Domains and Secrets

Use this page after your application works on its host's default URL. These settings let you move traffic to a stable domain and provide server credentials.

Use Your Own Domain

On Cloudflare or Vercel, add a hostname to the config:

deploy: {
  target: 'cloudflare',
  domain: 'api.example.com',
}

Use a hostname without a scheme, port, path, or wildcard.

• Cloudflare: the zone must already exist in the same account. CloudConfig keeps existing routes and adds the hostname as a custom-domain route.
• Vercel: use target: 'vercel'. Deployment assigns the alias, but DNS must resolve to Vercel.
• Azure: omit deploy.domain. Automatic hostname and certificate binding is not implemented; use the Azure hostname or bind a domain and certificate in Azure separately.

Set the Sign-In Origin

Set the stable public origin in the ignored .env file or process environment:

BETTER_AUTH_URL=https://app.example.com

Use the scheme and hostname only, without /api/auth or another path. Declare this setting for deployment synchronization:

deploy: {
  secrets: ['BETTER_AUTH_URL'],
}

Register the corresponding callback URL with each sign-in provider. For GitHub:

https://app.example.com/api/auth/callback/github

Replace the example origin with your public URL. GitHub supports multiple callback URLs, so development and production callbacks can belong to the same OAuth app.

Changing hosts does not update provider registrations automatically. If you use Turnstile, update its allowed domains too. Run cloudconfig auth add github after setting BETTER_AUTH_URL to print the resolved callback URL.

Upload Application Secrets

Declare additional application secrets by name, then supply their values in .env or the process environment:

deploy: {
  secrets: ['STRIPE_KEY'],
}

The process environment takes precedence. A missing required value stops deployment and names the variable. Keep .env.example as a template containing placeholders; it is not loaded for development or deployment.

The auth and connect blocks determine their own required secret names. You do not need to list those credentials again in deploy.secrets.

For CI, provide values through the CI secret store. Keep credentials out of source files and committed environment files.