NanaadeNanaade Developers
Browse documentation
Deployment

Domains, TLS, routing, and cookies

Nanaade runs a shared multi-tenant application. A new tenant hostname normally points to the shared production deployment; it does not require a separate branch or server.

Recommended: Nanaade subdomain

Tenant portal:     https://portal.northbridge.edu
Nanaade workspace: https://northbridge.nanaade.ai
Nanaade API:       https://api.nanaade.ai

Nanaade registers both browser origins, provisions the tenant hostname at the production edge, and configures TLS. The production session cookie can be shared across Nanaade-managed subdomains where required.

Tenant-owned custom domain

For https://careers.northbridge.edu, coordinate all of the following:

  1. Add domain ownership/verification records requested by the hosting edge.
  2. Route DNS using the exact CNAME or A record supplied by Nanaade/hosting provider.
  3. Wait for a valid TLS certificate before testing SSO.
  4. Register the exact HTTPS origin in the SSO allowlist.
  5. Configure edge routing to the Nanaade frontend and exchange path as designed.
  6. Validate host-only cookie behavior on the final domain.

Exact-origin examples

| URL | Same origin as https://portal.northbridge.edu? | |---|---| | https://portal.northbridge.edu/login | Yes; path is ignored in origin comparison. | | https://www.portal.northbridge.edu | No; hostname differs. | | http://portal.northbridge.edu | No; scheme differs and production requires HTTPS. | | https://portal.northbridge.edu:8443 | No; explicit port differs. |

Do not register wildcard origins. Vercel preview deployments have changing hostnames; use a stable staging domain such as https://portal-staging.northbridge.edu and separate staging credentials.

Cookie implications

Nanaade production cookies are HttpOnly, Secure, and SameSite=None. On Nanaade hosts they can use .nanaade.ai. A cookie cannot be shared from api.nanaade.ai to careers.northbridge.edu; a custom-domain architecture must route the exchange in a way that causes the browser to receive a cookie valid for that custom host.

Deployment verification

Use browser developer tools to confirm the form request carries the expected Origin, the response returns 303, the cookie is accepted rather than blocked, and the final Location uses an approved host/path. Never copy session-cookie values into tickets or screenshots.