Symptoms
- Vercel Settings, Domains shows the name, but the certificate is Pending, Invalid, or flips back.
- Chrome padlock missing; a leftover Squarespace or Webflow certificate in the error.
- The site loads on the vercel.app host and 404s or shows an old landing page on the apex.
- www works and the apex does not, or the reverse.
Why this bites AI-built apps
Lovable and Bolt give you a preview host. A custom domain is a DNS job the generator cannot finish. People add the domain in Vercel, then add a CNAME at the registrar, often to an old host, and wait five minutes. Certificates need the exact A and CNAME pair Vercel printed, and they need competing records gone.
The actual fix
- Vercel, Project, Settings, Domains: add yourdomain.com and www.yourdomain.com.
- Copy the records on that screen. Typically an A on the apex (Vercel anycast IPs) and a CNAME on www pointing at cname.vercel-dns.com. Use what the dashboard shows today, not a blog post from 2022.
- At the DNS host, delete leftover A, AAAA, CNAME, and ALIAS records for those names that still point at Webflow, Netlify, Squarespace, GitHub Pages, or a previous Vercel project.
- Do not put a CNAME on the apex if the host also has MX/TXT and forbids flattening. Use the A record Vercel gave you, or the host ALIAS/ANAME.
- Wait. Refresh the Vercel domain page until the certificate is green. Do not click Add again; that creates duplicates.
- Once green, update every callback: Supabase Site URL, OAuth redirects, Stripe webhook, success_url, and any VITE_SITE_URL. Then redeploy so baked-in URLs change.
Apex and www are two hostnames. Redirect one to the other in Vercel after both certs are green, so OAuth is not registered on the host you then bounce away from.
How to know you are done
Incognito load of https://yourdomain.com shows a padlock and the current app, not a host parking page. www lands in the same place. Stripe and Google callbacks use the custom domain, not the vercel.app URL.
A 12-click version lives in ops/deploy-on-vercel.md in this repo.