- App (frontend):
your-app.apps.yourcompany.com - API:
your-app.api.apps.yourcompany.com
console.mycompany.com — by placing your own reverse proxy in front of the app’s
existing hosts. The deployment itself doesn’t change: you tell the app which
public URLs to advertise, and your proxy routes your domain to the internal hosts.
Vanity URLs use a bring-your-own reverse proxy model. You keep control of DNS,
TLS, and routing for your domain; Synthetiq just makes the app emit the right
public URLs (OAuth issuer, redirects, cookies, API base). There’s no change to how
the app is built or deployed.
How it works
/api plus the OAuth/OIDC surface at /oauth, /auth, /.well-known, and
/mcp. Your proxy maps your public domain onto those.
Configure the app’s public URLs
Set two values on the production app:/gateway is an arbitrary routing prefix — name it anything (/backend,
/edge, …). Just avoid the app’s own top-level paths (/api, /oauth, /auth,
/.well-known, /mcp); /api would produce awkward …/api/api/… URLs.--app-url "".
What your reverse proxy must do
Your proxy sits in front of your domain and forwards to the app’s internal hosts, rewriting theHost header so Synthetiq’s edge routes to the right app.
1
Terminate TLS for your domain
Serve
console.mycompany.com with your own certificate.2
Route the API base to the internal API host
Send everything under
api_url to your-app.api.apps.yourcompany.com, with Host
rewritten and the api_url path prefix (e.g. /gateway) stripped. The app mounts
/api (data), /oauth, /auth, /.well-known, and /mcp beneath api_url — all
of these must reach the API host.3
Route everything else to the internal frontend host
Send all other paths to
your-app.apps.yourcompany.com (the static frontend), with
Host rewritten.The internal hostnames are your app’s default URLs — the Production URL shown in
the Domain tab (
your-app.apps.yourcompany.com) and its API counterpart
(your-app.api.apps.yourcompany.com).Example: Cloudflare
This example servesconsole.mycompany.com, with the API under /gateway, using a
Cloudflare Worker for the routing.
1
Add the domain to Cloudflare
Add a proxied (orange-cloud) DNS record for
console.mycompany.com. The Worker
(next step) intercepts every request and connects to Synthetiq’s hosts itself, so
this record’s target is never used as an origin — it exists only so the hostname
resolves through Cloudflare (which runs the Worker and terminates TLS). Use a
placeholder target: an AAAA record pointing to 100:: (or an A record to
192.0.2.1), with Proxy status: Proxied. Grey-cloud (DNS-only) will not work.
Cloudflare provisions TLS automatically.2
Deploy the Worker
Create a Worker with the routing below and bind it to the route
console.mycompany.com/*. Replace the two origin hostnames with your app’s defaults.3
Set the URLs and redeploy
Set
app_url / api_url on the app (above) and redeploy. Then sign in at
https://console.mycompany.com to confirm the login round-trip works end to end.CORS
With the path layout (api_url = https://console.mycompany.com/gateway) the frontend
and API share one origin, so there is no CORS to think about.
With the subdomain layout (api_url = https://api.console.mycompany.com) the
frontend and API are different origins, so requests are cross-origin — but this is
handled automatically, the same way the default two-host deployment already is
(its frontend and API also live on different hosts). The app allows browser
requests whose Origin matches app_url. So it just works, provided:
- You set both
app_urlandapi_url— CORS is keyed toapp_url(the frontend origin). Setting onlyapi_urlleaves the app allowing the default host, and your frontend’s calls would be rejected. - Your proxy forwards the
Originheader unchanged and passesOPTIONSpreflight requests through to the API host (standard proxy behavior).
Notes and limitations
- Redeploy required. Setting or changing a vanity URL only takes effect on the next deploy.
- Use your vanity URL once it’s live. The app then advertises only your domain
for login and API calls, so opening the default
your-app.apps.yourcompany.comURL won’t work as an entry point — its API calls are rejected (CORS) and its login won’t complete. The internal hosts do stay network-reachable behind Synthetiq’s edge (that’s how your proxy reaches them); to restrict them to proxy-only access, ask us about origin hardening.

