# Use your company's own address for an internal tool

To serve an app from an address of your company, such as `tools.yourcompany.com`, connect the address on the app page and add two DNS records at your domain provider. Scava checks the records, issues the https certificate and serves the app there. This is available on the Team and Business plans.

## Steps

1. Open the app page at scava.ai and enter the address, for example `tools.yourcompany.com`. Use a subdomain. A bare domain such as `yourcompany.com` is not accepted, nor is an address that belongs to Scava.
2. Scava shows two DNS records. Create them at your DNS provider.

| Type | Name | Value |
|---|---|---|
| TXT | `_scava.tools.yourcompany.com` | `scava-verify=` followed by the token shown on the app page |
| CNAME | `tools.yourcompany.com` | `cname.scava.site` |

3. Press the check button on the app page. DNS changes can take a few minutes and sometimes up to an hour. The page tells you which record is still missing.
4. When both records are found, Scava requests the certificate. This takes a few minutes more. Then the address is live.

The TXT record proves that the domain is yours. The CNAME sends visitors to Scava. Both are needed.

## What changes for the app

- The Scava address (`...scava.site`) keeps working.
- The app runs under the same rules as before: its own origin, its own cookies, the same content security policy, the same permission check on every request. Nothing about the sign-in is weaker on an own address.
- When a colleague opens the own address and is not signed in, Scava sends them to sign in and then back to the own address. Scava returns only to the address that is live for this app. It does not redirect to any other address.
- Links in notification emails of the app can point to either address.
- Server code of the app cannot call the app's own address or Scava's addresses. Use `env.SCAVA` for data and files; see [Server code](/docs/server-code).
- Because an app can be served from either address, never write its address into its code. Use relative paths.

## Who can do it

- Only the owner of the app connects, changes or removes the address, and only in the browser. A co-editor sees the address but cannot change it. An agent cannot do it.
- Several apps may claim the same address, but only the claim whose token is found in your DNS goes live. Another app can never take over a live address. A claim without proof disappears after 7 days.
- If the plan of the owner falls below Team, the own address redirects to the Scava address until the plan fits again.

## Common problems

| Message | What to do |
|---|---|
| The TXT record is not there yet | Check name and value. Wait a few minutes. Some DNS providers add the domain name to the name automatically, so enter `_scava.tools` instead of the full name. |
| Point the address to cname.scava.site with a CNAME record | The CNAME is missing or points somewhere else. If an A or AAAA record exists for the same name, remove it first, then add the CNAME. |
| The certificate is being issued | Wait. This takes a few minutes. |