The white label replaces OpenWAF's identity with your agency's. It has three independent parts, all in White label and all managed by admins of the whole organization:
| Part | What your customers see |
|---|---|
| Brand | Your name, logo, accent colour and support email |
| Dashboard domain | The dashboard at dash.youragency.com, painted with your brand |
| Own nameservers | ns1.youragency.com and ns2.youragency.com instead of *.ns.openwaf.dev |
Brand
The brand is used:
- in the dashboard, when it is opened on your dashboard domain;
- in the sign-in emails sent from that dashboard;
- in the access-gate emails of your domains;
- on the Branded block page of your domains.
In White label › Brand, enter the Display name, the Accent colour (#rrggbb) and the Support email, then select Save brand. Under Logo, choose an SVG or PNG file and select Upload logo.
openwaf-cloud ctl brand set name="Acme Digital" accent=#2456e8 [email protected] --reason "Brand"
openwaf-cloud ctl brand showUpload the logo from the dashboard or the API.
curl -X PUT "https://dash.openwaf.dev/v1/orgs/$ORG/brand" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-d '{"name": "Acme Digital", "accent": "#2456e8", "support_email": "[email protected]"}'
curl -X PUT "https://dash.openwaf.dev/v1/orgs/$ORG/brand/logo" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: image/svg+xml" \
--data-binary @logo.svg- Display name: up to 100 characters, without line breaks or angle brackets.
- Accent colour:
#rrggbb. The dashboard warns when white button text on it would not meet WCAG AA contrast (4.5:1). - Logo: SVG or PNG, up to 256 KB (PNG up to 4096×4096 pixels). SVGs are sanitised: scripts, event handlers and external references are removed, so check the result after uploading. Set the name and colour before the logo.
Dashboard domain
Serve the dashboard at a host name you control, for example dash.youragency.com.
In White label › Custom dashboard domain, enter the Host name and select Save domain. Use a subdomain: a CNAME cannot live at the root of a domain.
At the DNS provider of
youragency.com, create the record shown:dash.youragency.com. CNAME custom.openwaf.dev.If your DNS provider offers a proxy for records (such as Cloudflare's orange cloud), turn it off for this one.
Select Check now. When the CNAME resolves, the status goes from Pending to Active and OpenWAF issues the HTTPS certificate automatically (Let's Encrypt). There is nothing to upload.
The same steps from the CLI: openwaf-cloud ctl whitelabel domain dash.youragency.com --reason "…", then openwaf-cloud ctl whitelabel verify. In the API: PUT /v1/orgs/{org}/whitelabel/domain with {"host": "…"}, then POST /v1/orgs/{org}/whitelabel/domain/verify.
How it behaves:
- On your domain, people sign in with an email code only. Google and GitHub sign-in are only offered on
dash.openwaf.dev. - Sign-in emails requested on your domain carry your brand only for people who are already members of your organization; anyone else gets the standard OpenWAF email. The link in the email always opens
dash.openwaf.dev; the 6-digit code works on either host. - OpenWAF re-checks the CNAME every hour. If it no longer points to
custom.openwaf.dev, the domain goes to Error and stops serving the dashboard until you fix the record and check again. - A host name inside an active domain of another OpenWAF organization is refused with
409 host_taken.
To stop using it, select Remove domain; then you can delete the CNAME.
Own nameservers
Give your customers nameservers with your name. This needs an ownership TXT record and address records in your domain: see Custom nameservers.