← Documentation

Domains & HTTPS

Every app you deploy gets a working HTTPS URL immediately—including apps on servers with no public IP. When you're ready, point your own domain at it.

The generated URL

As soon as an app is running, Kaja gives it a hostname on a domain we operate, with a certificate already issued. You don't configure anything: no ingress, no cert-manager annotations, no DNS.

This works even when your server has every inbound port closed. Traffic arrives at Kaja's gateway and travels to your app over the same outbound connection the agent already holds open. See Connecting servers for how that channel is established.

Adding your own domain

Adding a custom domain is two independent steps: proving you own it, and pointing traffic at Kaja. They can happen in either order.

  1. In your project, open Domains and enter the hostname you want (for example api.acme.com).
  2. Kaja shows you two records:
    • a TXT record carrying a token unique to your organization—this proves ownership
    • a CNAME or A record—this routes real traffic
  3. Add them at your DNS provider.
  4. Click Verify. Kaja checks the TXT record and, once it resolves, marks the domain verified.

DNS propagation is not instant. If verification fails immediately after you add the record, wait a few minutes and try again—the error will tell you which record is still missing.

Why the ownership check exists

Without it, anyone could claim a hostname that belongs to someone else and intercept traffic intended for them. The TXT token is scoped to your organization, so a domain verified by you cannot be claimed by another organization while it remains yours.

Certificates

Once a domain is verified and pointing at Kaja, certificates are issued and renewed automatically. There is nothing to install and nothing to rotate.

Traffic and metering

Traffic that reaches your app through Kaja's gateway counts toward your plan's gateway allowance. Traffic served directly by your own load balancer or ingress never passes through us and is never metered. See Pricing for the current allowances.

Next steps

  • Apps — Deploy something to attach a domain to.
  • Projects — How projects isolate apps and their config.
  • Connecting servers — The outbound agent that makes private serving possible.