# Cloudflare for SaaS

Use this if you're on shared hosting or a platform where you can't run Caddy, or if you want Cloudflare's network in front of customers' domains.

Cloudflare issues and renews the certificates; JustDocs registers each customer domain with Cloudflare through its API and reports progress.

Cloudflare charges per custom hostname beyond a free allowance; see [Cloudflare for SaaS pricing](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/). Customers should use subdomains: a bare domain behind Cloudflare is an Enterprise add-on unless their DNS provider flattens CNAME records.

1. Add your platform domain to Cloudflare; your nameservers must point to Cloudflare.
2. Create a **proxied** DNS record for the address customers will point at, for example `customers.your-domain.example`, as an A record to your server.
3. Under **SSL/TLS → Custom Hostnames**, enable Cloudflare for SaaS and set the **Fallback Origin** to that address.
4. Set **SSL/TLS → Overview → encryption mode** to **Full**. Your server needs a certificate of its own; a Cloudflare Origin Certificate is fine.
5. Create an API token under **My Profile → API Tokens → Create Token → Custom token** with the permission **Zone → SSL and Certificates → Edit** on your platform domain.
6. Copy the **Zone ID** from the domain's Overview page.
7. In **Admin → Settings → Custom domains**, choose **Cloudflare for SaaS**, set the CNAME target to `customers.your-domain.example`, and enter the zone ID and the token.

Once a customer adds their domain and the TXT record is found, JustDocs creates the custom hostname in Cloudflare, and Cloudflare validates it after the CNAME is in place. If Cloudflare asks for anything extra, such as its own TXT record, the customer sees that request on the domain. Removing a domain also removes its custom hostname from Cloudflare.