takes the customer's domain, creates the Cloudflare hostname, saves a record
• verifyDomain — checks whether DNS has propagated and the domain is confirmed
• assignDomainToFunnel — links a verified domain to a specific tenant or funnel
• deleteDomain — tears down the Cloudflare hostname and the local record

And four business rules layered on top:

• Gate the feature behind the right pricing plan
• Cap how many domains each workspace can add
• Block one customer from claiming a domain another customer already has
• Only allow a domain to be assigned to a funnel that belongs to the same workspace that added it

Step 4: The Status Flow

Domains move through: pending → verifying → verified, or pending → verifying → failed.

• Pending — just submitted, no check run yet
• Verifying — actively checking DNS and any required TXT records
• Verified — DNS confirmed, SSL issued, domain live
• Failed — didn't verify within your attempt window

Support this with a backoff schedule (check frequently at first, less often over time), a hard cap on attempts, a background job that periodically sweeps pending domains in case propagation just took longer than expected, and email notifications so customers know the second their domain goes live — or exactly what's wrong if it doesn't.

Step 5: What to Store

Your custom_domains table needs:

Two supporting tables round it out:

• cf_hostname_cleanup_queue — orphaned Cloudflare hostnames waiting to be deleted asynchronously
• workspaces.custom_domain_limit — per-workspace override of your default domain quota

Step 6: Handling It When Things Break

Don't show raw Cloudflare errors. Codes like 1014 (usually a DNS/CNAME misconfiguration on the customer's side) and 1000 (often a record pointing somewhere unrecognized) mean nothing to a non-technical customer. Translate them into plain instructions instead.

Message clearly if your own platform isn't ready yet — if Cloudflare for SaaS isn't fully configured on your end, don't let a customer hit a raw API error trying to add their domain.

Run a janitor job that finds Cloudflare hostnames with no matching active database record and removes them — this keeps your account from silently accumulating dead entries over time.

Confirming a Domain Is Actually Live

curl -I https://theirbrand.com

Look for 200, a valid certificate, and routing headers confirming the request reached your Worker and resolved to the correct tenant — not just that DNS technically resolves.

If you've built a diagnostics panel, four checks tell you almost everything: DNS record presence, SSL certificate status, Cloudflare hostname status, and the funnel assignment in your own database.

Want This Built on Your Platform?

Vendor custom domains touch DNS, SSL, and multi-tenant routing all at once, which is exactly why it's one of the more failure-prone features to build without prior experience. AIFun implements this Cloudflare-and-Lovable setup for SaaS platforms directly — reach out if you want it running reliably on your app.