Customer domains

1. Attach the domain with ctx.domains.
2. Pick the customer from props.host in a page.
3. Sign users in on the customer’s domain.

​

Attach a domain

import { action, v } from "@pylonsync/functions";

export default action({
  args: { hostname: v.string() },
  async handler(ctx, args) {
    const d = await ctx.domains.add(args.hostname);
    // Show the customer:
    //   CNAME  d.hostname  →  d.cnameTarget
    //   plus the TXT records in d.ownership and d.dcv
    return d;
  },
});

​

Pick the customer from the host

import { use } from "react";
import type { PageProps } from "@pylonsync/react";

export default function Home({ host, serverData }: PageProps) {
  // Your own lookup: which customer owns this hostname, if any.
  const tenant = use(serverData.fn<Tenant | null>("tenantForHost", { host }));
  if (!tenant) return <MarketingHome />;
  return <TenantHome tenant={tenant} />;
}

• A forged Host header gives "". A page cannot be made to render another customer’s content by a header the server does not trust.
• host is part of the SSR cache key. Each host gets its own cache entry, so a page with export const revalidate stays cacheable.
• The browser receives the same value in the hydration payload.

​

Sign users in on the customer’s domain

• Email and password, magic codes, passkeys. These run on the customer’s domain directly. The session cookie is host-only on that domain, also when PYLON_COOKIE_DOMAIN is set for your own domain, because a browser drops a cookie whose Domain= does not cover the host.
• OAuth (Google, GitHub, and others). The provider only knows your app’s one registered callback URL, on your own host. Pylon moves the sign-in to the customer’s domain with a one-time code.

const callback = `https://${location.host}/`;
const res = await fetch(
  `/api/auth/login/google?callback=${encodeURIComponent(callback)}`,
);
const { redirect } = await res.json();
location.href = redirect;

1. The start request sets a short-lived, host-only cookie on the customer’s domain. It binds the sign-in to this browser.
2. The provider returns the browser to your app’s callback. The callback does not set a session cookie on your host. It redirects to https://<customer domain>/api/auth/handoff?code=….
3. The handoff request, on the customer’s domain, checks the code and the binding cookie, creates the session, sets the cookie, and redirects to the callback URL.

• is 32 random bytes, and only its SHA-256 is stored,
• works once, for 120 seconds,
• works only on the domain it was made for,
• works only in the browser that started the sign-in, so a code sent to another person cannot sign them in to the sender’s account.