keenauth_custom_domain

The keenauth_custom_domain resource adds a custom login domain to the environment. See Set up a custom login domain for what the domain serves and how verification works.

resource "keenauth_custom_domain" "login" {
  hostname = "login.example.com"
}

output "dns_records" {
  value = keenauth_custom_domain.login.dns_records
}

Lifecycle

• The domain starts in pending_dns. Publish the TXT and CNAME records in dns_records at your DNS provider; the platform verifies them and issues the certificate.
• status, is_primary, failure_reason and certificate_expires_at follow the platform's checks. They are read-only and never cause a plan change.
• Write hostname in lower case without a trailing dot. Write internationalized names as A-labels (xn--…).
• Changing hostname replaces the custom domain.
• Removing the resource releases the domain: sign-in on that domain stops and the name stays in quarantine for 30 days.
• The primary domain cannot be removed; the API answers 409 custom_domain_in_use. Make another domain primary first, in the dashboard or with keenauth custom-domains make-primary.
• A domain released outside the provider is removed from state and planned again.
• The development environment has no custom domains.

Import

Import by hostname or by ID:

tofu import keenauth_custom_domain.login login.example.com
tofu import keenauth_custom_domain.login cdom_01j9zq3v8c5m2x7k4t6r1n0b3d