Docs
Docs
Open dashboard
Guides

Build it with AI

Copy one prompt into Claude Code, Cursor or ChatGPT and your coding agent wires Apexly into your codebase end to end, from the customer's hostname to webhooks and signature checks.

Paste this into a coding agent opened in your repository and it builds the whole integration with you: a server-only API client, the customer's "add your domain" screen, the webhook handler and the origin signature check. It reads these docs through llms.txt as it goes, so it uses current endpoints, not a guess.

Build it with AI

One prompt wires Apexly into your codebase end to end: domains, DNS, webhooks and signature checks.

  • Claude Code
  • Cursor
  • ChatGPT
You are integrating Apexly into this codebase, end to end. Apexly is custom domains as a service: my customers point their own hostname (for example careers.acme.com) at Apexly, and Apexly serves my app there with TLS, forwarding every request to my origin with the original Host header.

My setup:
- App id: <your app id: Settings, bottom of the page>
- Origin: <where your app lives, e.g. https://app.example.com>
- API base: https://api.apexly.dev
- API key: already in the env var APEXLY_API_KEY (test mode). Read it from the environment; never ask me to paste it.
- Signing secret: in the env var APEXLY_SIGNING_SECRET (whsec_…, Apexly dashboard → Settings → Signing secret).

Docs, the source of truth: read https://docs.apexly.dev/llms.txt first, then the guide for this stack (Next.js, NestJS, Rails, Laravel, Django or Go), the Quickstart and Webhooks pages. Do not guess endpoints or headers.

Do this, in order, in the style this codebase already uses:
1. Find the framework, ORM, auth and where tenants/accounts live. Tell me what you found and your plan before changing anything.
2. Add APEXLY_API_KEY and APEXLY_SIGNING_SECRET to .env.example (no real values) and a small server-only Apexly client: Bearer auth, timeouts, and errors read from { error: { code, message, fix } }.
3. Store the Apexly domain on the tenant: apexly_domain_id, hostname and status, with a migration.
4. Customer UI: in the tenant's settings, let them enter a hostname, call POST /v1/domains (send metadata with our tenant id), then show the DNS record from the response with a copy button, or link to its connect_url, and the live status.
5. Webhooks: an endpoint that verifies Apexly-Signature against the raw body (constant time, reject timestamps older than five minutes), handles domain.active, domain.dns_broken, domain.cert_failed and domain.deleted, updates the tenant, is idempotent on the event id, and replies 2xx within 10 seconds. Then tell me the URL to set in Settings → Webhooks.
6. Origin: middleware that verifies X-Apexly-Signature (HMAC-SHA256 of "<timestamp>.<host>" with the signing secret) on requests arriving through Apexly, and resolves the tenant from the Host header.
7. Make customer hostnames work everywhere: host allowlists, cookies, CORS, redirects and absolute URLs.
8. Tests for both signature checks and the webhook handler. Then give me the exact steps to try it end to end with a test key.

Rules: never log, commit or print keys or secrets; validate every input; keep the API key on the server. If anything is ambiguous, ask before guessing.
Paste into Claude Code or Cursor in your repo. In ChatGPT, attach your main files too.
The prompt in your dashboard already has your app id, origin and API base filled in, and includes a freshly created test key. Find it on the first-domain screen and in Settings, under Signing secret.

Which tool

  • Claude Code or Cursor: open the agent in your repository and paste. It reads your code, tells you its plan, then makes the changes.
  • ChatGPT or another chat: paste, then attach the files it asks for (your router or middleware, the tenant model, the settings page). Copy its changes back by hand.
  • Want the agent to manage domains too? Add the Apexly MCP server so it can create and check test domains while it builds.

Keep your keys safe

  • Use a test key while building: test domains never contact a certificate authority and walk every state on a ten-second timer. See Test mode.
  • The dashboard only ever puts a test key, never a live one, into the prompt. Live keys stay in APEXLY_API_KEY in your environment or secrets manager.
  • The signing secret is never in the prompt. The agent reads it from APEXLY_SIGNING_SECRET.
Was this helpful?