Your own domain

webmati domain — add your domain, the DNS record to publish, verification, HTTPS (behind Cloudflare too), the primary address.

Run it inside the project folder (it works on the project's website). Outside a project, add --store <slug>.

webmati domain add shop.brand.com                 # 1. add it; prints the DNS record to publish
webmati domain verify shop.brand.com --wait       # 2. wait until DNS proves the domain
webmati domain ssl shop.brand.com full            # 3. HTTPS (when behind Cloudflare)
webmati domain primary shop.brand.com             # 4. make it the primary address
webmati domain list                               # see them all

The website's plan must include custom domains; otherwise add says Your current plan does not include custom domains (with a Vietnamese line).

1. Add: `domain add`

webmati domain add shop.brand.com

Added shop.brand.com to my-shop (pending).

Publish ONE of these records at the domain's DNS host:
  TYPE   NAME                                VALUE
  TXT    _webmati-verify.shop.brand.com      webmati-verification=<token>
  CNAME  shop.brand.com                      <cname_target>

Publish one of the two records where the domain's DNS is managed, copied exactly as the CLI prints it (the values are your domain's own):

TXT always works, and it is the only proof behind Cloudflare's orange cloud (Cloudflare hides the CNAME).
CNAME is for DNS that is not proxied; most DNS hosts cannot put a CNAME on an apex (brand.com).
Either way, traffic must still reach <cname_target>: the CNAME does that, and so does a proxied Cloudflare record pointing at it.

The host is normalised: https://, a trailing / and a trailing dot are dropped, and it is lower-cased.

2. Verify: `domain verify`

webmati domain verify shop.brand.com
webmati domain verify shop.brand.com --wait                # tries again after 15s, 30s, then every 60s
webmati domain verify shop.brand.com --wait --timeout 30m

While it does not verify, the command says what it found (a TXT record holding an older value to replace, say, or no CNAME), prints the records again, and exits with code 3. DNS can take minutes to hours to spread, so a failure right after an edit is normal. Once verified:

shop.brand.com is verified and serves the website.
HTTPS: letsencrypt (pending). Behind Cloudflare, match its SSL/TLS mode: `webmati domain ssl shop.brand.com flexible|full|full_strict`.
To make it the address canonical URLs and redirects use: `webmati domain primary shop.brand.com`.

3. HTTPS: `domain ssl`

Pick by the domain's SSL/TLS mode on Cloudflare:

On Cloudflare	Command
not behind Cloudflare, or a grey cloud	`webmati domain ssl shop.brand.com letsencrypt`
Flexible	`webmati domain ssl shop.brand.com flexible`
Full	`webmati domain ssl shop.brand.com full`
Full (strict)	`webmati domain ssl shop.brand.com full_strict --cert-file origin.pem --key-file origin.key`

Full: the platform issues its own certificate the first time Cloudflare connects over HTTPS. Keep Always Use HTTPS off on Cloudflare until the site answers: the certificate check comes in over plain HTTP.
Full (strict) needs a certificate Cloudflare trusts: a Cloudflare Origin Certificate (Cloudflare ▸ SSL/TLS ▸ Origin Server ▸ Create). Save the certificate and the key to files and pass them with --cert-file / --key-file. The key file is sent sealed and never printed. Without both files the command exits with code 2 and explains this.
manual is for a certificate of your own, with the same two flags.

4. Primary address: `domain primary`

webmati domain primary shop.brand.com

From then on canonical URLs, sitemaps and redirects use this domain. It must be verified first.

List and remove

webmati domain list
webmati domain remove shop.brand.com

list prints every domain (the platform's built-in address too) with its type, status, HTTPS and which one is primary; for a custom domain that is not verified it adds the records to publish and the last check.

remove asks first ([y/N]; "no" exits with code 3). Removing does not fix a domain that will not verify or serve: read verify and ssl first. The built-in address stays, and adding the domain back later keeps its TXT value. In scripts use --yes (required with --json).

Exit codes

0 done · 1 refused or failed · 2 bad usage (an unknown subcommand or mode, a missing host, full_strict without the files) · 3 needs your attention (not verified, also when --wait runs out; "no" to remove).

Keys approved before version 0.1.3

From CLI 0.1.3 on, the CLI's key carries domain access. A key approved before 0.1.3 does not: run webmati login --web once inside the project for a new key, then use webmati domain.