---
title: Domain setup infrastructure
description: Build provider-connected domain setup into your SaaS with exact DNS plans, host-owned credentials, and React flows you control.
sidebar:
  label: Overview
  order: 1
seo:
  title: Domain setup infrastructure for SaaS
---

DomainKit is a TypeScript toolkit for building provider-connected domain setup into a SaaS product.
Your application defines the DNS requirements and owns the customer, credential, persistence, and
policy boundaries. DomainKit supplies the portable connection, planning, authorization,
verification, and cleanup lifecycle.

The package root is Effect-native. A secondary Promise facade is available for foreign runtime
boundaries. `@domainkit/react` provides browser-safe connection, provisioning, verification,
cleanup, and DNS record interfaces over a transport owned by the host application.

```package-install
domainkit
```

<CardGroup cols={2}>
  <Card title="Quickstart" href="/docs/quickstart" icon="rocket">
    Install DomainKit and build your first reviewable DNS plan.
  </Card>
  <Card title="Plans" href="/docs/core/plans" icon="file">
    Understand the immutable plan, authorization, apply, and cleanup lifecycle.
  </Card>
  <Card title="Connect providers" href="/docs/core/connections" icon="link">
    Add OAuth, integration, or API-token authorization without exposing credentials to the browser.
  </Card>
  <Card title="React UI" href="/docs/react" icon="component">
    Use complete flows or compose semantic parts into your own product.
  </Card>
  <ProviderCard title="Cloudflare" href="/docs/providers/cloudflare" provider="cloudflare">
    Connect with OAuth or scoped API tokens and discover the owning account.
  </ProviderCard>
  <ProviderCard title="Vercel" href="/docs/providers/vercel" provider="vercel">
    Preserve personal or team context from a Vercel Integration installation.
  </ProviderCard>
</CardGroup>

## Product boundary

| DomainKit owns                              | Your application owns                                  |
| ------------------------------------------- | ------------------------------------------------------ |
| Provider-neutral DNS requirements and plans | Product-specific DNS requirements                      |
| Digest-bound plan authorization             | Identity, tenancy, consent, and audit policy           |
| Cloudflare and Vercel provider integrations | Credential encryption and durable persistence          |
| Provider and public-DNS observation         | Authenticated routes and product readiness state       |
| Receipt-bound cleanup                       | When and how users may remove records                  |
| Browser-safe React lifecycle contracts      | Branding, surrounding UI, notifications, and telemetry |

## Safety model

- **Review before mutation.** A plan lists creates, exact no-ops, and conflicts before any write.
- **Authorize the digest.** Apply accepts the reviewed plan plus authorization for that exact digest.
- **Fail closed.** DomainKit never silently overwrites incompatible DNS state.
- **Keep the host in control.** Your application owns credential storage, consent, callback routes, persistence, and audit history.
- **One implementation.** The Effect API is canonical; the Promise API delegates to it.

## Packages

| Package             | Use it for                                                               |
| ------------------- | ------------------------------------------------------------------------ |
| `domainkit`         | Effect services, programs, schemas, typed failures, and provider modules |
| `domainkit/promise` | Promise facade for foreign runtime boundaries                            |
| `domainkit/testing` | In-memory capabilities and provider conformance tests                    |
| `@domainkit/react`  | Browser-safe flows and DNS record primitives over a host-owned transport |