Domains and ownership checks

A subscription domain has to be verified: that way nobody can pose as you by putting your ID into their own subscription. FlowLock stores the name of the verified domain and its SHA-256 hash; the apps tell the server only the hash of the domain the subscription came from.

Add a domain

1. Cabinet → “Domains” → enter the name (sub.example.com) or a whole subscription link: the cabinet takes the domain from it.
2. Verify it in one of the ways below. The cabinet shows ready-made values to copy.
3. Press “Check”, or just wait: the cabinet checks a new domain by itself every hour for the first 72 hours.

TXT record

At your registrar or in your DNS panel (Cloudflare and others):

_flowlock.sub.example.com.  TXT  "flowlock-provider=k7m2x9q4bd"

The record name is _flowlock. in front of your domain. The subdomain may have any number of other TXT records: the cabinet looks among them for the one equal to flowlock-provider=<ID>.

File on the website

The file https://sub.example.com/.well-known/flowlock-provider with the text:

flowlock-provider=k7m2x9q4bd

The file must be served directly from this domain: port 443, a valid certificate, status 200, no redirects, at most 4 KB. A domain that points to a private address (10.x, 192.168.x and so on) can't be verified this way.

Statuses

If a check fails, the cabinet gives the reason: there is neither a record nor a file; the record exists but with a different ID; DNS didn't answer; the file is served with a status other than 200; the file couldn't be downloaded; the domain points to a private address.

Important

• The exact name is verified: sub.example.com and example.com are different domains, and www. is separate too. The port doesn't matter: sub.example.com:2096 = sub.example.com.
• Internationalised domains can be entered as they are (подписка.рф): the cabinet converts them to punycode.
• An IP address can't be verified: subscriptions served by IP work as ordinary ones.
• Don't remove the record or the file: the cabinet re-checks the domain once a day. A lost domain comes back by itself as soon as a check passes again.
• Several providers can verify the same domain, each with their own TXT record (for example, a shared panel).
• Up to 50 domains per cabinet, and up to 20 manual checks per hour.

Addresses for moving a subscription (new-url, new-domain, fallback-url), for the “Change the address” command and for limited links must also be on your verified domains.