Managed proxies

A managed proxy serves the widget script, stylesheet, and API from a subdomain on your domain — for example c.example.gov.sg — instead of https://confetti.gov.sg. Use one when your Content-Security-Policy (or network policy) cannot allowlist a third-party host. Confetti provisions the hostname, issues the TLS certificate, and routes traffic.

Prefer a managed proxy over running your own reverse proxy. Operate a Cloudflare Worker only if you need to terminate the proxy yourself.

Add a managed proxy

Create the hostname in Confetti

Team owners can add a customer subdomain under Team settings → Managed Proxies. Choose a neutral name without words such as analytics, tracking, or confetti — for example c.example.gov.sg.

Create a DNS-only CNAME

Confetti shows a CNAME target. At your DNS provider, create:

c.example.gov.sg  CNAME  <target-shown-in-team-settings>

The record must be DNS-only. Do not flatten it, and do not replace it with an A or AAAA record.

If this hostname is in Cloudflare DNS, follow Disable the orange cloud before you wait for the status to change. Cloudflare proxies new CNAMEs by default, and a proxied record will not validate.

Wait until the status is Live

The row moves from Waiting for DNS to Issuing certificate, then Live. That can take a few minutes after the CNAME is visible. Use Diagnose if it stays on Waiting or shows Action needed.

Copy the Live URL from Team settings and pass it as proxyUrl. Allowlist the same origin in your Content-Security-Policy instead of https://confetti.gov.sg. Keep your website origin in Authorised Domains — that list is the page that embeds the widget, not the proxy host.

<PopoverConfetti
  surveyId="<your-survey-id>"
  publishableKey="<your-publishable-key>"
  proxyUrl="https://c.example.gov.sg"
/>

script-src https://c.example.gov.sg;
style-src https://c.example.gov.sg;
connect-src https://c.example.gov.sg;

Disable the orange cloud

Cloudflare DNS turns Proxy status on by default for new CNAME records. That is the orange cloud icon in the DNS table. Turn it off for the Confetti hostname.

A managed proxy will not become Live while the record is orange-clouded. Leave it DNS-only after it is Live as well — do not turn the orange cloud back on.

Cloudflare dashboard

Open the Cloudflare dashboard and select the zone that owns the hostname (for c.example.gov.sg, that is example.gov.sg).
Go to DNS → Records.
Add a CNAME, or edit the record you already created:

Field Value
Type CNAME
Name The host label only, e.g. c
Target The value shown in Team settings → Managed Proxies
Proxy status DNS only
TTL Auto
Confirm Proxy status is DNS only. The cloud icon next to the record must be grey, not orange. Click the cloud to toggle it if it is still orange.
Save. Do not switch the record back to Proxied.

Field	Value
Type	CNAME
Name	The host label only, e.g. `c`
Target	The value shown in Team settings → Managed Proxies
Proxy status	DNS only
TTL	Auto

See Cloudflare's proxy status docs for what the orange and grey cloud icons mean.

Terraform, Pulumi, or the Cloudflare API

Create a CNAME to the target shown in Team settings and set proxied to false. In the Cloudflare API the field is "proxied": false. A proxied record is the orange cloud; false is DNS only.

Why DNS-only is required

Confetti issues the certificate through Cloudflare for SaaS. That flow looks up your hostname and expects a CNAME to Confetti's target.

An orange-clouded record is flattened: public DNS answers with Cloudflare anycast A and AAAA addresses, not the CNAME. Certificate validation then stalls, and Diagnose tells you to use a DNS-only CNAME and disable the orange cloud.

Confetti already terminates TLS and proxies widget traffic. Putting the customer record behind Cloudflare's HTTP proxy (including orange-to-orange) is not supported for managed proxies.

Troubleshooting

Run Diagnose on the managed proxy row after you change DNS. It re-checks the CNAME, certificate, and CAA records.

Symptom	What to do
Stuck on Waiting for DNS	Confirm the CNAME target matches Team settings exactly. If the zone is on Cloudflare, set Proxy status to DNS only and wait a few minutes.
Diagnose: DNS CNAME failed	The hostname is missing, wrong, flattened, or orange-clouded. Recreate it as a DNS-only CNAME.
Action needed after the CNAME looks correct	Click Retry to restart certificate issuance, then Diagnose again.
CAA check mentions Cloudflare's CAs	If you publish CAA records, they must allow Cloudflare to issue for this hostname. Remove an overly strict CAA policy or add Cloudflare's certificate authorities.
Widget 404s after the proxy is Live	Pass the Live `https://` URL as `proxyUrl`, and allowlist that origin in CSP. Setting `proxyUrl` without a live proxy will 404.

Need help?

Email confetti@open.gov.sg or reach out in Slack #confetti (internal use only).