How do I set up a domain for Flows?

Before a Flow can run, you need a verified domain. Flows sign in to your site and run on a schedule, so AccessLint only runs them against a hostname you’ve proven you control.

You can start authoring a flow right away against an unverified domain: the DNS wait overlaps the authoring. Verification is what’s needed before the flow can actually run.

Add the domain

In your dashboard, open Domains.
Under Add a domain, enter the hostname you want to monitor: a bare host like example.com (no https://, no path). Click Add domain.
The domain appears in your list marked Unverified. Click it to open the verification instructions.

Verify ownership

Complete any one of the three methods below, then click Verify. AccessLint shows you the exact token to use on the domain’s page: the values below are examples.

Option 1: DNS TXT record

Add a TXT record to your domain with this exact value:

accesslint-verify=YOUR_TOKEN

DNS changes can take a few minutes to propagate. If verification doesn’t succeed right away, wait a moment and click Verify again.

Option 2: Meta tag

Add this tag to the <head> of your homepage:

<meta name="accesslint-verify" content="YOUR_TOKEN">

Option 3: Well-known file

Serve a plain-text file at https://example.com/.well-known/accesslint-verify containing the token, nothing else:

YOUR_TOKEN

Once any method succeeds, the domain is marked Verified and shows which method was used. You can now author a flow against it.

If the journeys you want to monitor are behind a login, set up sign-in on the domain. This is the only place credentials are ever discussed, and AccessLint never asks you for one. The Authentication card appears on the domain’s page once it’s verified.

Pick a Method:

None: the site is public. Nothing to configure.
Managed inbox: sign in as an address we own. The option to use for a site behind a login.

Choosing the managed inbox and clicking Save authentication issues a test account address ending in @accesslint.email, shown with a copy button. Then:

Invite or register that address as a user in your app, exactly as you’d onboard a real teammate. Give it whatever role the journey needs.
AccessLint receives that mailbox’s mail, so when a run asks your site for a sign-in email, it can read the magic link or one-time code and continue. You never share a password with us.
Optionally set an Entry path (where the login lives, if it isn’t /), and a Signed-in check if the automatic heuristic gets it wrong on your app. The check can require that the URL contains or omits some text, or that the page shows text like “Sign out”.

The card shows Sign-in not verified yet until it has worked once. Run a flow by hand to check it works: scheduled runs don’t start until the first successful sign-in. Manual and dry runs are never gated on it, precisely so you can prove it out.

Two things to know:

On sites that only offer passwords, AccessLint uses the password reset flow and sets a throwaway password it never stores, logs, or returns.
Sign-in emails that route their links through an unbranded click tracker (a link rewritten to something like sendgrid.net) are deliberately not followed, because we only follow links back to your own host and its subdomains. If your sign-in email does that, sign-in will not complete.

Once a run signs in successfully, the session is reused so later runs skip the login entirely.

Removing a domain

From a domain’s page, click Remove domain. This deletes the domain and all of its flows, so remove a domain only when you no longer want to monitor it.