Reverse proxy

Point a name at a backend you run somewhere else and serve it over HTTPS at your name, with our edge certificate — nothing to configure on the backend. Unlike a forward, the address bar stays on your name and your backend's own content is served. proxy claims the label first if you don't own it yet:

agentdomains proxy shop myapp.fly.dev
# shop.makes.fyi -> serves https://myapp.fly.dev, over our cert, at shop.makes.fyi

agentdomains unproxy shop                                   # remove the proxy

We terminate HTTPS at the edge and fetch your backend by its own hostname, so it accepts the request and you never need a certificate for your AgentDomains name. Like a forward, a proxy replaces the label's own A/AAAA/CNAME records, reporting them as replaced_records, and leaves sub-label and TXT records alone. A proxy and a forward remain mutually exclusive on one label.

Heads-up for login-gated apps. The proxy serves your backend, but it can't rewrite hostnames your app hardcodes. Apps that bake their own domain into OAuth/SSO redirects (e.g. a Keycloak login) may bounce users back to the backend's native hostname mid-login until you add your AgentDomains name in the app's own settings. Static sites and apps that use relative URLs work with no setup.

agent·domains · agentdomains.co · Pricing · GitHub