OEM Onboarding

Launch your AI site in 10 minutes

This guide walks you from zero through the OEM white-label integration: customise the brand, bind a domain, issue API keys, configure commission settlement. Everything is point-and-click in /admin — no code changes required.

Brand Domain API key Commission

Onboarding overview

An OEM tenant is a fully isolated billing / branding / user pool, separate from every other tenant on the platform. A typical onboarding runs through the steps below in order.

01
Request a tenant
Create one at /admin/tenants and grab the tenant slug.
02
Upload branding
Logo · primary colour · tagline · compliance copy in one form.
03
Bind your domain
Add one CNAME record; we issue SSL (typically 30s–2min).
04
Issue API keys
Issue keys for ops/dev with quotas and IP allowlists.
05
Activate commissions
Add bank / USDT payout details, confirm rate.

1. Brand customisation

Configure in the "Brand" tab of /admin/tenants/[slug]. Every field is editable any time and goes live immediately — caches expire ~60 seconds after a save.

Required fields

Field	Constraint	Example
`brandName`	1–100 characters	AcmeAI
`brandLogoUrl`	HTTPS · PNG/SVG · ≤ 512KB	https://cdn.acme.ai/logo.svg
`brandFaviconUrl`	HTTPS · ICO/PNG · 32×32 or 64×64	https://cdn.acme.ai/favicon.ico
`themePrimaryColor`	#RRGGBB	#ff6a1a
`brandTagline`	≤ 200 characters	One key replaces five vendor accounts
`supportEmail`	Valid RFC5321 email	[email protected]
`termsUrl / privacyUrl`	Absolute HTTPS URL	https://acme.ai/terms

Advanced: custom HTML injection

Enabling customHeadEnabled lets you inject custom HTML into the page <head> — analytics, third-party support widgets, etc. The content is filtered against a CSP allowlist; no inline scripts — every script must point at a publicly accessible HTTPS URL.

Colour contrast

themePrimaryColor is used both for button backgrounds and for inline links on white. Make sure it meets WCAG AA contrast (≥ 4.5:1) against both white and black. The admin runs a contrast check before saving and rejects anything that fails.

2. Domain configuration

Each OEM tenant can bind one apex/sub-domain plus up to 4 alias domains. We auto-issue Let's Encrypt certificates and rotate every 60 days.

DNS record

Add the following CNAME record at your DNS provider:

DNS
Type    Name             Value                           TTL
CNAME   app.acme.ai      tenant-acme.aicodedog.net   300

Click "Verify" in /admin/tenants/[slug]/domains — we query DNS in real time, issue a cert within 30s of passing, and mark the domain verified.

DNS state machine

pending — added, not yet verified
verifying — DNS lookup in progress
verified — CNAME correct, SSL being issued
issued — cert ready, the domain is live
error — see dns_error for the specific reason

Apex (root) domain limitation

AICodeDog can't accept a bare apex (acme.ai) pointed directly at us — CNAME records can't coexist with other records on the same name. Correct setup: use www.acme.ai or app.acme.ai, then 301 the apex via Cloudflare / Route53.

3. API keys

Keys are how end users authenticate LLM calls. OEM tenants typically issue one key per developer for separate metrics and revocation.

Issuing

bash
curl https://api.aicodedog.com/v1/keys \
  -H "Authorization: Bearer $TENANT_ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "acme-prod-server",
    "user_id": "u_e3b0c...",
    "allowed_ips": ["203.0.113.0/24"],
    "expires_at": "2027-01-01T00:00:00Z"
  }'

The key field is returned only once, in the form sk-live-ac_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx. The server only stores a SHA-256 hash — if you lose it you can only rotate, not recover.

Configuring it in clients

Claude Code

Base URL: https://api.{your-domain}

via ANTHROPIC_BASE_URL

Cursor

Base URL: https://api.{your-domain}

via Settings → OpenAI Base URL

Windsurf

Base URL: https://api.{your-domain}

via Settings → Custom OpenAI Endpoint

Rotate & revoke

Click "Rotate" in /console/api-keys to mint a new key and instantly invalidate the old one; "Revoke" permanently disables the key with no recovery. Both actions are written to the audit log.

Failures are free

Every 4xx/5xx call is excluded from your quota — only 2xx responses are billed. This is a hard guarantee in the OEM contract, enforced at billing time against the usage table.

4. Commission settlement

OEM revenue has three components: Price spread (your retail price − our wholesale cost), Invite commission (30% of downstream spend, decaying over 12 months by default), Platform subsidy (first-month discounts for new customers).

Settlement cycle

T+1 at 00:05 UTC: yesterday's usage is snapshotted into commission_records.
T+7: refund / dispute window closes, status flips from pending to available.
15th of each month: payout is initiated (bank transfer / USDT-TRC20); arrival in 1–3 business days.

Payout methods

Method	Minimum	Fee	Arrival
Stripe Connect (Std)	$50	2.9% + $0.30	T+2
USDT TRC-20	$100	$1 flat	1 hour
Bank (CN, B2B)	$140 (~¥1000)	0.5% · ¥5 minimum	T+2

Commission formula

formula
commission_cents = amount_cents × commission_rate × (1 - refund_ratio)

# commission_rate defaults to 0.300, override per tenant in /admin/tenants/[slug]
# refund_ratio    proportionally claws back commission on refunds
# Last decimal uses ROUND_HALF_EVEN (banker's rounding) to avoid drift

Anti-fraud

Self-invitations, registrations of same-fingerprint accounts inside a short IP window, and refund-loop transactions are all caught by anti_fraud_check() and marked reversed. Run the self-check list.

Ready to ship

Need help integrating?

Email [email protected] with your domain and expected scale — we reply within 24 hours.

Activate a tenant