Custom domains & HTTPS

The Domains page connects a domain you own to a project and manages everything in your AWS account: the Route53 hosted zone, a free ACM certificate, and DNS records. The HTTPS CloudFront distributions themselves are attached from the Websites page.

Why use it

A custom domain is mostly about not being locked to someone else's hostname. The name your users bookmark, the origin your mobile app has pinned in a shipped binary, and the address in your OAuth provider's config are all expensive to change later — putting them on a domain you control means the backend behind them can move without any of it breaking.

There is also a concrete unblocking effect. Some integrations simply won't work on a shared platform hostname: Google OAuth requires an HTTPS callback on a domain you own, Apple's universal links need a verification file served from your domain, and cookies scoped to your own name are what let a site and its API share a session.

Everything lives in your AWS account — the hosted zone, the certificate, the CloudFront distribution — so disconnecting a domain from a project leaves the domain itself untouched.

Your site on your own name: example.com and www.example.com serving a published site instead of a project hostname.
A stable API origin: Point api.example.com at the project API so apps ship a SHOVELBASE_URL you control — required for Google OAuth, and the difference between a config change and an app-store release if the backend ever moves.
Environment-per-subdomain: staging.example.com and app.example.com on separate projects, sharing one zone and one wildcard certificate.
Email and verification records: Once the zone is here, the TXT/MX records for your mail provider and any domain-verification tokens are managed on this page too.

Surface	Availability
Portal UI	Connect a domain, view zone/NS/certificate status, manage DNS records
CLI	None — there's no `shovelbase domains` command
SDK / HTTP	None — script it via the Management API's domains/records endpoints instead

Connecting a domain

Enter the domain (e.g. example.com). shovelbase finds or creates its public hosted zone and requests an ACM certificate for example.com + *.example.com in us-east-1 (the region CloudFront requires), inserting the DNS validation records into the zone automatically. The page shows the zone's name servers — set those as the domain's NS entries at your registrar. Once the delegation is live, the certificate issues by itself, usually within minutes.

Attaching the domain

With an issued certificate, attaching lives next to the thing itself: on the Websites page next to each site, and on the Public APIs sub-tab for the project API. Type a subdomain — or leave it blank for the apex — and hit Attach. Behind the scenes shovelbase creates a CloudFront distribution and upserts the domain's alias A/AAAA records, so the name goes live as soon as CloudFront deploys (~5 minutes):

Websites — CloudFront reads the site's S3 files directly (the portal is not in the serving path) with the same semantics as the portal URL: index.html for directory URLs, trailing-slash redirects, 404.html for misses, assets cached at the edge. The site's row then shows the domain URL instead of the /sites/… one.
Public APIs — the project API, giving your apps an HTTPS SHOVELBASE_URL like https://api.example.com (needed for things like Google OAuth). Caching is disabled; all methods pass through.

Distributions follow CloudFront's pay-as-you-go/free-tier setup — SNI certificates, no WAF, no Origin Shield, nothing with a fixed monthly cost. Detaching tears the distribution down: the alias records are removed and the distribution is disabled immediately, then deleted once CloudFront finishes deploying the disabled state — it shows as “removing…” for those few minutes.

DNS records

The zone's records are listed inline, and you can add or delete A/AAAA/CNAME/TXT/MX/SRV records — e.g. the TXT and MX entries for your mail provider. The zone's SOA/NS records and CloudFront alias records are managed for you.

Disconnecting a domain (or deleting the project) only removes the link — the zone, certificate and distributions stay in your account.