ShippedHTTPS
Give visitors an encrypted connection to your site. Shipped handles certificate management for supported application domains.
Publish with an encrypted connection
Shipped gives your application an HTTPS endpoint for browser and API traffic. That protects data in transit between the client and the public endpoint. Use HTTPS URLs consistently in your application, including links, API addresses, and authentication callbacks, so a secure page does not accidentally depend on an insecure resource.
Bring HTTPS to your own domain
Connect a domain you control and complete the required DNS and ownership checks. Shipped manages certificate issuance and renewal for the verified hostname. Keep those domain records correct when changing DNS providers or other settings, since a certificate workflow depends on continued domain control and the ability to validate it.
Keep application security in view
HTTPS is one part of protecting an application. Your code still controls login, access permissions, cookie settings, and the data returned to each user. Keep private responses out of public caches, store credentials as secrets, and review application redirects and embedded assets when moving an existing site to its new domain.
A little more detail
Questions about HTTPS?
Does HTTPS make a private API public-safe by itself?
No. HTTPS protects the connection. Your API still needs appropriate authentication, authorization, input validation, and limits on what each caller can read or change.
What do I need to do for my custom domain?
Add the domain in Shipped, configure its DNS records, and complete ownership verification. Leave the required records in place so the domain and certificate can continue to be validated.
From your workspace to the web