On this page

This page is the white-label preview-domain entry point. The canonical routing and production-domain contract lives in Deployment Domains.

Custom domains are layered. Do not treat one wildcard as the whole product. Sandbox previews, production deployments, App Engine apps, computers, and exact customer hostnames each have their own routing rules.

For the full current model, start with Deployment Domains and White-label setup.

Current domain layers

LayerExampleCurrent management path
Sandbox preview domainhttps://5173-sbx01j9x.sandbox.cliniciq.comTenant, workspace, or project preview-domain routes
Standard deployment fallbackhttps://lead-magnet.cliniciq.miosa.appReturned by deployment APIs
App Engine managed fallbackhttps://lead-magnet.cliniciq.miosa.appReturned by App Engine publish APIs
Exact deployment domainhttps://program.drsmithclinic.comDeployment custom-domain API
Computer custom domainhttps://desktop.drsmithclinic.comComputer custom-domain API

Always display the URL returned by the backend: preview_url, desktop_url, public_url, or url. Do not construct hostnames in frontend code or SDK code.

Add this CNAME record at your DNS provider

For wildcard preview or app domains, delegate traffic to MIOSA:

FieldValue
TypeCNAME
Host* (wildcard)
Valueproxy.miosa.ai
TTL300 - 600 seconds
Proxy status (Cloudflare only)DNS only - gray cloud

Within a few minutes, use the relevant verify action in MIOSA. Preview domains are self-service. Exact deployment and computer domains are self-service. Tenant-level deployment-domain routing exists, but tenant-level management is operator-assisted.

How it works

After a domain is configured and verified, MIOSA’s router:

  1. Confirms the hostname belongs to the tenant, workspace, project, computer, or deployment.
  2. Issues or reuses the TLS certificate.
  3. Routes the request to the current sandbox, computer, standard deployment, or App Engine container.

Security note: Domain ownership and tenant scope are checked before MIOSA routes traffic.

Troubleshooting

My sandbox URL returns a TLS error or cert warning

  • DNS hasn’t propagated yet - wait a few minutes.
  • If using Cloudflare, verify proxy status is DNS only (gray cloud).
  • Confirm the record exists:
dig +short "*.your-domain.com" CNAME
# Expected: proxy.miosa.ai.

My sandbox URL returns 502 or 503

Your sandbox isn’t running, or no HTTP server is listening on the port you’re requesting. The DNS chain is correct - your sandbox just needs to serve traffic.

My sandbox URL returns 400 or “URL not connected”

The slug doesn’t match any sandbox in your tenant. Confirm the sandbox is in running state and that the slug (first 8 hex chars of the sandbox UUID) matches the leftmost label of the hostname.

Disconnecting

To stop using your custom domain: remove the CNAME from your DNS provider, or open Settings → Domains in MIOSA and click Disconnect. After disconnecting, the next request to <slug>.<your-domain> will fail to issue a certificate. The domain becomes available to bind to a different tenant after the cache expires.

Optional - explicit registration via Settings → Domains

Open Settings → Domains or use the custom-domain APIs to register the domain before sending traffic. MIOSA returns the DNS records and verification status.

See also

Was this helpful?