Build your storefront

Domains and going live

Add a hostname, point DNS at the platform, get a certificate, decide what it serves, and take the password off on launch day.

A domain is the thing in front of everything else. It decides which hostname buyers type, what that hostname serves, whether it is reachable at all, and whether it is protected while you build.

Before you begin. You need access to the DNS for the domain, at your registrar or wherever the zone is hosted. That is often a different person than the one running the shop project, and waiting for them is the most common reason a launch date slips. Ask early.

The four states a domain moves through

StateWhat it meansWhat is missing
UnconfiguredAdded, but DNS has not verifiedThe DNS records
ProtectedServing, behind a loginThe go-live
LiveServing publicly with a valid certificateNothing
RedirectServing a 301 to another hostNothing; this is a finished state

Add the domain

  1. Go to Experience Studio › Domains and select Add domain.
  2. Enter the hostname as a lower-case fully qualified name: shop.acme.com. No wildcards.
  3. Pick the tenant it belongs to.
  4. If this domain should not serve a shop but send visitors elsewhere, enable Redirect (301) instead of a site and set the target. Path and query are preserved. Use this for an apex (acme.com → www.acme.com) or a domain move (acme.ch → acme.com).
  5. Create it. The required DNS records are shown next.

Point DNS at the platform

Open the domain and go to the DNS & TLS tab. It lists the exact records to set, with their TTL. Follow that list; it is specific to your domain and to whether it serves a site or a redirect.

Two things worth knowing before you open your DNS provider:

  • A subdomain such as shop.acme.com can take a CNAME pointing at the platform edge.
  • An apex such as acme.com cannot take a CNAME. Either use your DNS provider's CNAME flattening (sometimes called ALIAS or ANAME), or point www at the platform and redirect the apex to it.

Set the records at your provider, then select Verify DNS. Propagation is usually under a minute. If verification fails, the per-record diagnostics show what was expected and what was found, nearly always enough to spot a typo or a record that landed in the wrong zone.

Once verification passes, a Let's Encrypt certificate is issued for you, usually within a minute. Upload your own certificate (the full PEM chain plus the private key) only if you cannot use automatic issuance. You can revert to ACME later; the uploaded certificate is then removed.

Decide what it serves

On the domain's Overview tab, under Routing:

  • Self-hosted storefront: point the domain at one of your deployed sites.
  • Theme: serve an installed theme on the shared platform runtime.
  • Not routed: clear the target. The domain resolves and serves nothing.

Pick one and select Apply routing. A domain showing Not routed under Serving in the list answers requests with nothing, which looks identical to an outage from the outside.

Keep it private until launch

While you build, protect the domain under Access. Switch it from Public to Protected and it sits behind HTTP Basic Auth:

  • Credentials: the usernames and passwords that get through. Add one per person or one per party; a label makes it possible to revoke the right one.
  • Allowed IPs & ranges: full access without a login, for your office range or a trusted system. 10.0.0.0/8 or 203.0.113.5.
  • Public paths: reachable without a login even while protected. Health checks and webhook endpoints belong here: /api/*, /health.
  • Protected-only paths: the inverse. Only these need a login, everything else stays public. Useful when you want the catalog open but /checkout/* closed during a pilot.
Basic Auth is a construction fence, not a customer login. It is one shared password with no identity behind it, and it blocks search engines and link previews completely. Never use it to gate customer pricing. That is what a logged-in-only price list is for.

Go live

When the storefront is ready, use Go-Live on the domain. That removes the preview protection and makes it publicly reachable. Do the pre-launch checks first. Going live is a single click and the internet notices quickly.

What to check

  • The list shows Status: Live, DNS Status: Active, and the right target under Serving.
  • The certificate on the DNS & TLS tab shows an issuer and a valid-until date in the future.
  • https:// works and http:// does not stay on http://.
  • If you run several country domains, confirm they cross-reference each other correctly. See Languages and markets.

When it does not work

  • Verification keeps failing: read the expected-versus-found diagnostics. A record set on shop.acme.com.acme.com is the classic: the provider appended the zone to a name you had already written in full.
  • The certificate stays pending: verification has not passed, or a CAA record on the zone forbids the issuer.
Deleting a domain revokes its certificate and tears down its routing. Traffic to that hostname stops being served. There is no undo beyond adding it again and waiting for DNS and a new certificate.

Next

Themes and branding

Install a theme, configure it once globally, override it per market, and keep the logo somewhere sane.

Languages and markets

A market is a business context: its locales, its currencies and its tax classes. Model it once and the storefront, the prices and the content follow.