Portal domain (custom staff login URL) — Certivus Help

Use the Settings → Integrations → Portal domain card to register a custom URL for your team's daily login, e.g. portal.your-firm.co.uk instead of app.certivus.com.

This is part of the White-label add-on. If you see a paywall card instead of the setup form, contact us to enable the bundle.

Why bother

Your team sees your brand in the browser bar instead of ours, every minute of every day.
Looks professional when sharing internal links in Slack / Teams (https://portal.your-firm.co.uk/firm/clients/123 vs https://app.certivus.com/firm/clients/123).
Reduces accidental cross-tenant clicks if your team works with multiple Certivus-powered firms.
It does NOT change anything client-facing — KYC links, emails, and WhatsApp go where they always went (the verify-link and email-sending cards control those independently).

Who can use this

Your firm needs the White-label add-on (a monthly retainer; one entitlement covers all four white-label cards).
Within your firm: firm-owners and managers can register, verify, or remove the domain.

Pick a domain

A dedicated subdomain is strongly recommended over your apex domain:

✅ portal.your-firm.co.uk
✅ app.your-firm.co.uk
✅ staff.your-firm.co.uk
⚠️ your-firm.co.uk (apex) — works, but consumes the root of your domain; harder to undo

You can only register one portal domain per firm at a time. To change it, remove the current one first.

Setup walkthrough

Click "Connect your portal domain" and enter the host you want, e.g. portal.your-firm.co.uk. Use lowercase, no https:// prefix, no trailing slash.
Add the two DNS records the card shows you at your domain registrar (Cloudflare, GoDaddy, 123-Reg, whoever holds your DNS):
- A TXT record at _certivus-verify.portal.your-firm.co.uk with the token shown on the card. This proves you own the domain.
- A CNAME record at portal.your-firm.co.uk pointing to cname.vercel-dns.com. This routes traffic to our hosting.
- For apex domains only: replace the CNAME with an A record pointing to 76.76.21.21.
Click Verify. DNS propagation usually takes 5–30 minutes — if Verify fails immediately, wait 10 minutes and try again. We don't lock you in any state; you can click Verify as many times as needed.
We provision an SSL certificate automatically. No action from you. The card flips to a green Verified state once the certificate is live (usually within 1–2 minutes of verification).
Share the new URL with your team — they can bookmark https://portal.your-firm.co.uk/ and use it for everything. Existing sessions on app.certivus.com keep working — both hosts route to your firm, the user just sees different branding in the URL bar.

How sign-in works (the half-second flicker)

When a staff member signs in on portal.your-firm.co.uk — whether via Rajoka ID SSO, password, or password-reset link — the OAuth dance bounces through app.certivus.com for a fraction of a second to complete the auth handshake, then lands back on your domain with a working session.

You'll see a brief flicker of app.certivus.com during the redirect. This is normal. It's the reason we don't have to register every firm's domain with our auth provider — one canonical handoff URL is enough forever.

Common questions

Will Rajoka ID SSO work on my portal domain? Yes. The bounce-through described above means Rajoka ID doesn't need any per-firm config on our end. It just works.

What about password resets? The reset link in the email goes to app.certivus.com/auth/handoff?firm_host=... then bounces back to your domain. The user lands at portal.your-firm.co.uk/auth/reset-password and the rest of the flow proceeds as normal.

Will existing bookmarks still work? Yes. Both app.certivus.com and your portal domain route to your firm. Anything bookmarked on app.certivus.com continues to work indefinitely — it's just no longer branded as your firm.

What if my DNS provider doesn't support CNAME on portal.? Most providers do. If yours doesn't, switch to a different subdomain (e.g. app.your-firm.co.uk) or use Cloudflare in front. CNAMEs at the apex (@) aren't supported by DNS — use an A record to 76.76.21.21 instead.

Can I have multiple portal domains? No, one per firm. If you want both portal.your-firm.co.uk and app.your-firm.co.uk to work, point both at our hosting via CNAME and only one will resolve to the firm — the other will show an error page. Pick a single canonical host.

Removing the portal domain

Click the trash icon, confirm, and the domain is detached immediately.

Staff currently signed in on the portal host stay signed in until their session expires. Their bookmarks break the next time they navigate.
New logins happen on app.certivus.com.
The DNS records you added at your registrar become safe to delete (the TXT record especially; the CNAME can stay or be removed).
You can re-register the same domain later if you change your mind.

Troubleshooting

Verification fails with "DNS TXT record not found":

Check the TXT record exists at the exact host shown on the card (e.g. _certivus-verify.portal.your-firm.co.uk, not portal.your-firm.co.uk).
Check the value matches the token shown on the card with no extra quotes or whitespace.
Wait 10 minutes for DNS propagation, click Verify again.
Use dnschecker.org to confirm the TXT record is live globally.

Verification fails with "DNS routing not configured":

Check the CNAME record points to cname.vercel-dns.com (or A record to 76.76.21.21 for apex).
Some DNS providers add a trailing dot (cname.vercel-dns.com.) — that's correct.
Cloudflare users: make sure the orange cloud (proxy mode) is OFF for the CNAME. Proxied CNAMEs don't end at Vercel.

Sign-in fails on the portal host with "Authentication tokens missing":

This usually means the auth bounce didn't complete. Try signing in again from the portal host.
If it persists, sign in on app.certivus.com instead and contact us — there's a configuration issue on our side.

Sign-in fails with "That firm domain is not registered":

This shouldn't happen if your domain shows as Verified on the card. If it does, click Re-verify on the card and try logging in again.