Get a Free Custom Domain from Your License (Managed Cloudflare Tunnel)

Every eligible OneSigner license includes one free public HTTPS address on our infrastructure — like https://yourname.onesigner.com — powered by a managed Cloudflare Tunnel. No domain purchase, no Cloudflare account, no port-forwarding, and a valid TLS certificate out of the box. This guide walks the whole flow for real, from claiming the subdomain to seeing your portal live on the internet (we use demo.onesigner.com throughout).

How it works

When you claim a subdomain, our system provisions a named tunnel on our Cloudflare account, creates the DNS record and points the ingress at your chosen local port. You get a connector token; the OneSigner service uses it to run cloudflared on your machine, which opens an outbound connection to Cloudflare. Visitors reach https://yourname.onesigner.com → Cloudflare → the tunnel → your OneSigner app. Nothing ever connects inbound to your network.

Requirements

• An active OneSigner license (trial or paid) on your onesign.sg account.
• OneSigner installed and running — see the Installation Guide.
• The app's port set to 9440 (default) or anything in 9200–9440. Other ports are not accepted.

Step 1 — Claim Your Subdomain

Sign in at onesign.sg → My Licenses → open Custom domain next to your license:

• Subdomain — 3–63 characters: lowercase letters, digits, hyphens. Names like www, mail or admin are reserved.
• Local port — must match the port set in OneSigner's General tab (here we use 9430).

Important: you can choose the subdomain only once per license — changing it later requires support. Preview your address, then click Create my public domain and confirm:

Step 2 — Copy the Tunnel Token

Provisioning takes a few seconds. The page then shows Your public domain and the Tunnel token:

Click Copy next to the token. Keep it secret — anyone who has it can serve traffic on your domain. (This page stays available; you can come back for the token any time.)

Step 3 — Configure OneSigner

On the machine running OneSigner, open OneSigner Config → Custom Domain tab:

1. Click Download cloudflared if the status shows "Not found" (one-time, ~52 MB — status turns to OK Found).
2. Tick Enable Custom Domain.
3. Paste the token into Tunnel Token (it displays masked; tick Show token to double-check).
4. Put your new address into Public URL.
5. Click Save Tunnel Settings, then restart the service (General tab → Restart).

After the restart the service launches and supervises cloudflared for you — no extra window, nothing to keep open:

Step 4 — Verify

Give it up to a minute for the first connection, then open your address from any network — your portal is live over HTTPS:

You can also click Check connection on the portal's Custom domain page — it pings your app through the tunnel:

Managing Your Domain

• Changed the app's port? Update it on the portal's Custom domain page too (Local port → Update port) — the tunnel follows within seconds. Port changes are limited, so don't churn them.
• Subdomain is fixed — pick carefully; changing it requires support (the old tunnel is deleted and you create a new one).
• Token leaked? Contact support to rotate it.
• License lifecycle: the domain is tied to your license — if the license expires or is cancelled, the tunnel is revoked automatically.

Troubleshooting

Next: put the address to work — give tenants remote access, point CI pipelines at it, or send eSign requests your recipients can open from anywhere.