The connect flow

Every connect session resolves to one URL: https://app.dodomain.io/connect/<token>. You can hand that link to your user directly (zero code on your frontend) or open the same flow in a modal on your own page with the @dodomain/connect widget.

Provider detection

When the user lands on the connect page, DoDomain detects which DNS provider manages the domain and picks the best available path for that provider. The session's detect endpoint (POST /api/v1/sessions/:token/detect) powers this — it identifies the provider, the registrable zone, and the nameservers.

Connect tiers

• Cloudflare one-click — for domains on Cloudflare, the user grants a scoped OAuth consent and DoDomain writes the records for them, verifies via the Cloudflare API, and then deletes its token. A real one-click.
• Guided manual — the universal fallback for every other provider: provider-specific deep links plus copy-paste instructions for each record, with live per-record verification so the user sees each record turn green as it propagates.

Whatever the path, verification is always done against the domain's authoritative nameservers — not a cache — so a green result means the records are really live.

The widget

@dodomain/connect is an embeddable browser widget: a modal iframe over the hosted flow, so your user never leaves your page.

import { showDoDomain } from "@dodomain/connect";

// token comes from your server's POST /api/v1/sessions call
showDoDomain({ token: session.token, onVerified: () => location.reload() });

Install with npm install @dodomain/connect. The widget is MIT-licensed with zero runtime dependencies.

Sessions are short-lived capabilities

A session token (dd_sess_...) is a single-session bearer capability: whoever holds it can read that session and trigger its verification. It travels inside connectUrl by design and is safe to hand to the browser — but treat it like a password-reset link: keep it out of logs and analytics, and send it only to the user doing the connecting. Sessions expire 24 hours after creation; after expiry every session endpoint answers 410 expired, and an expired session can never be verified.

SSL

DoDomain writes and verifies the DNS that points a customer's domain at your infrastructure — TLS terminates at your host (Vercel, Cloudflare for SaaS, Caddy, nginx, and similar setups). DoDomain does not proxy traffic or issue certificates for you.