--- title: "White-label branding and custom domains" slug: "reseller-white-label-branding" source: "https://app.cloudpe.com/help/reseller-white-label-branding" updated: "2026-08-30T19:03:44.029Z" --- # White-label branding and custom domains ## Overview White-label branding lets a reseller present CloudPe under its own identity: brand name, logo, colours, favicon, and support / terms / privacy links, served on the reseller's own custom domain. The public branding endpoint is host-scoped, so the login, signup and dashboard surfaces on a verified reseller domain render the reseller's brand instead of the platform's. Branding pairs with capability gating on end-customer accounts: on a reseller tenant the billing page shows wallet and usage amounts only (invoices, payment and bank-transfer tabs are hidden, no add-funds), provider KYC banners are suppressed, and the Support navigation item points at the reseller's own external support URL. Backend endpoints enforce this regardless of what the UI renders. Branding settings live in the reseller portal at `/reseller/settings/branding`; the domain lifecycle (add → verify → status → remove) is managed from the same page. ## Before you start - Your reseller organization must be active. The portal access check fails closed for suspended or soft-deleted reseller organizations. - The reseller organization owner has full portal access automatically after accepting the owner invitation. Non-owner staff need a reseller role assigned at the reseller organization scope — a globally scoped reseller role grants no per-organization permission and the portal returns a permission error. Reading branding requires `reseller_branding:read`; changing it requires `reseller:branding` (or `reseller:manage`, or organization ownership). Sensitive branding fields (bank details, government ID, verification token) stay restricted to the owner or a `reseller:manage` holder. - You need DNS control of the domain or subdomain you want to use — verification is done with a DNS TXT token you publish yourself. - A platform operator must point the domain at the platform (CNAME) and install an nginx server block plus a TLS certificate. Automatic SSL issuance for custom domains is not built; certificates are operator-managed. The edge vhost is rendered only for a domain that is verified, on an active reseller, and has a certificate present. - Google sign-in on a custom domain needs one manual operator step (registering the origin with Google) before the Google button appears on that host. ## Steps 1. Open the reseller portal and go to Settings → Branding (`/reseller/settings/branding`). 2. Set your identity: brand name, logo URL, primary colour and favicon. These drive the login, signup and dashboard surfaces on your domain, and the sidebar logo inside the portal. 3. Set your support, terms and privacy URLs. The support URL is what the Support navigation item opens for your end customers. URL fields reject `javascript:` and `data:` schemes. 4. Add your custom domain. The portal issues a DNS TXT verification token. 5. Publish the TXT record at your DNS provider, then run verification from the domain section. Check the current state with the domain status action at any time. 6. Ask CloudPe operations to point the domain at the platform and install the nginx server block and certificate. Once the domain is verified and the certificate is present, the edge configuration for that host is rendered automatically; removing or suspending the domain drops it on the next sync. 7. If you want Google sign-in on your domain, ask the platform operator to add your domain's https origin to the Google OAuth client's authorized JavaScript origins and record the attestation on your reseller record. Until that is done, the login and signup pages on your host simply omit the Google button. 8. Optionally configure signup settings for your domain (self-service customer signup is off by default; you can also require approval so new signups wait for you to approve them) and your invoice prefix. 9. Optionally review your email templates — the template scaffold seeds your own brand colour and emits the normalized brand colour variable, so a later branding change propagates to templates that use it. ## Limits & billing - Automatic SSL issuance for custom domains is not implemented; certificates are managed by platform operations. - The domain verification TXT token has no expiry or reconciler — re-verify from the portal if you rotate DNS. - Changing the custom domain resets the Google sign-in origin attestation, because that registration is per-origin. The operator must register the new origin before the Google button returns. - The reseller hierarchy is a single level: reseller → customer organizations. Sub-resellers are not supported, so branding cannot be delegated further down. - Branding is host-scoped: platform hosts are never affected by a reseller's settings, and a platform host is not gated by the reseller's Google origin flag. - On your branded domain, end customers see wallet balance and usage amounts only. Invoices, payment UI and provider KYC are suppressed; wholesale settlement with CloudPe stays a manual, out-of-band commercial process. - Statement PDFs generated for your billing records use text-only branding (brand name and accent colour); your logo URL is never fetched or embedded server-side. ## FAQ **Do branding changes reach my customer emails?** Yes, if your templates use the brand colour variable. The template scaffold is built from your own primary colour, and the branded email context exposes a normalized hex value so a later colour change propagates. **Why is there no Google sign-in button on my domain?** Because the origin has not been registered with Google yet. Until the operator adds your domain's https origin to the authorized JavaScript origins and records the attestation, the provider list on that host omits Google rather than rendering a button that would fail. **Can customers sign themselves up on my domain?** Only if you enable it. Self-service signup on a verified partner domain is off by default; you can turn it on from the portal signup settings, optionally with approval required so new accounts wait in a pending state until you approve them from your customers list. When it is off, `/signup` on your host shows an "accounts are created by invitation" notice with your support contact. **What happens to my domain if my reseller account is suspended?** Domain resolution fails closed — the tenant must be an active reseller with a verified domain — and the rendered edge configuration for that host is dropped on the next sync. **Does removing the custom domain break existing customers?** They stop reaching you on that host. Removing or changing a domain also invalidates the shared domain cache immediately across all replicas, so the change takes effect everywhere at once. ## Related - [Reseller portal overview](/help/reseller-portal-overview) - [Managing reseller customers](/help/reseller-customer-management)