Building a White-Label Platform for Resellers: Feasibility, Cost and the Parts That Break

What white label actually means once resellers touch it

Most vendors quote this as a theming task: read the tenant, swap the logo, inject a hex code, done. That version works for three resellers on subdomains and starts leaking the moment the fourth one brings their own domain.

A platform we were called in to fix ran fine on partner-a.yourapp.com and partner-b.yourapp.com. Two resellers then pointed their own domains at it. The CDN cache key was built from path and query string, never the Host header, because on subdomains nothing had ever collided. Within an hour a customer of Partner A loaded the pricing page and got Partner B's logo, support number and rate card, cached at the same edge location. The fix was one line in the cache key. The cost was a partner relationship, because a reseller's client had just seen a competitor's pricing on what they believed was their vendor's site. Every hard part below has that shape: a shortcut that is correct at three tenants and a data leak at thirty.

Custom domains and TLS certificates

Once resellers want their brand in the address bar, you are running an ACME client on behalf of strangers who control DNS you cannot see. They add a CNAME to your edge, you issue a certificate per hostname, you renew it forever. The traps, in the order they bite:

• Apex domains cannot hold a CNAME. RFC 1034 forbids it. Resellers want reseller.com, not app.reseller.com. You either require a subdomain in your onboarding policy, or you hand them an A record pointing at an anycast IP, or you depend on their DNS provider supporting ALIAS, ANAME or CNAME flattening. Route 53 and Cloudflare do. Plenty of registrars a reseller's cousin set up in 2014 do not.
• CAA records silently block issuance. A reseller whose enterprise IT pinned CAA to DigiCert will fail Let's Encrypt issuance with no signal to them, only to you.
• Rate limits are real. Let's Encrypt publishes a limit of 50 certificates per registered domain per week and 5 failed validations per hostname per hour. A retry loop with no backoff will lock you out of a partner's domain for an hour, and a bulk onboarding script can lock a shared domain for a week.
• Renewal is where it actually breaks. The reseller migrates DNS in month seven, drops the CNAME, and nothing happens. Sixty days later the certificate does not renew and their site goes dark at 3am. Competent builds monitor validation health continuously rather than expiry, and alert at T minus 14 days on a failing challenge instead of at T minus 1 on an expiring cert.
• Fan-out limits. CloudFront allows 100 alternate domain names per distribution by default, so hostname 101 needs a distribution sharding strategy you did not plan.

What a competent build does: on-demand issuance behind an authorization endpoint that checks the hostname belongs to a paying tenant before asking for a cert. Caddy's on-demand TLS with an ask endpoint, cert-manager on Kubernetes, or a managed layer such as Cloudflare for SaaS custom hostnames or Approximated. Buying the managed layer is usually correct. Building your own ACME orchestration is two to four weeks you can spend elsewhere.

Where the brand actually has to appear

Ask and the list gets long: the app, transactional email, PDF invoices, the favicon, the PWA manifest, Open Graph images, SMS sender, the error page served when your app is down, and the login screen an SSO redirect lands on.

Two decisions matter. First, runtime theming through CSS custom properties versus a build per tenant. Runtime wins: one deploy, one cache, instant changes. Build-per-tenant means 40 builds on every release and a reseller waiting three days for a color change. Second, constrain the palette. A reseller will pick a yellow, put white text on it, and land at 2:1 contrast against a WCAG AA requirement of 4.5:1 for body text. Derive the accessible foreground from their brand color programmatically and show them the computed result at upload time. Validate logo aspect ratio and transparency at the same point, because someone will upload a 3000 by 400 PNG with a white box behind it and file a bug that your header is broken.

Mobile is the expensive one. Apple App Store Review Guideline 4.2.6 rejects white-label clone apps submitted from a single provider account. If resellers want branded iOS apps, each app ships from the reseller's own Apple Developer Program account at $99 per year, with their own Google Play account at $25 one time, their own store listing, screenshots and review cycle, and a release train you now run 40 times. That is a permanent operations cost rather than a build cost. A PWA, or one container app with a reseller code entered at first launch, is usually the honest answer, and the decision belongs before the quote.

Email under someone else's domain

SPF has a hard limit of 10 DNS lookups per RFC 7208. A reseller already running Google Workspace, HubSpot and a payroll tool is at eight. Adding your include tips them to permerror and their whole domain starts failing checks, including mail you did not send. So do not touch their SPF. Ask for DKIM CNAME delegation instead (SES easy DKIM publishes three CNAMEs; Postmark and SendGrid do the same), plus a custom MAIL FROM subdomain such as mail.reseller.com so the Return-Path aligns under relaxed DMARC without their apex SPF record changing at all. If their DMARC is p=reject and you skip this, every notification you send disappears and nobody tells you.

Then reputation. On a shared IP pool, one reseller who imports a bought list burns everyone. AWS SES publishes the thresholds: a bounce rate above 5% puts the account under review, and complaints above 0.1% do the same. Isolate per tenant with SES configuration sets, SendGrid subusers or Postmark message streams, with per tenant suppression lists and bounce and complaint webhooks routed back to the tenant that caused them. Dedicated IPs on SES list at about $25 per month each and need weeks of warmup, so they only make sense for your top few partners.

Billing when the reseller sets the price

The first question is who is the merchant of record. If the reseller bills their client, you are running a marketplace, and Stripe Connect account type is an architectural decision rather than a config flag. With direct charges the connected account carries chargeback liability. With destination charges the platform carries it, and you will discover this the first time a partner's client disputes $4,000.

Then the margin engine, which is the part that never gets estimated. You have a wholesale price. The reseller applies a markup. The markup changes mid-cycle, so you owe proration on both the retail invoice and your own revenue share. The end client refunds on day 20 after you already paid the partner their margin on day 2, so the partner now has a negative balance and you need a clawback policy in code. Add currency, add VAT reverse charge, add whose legal entity appears on the invoice PDF.

Mechanically: every write to Stripe carries an idempotency key. Every webhook handler stores the event id and drops duplicates, because Stripe retries for up to three days and events arrive out of order. Never trust the payload as current state, fetch the object. A subscription webhook processed out of order is how a churned reseller's tenant stays live for a month.

Tenant isolation, and the bugs that only exist at 40 tenants

A tenant_id column is table stakes. Postgres row level security is the enforcement, and two gotchas make it fake. First, the table owner bypasses RLS unless you declare FORCE ROW LEVEL SECURITY, so your migrations user reads everything and your test suite passes. Second, if you set the tenant with a session level SET behind PgBouncer in transaction pooling mode, the setting leaks to the next connection borrower. Use SET LOCAL inside the transaction.

The same discipline applies everywhere state is cached or queued: Redis keys prefixed by tenant, CDN cache keys including Host, search indexes filtered or split per tenant, and background jobs carrying tenant context in the payload so a job retried six hours later re-establishes the right scope instead of inheriting whatever the worker last touched. Add per tenant rate limits and queue fairness before the reseller who imports 400,000 rows takes your p95 down for everyone. Add impersonation with a visible banner and an audit log, because support will need to log in as a partner's user, and eventually a regulator or a partner's lawyer will ask who did.

What this costs and how long it takes

These are Digital Heroes delivery bands across 2,000+ projects, not list prices.

• Adding white-label reseller support to an existing product: $15,000 to $60,000. Tenant model, runtime theming, branded email, reseller admin. Assumes your schema can take a tenant_id without a rewrite.
• As part of a first release: $50,000 to $130,000 in 10 to 16 weeks. Designed in from day one, which is meaningfully cheaper than retrofitting.
• Full reseller platform: $150,000 to $350,000 over 6 to 12 months. Partner-owned domains and TLS at scale, per-tenant SSO and SCIM, Connect billing with a margin engine, partner portal, reporting, support tooling.

What pushes this capability toward the top of its band: resellers bringing their own apex domains (add 2 to 4 weeks and permanent ops load), resellers as merchant of record with their own pricing (add 3 to 6 weeks, most of it margin and refund edge cases), branded mobile apps (add 2 weeks per platform plus a release process forever), per-reseller SSO with SAML and SCIM deprovisioning (add 3 to 5 weeks), and retrofitting isolation onto a schema that never had a tenant column, which alone can double the number. What keeps it low: subdomains only, you stay merchant of record, resellers get theme and content control but not feature control.

When you should NOT build this

If you have fewer than roughly 25 resellers, you stay the merchant of record, and nobody needs a branded app, take the managed path.

Concretely: if the product is courses, content or community, Circle and Thinkific Plus already do white label including custom domains, and you will not beat them for under six figures. If it is a storefront, Shopify plus an app is the answer. If resellers mainly want your dashboard with their logo on it, that is embedded analytics, and Metabase, Explo or Omni ship white-labeled interactive embedding today. If you are on Next.js and the only real requirement is custom domains plus theming, Vercel's platforms approach with Cloudflare for SaaS gets you most of the way in about a week.

Build it when off-the-shelf genuinely collapses, and it collapses on one thing more than any other: resellers who must set their own prices and own the customer billing relationship. No white-label add-on handles wholesale pricing, markup, proration and clawback for you. That is where custom starts paying.

How to brief and vet a developer for this

Brief with counts and constraints, not adjectives: how many resellers in year one, own domain or subdomain, apex or subdomain, who invoices the end customer, do resellers need SSO, do they need mobile, what can they change (colors, copy, features, pricing), and what happens to their data when they churn.

Then ask these:

• "A reseller's DNS provider does not support ALIAS records. How do we serve their apex domain over TLS?" A good answer names an A record to an anycast IP or a subdomain-only onboarding policy, and mentions CAA.
• "Which DNS records do we ask a reseller to add for email, and why do we not touch their SPF?" You want DKIM CNAME delegation plus a custom MAIL FROM subdomain, and the phrase "10 lookup limit."
• "Show me the CDN cache key for a page served on a custom domain."
• "Who bypasses row level security in Postgres?" The answer is the table owner, unless FORCE ROW LEVEL SECURITY.
• "What happens the second time the same Stripe webhook arrives, and what happens if it arrives out of order?"
• "On Stripe Connect, who eats the chargeback on a destination charge?"
• "How does a reseller ship an iOS app under their own brand?" If guideline 4.2.6 and their own developer account do not come up, they have never done it.
• "A job is retried six hours later. Where does the tenant context come from?"

Red flags, in order of severity: calling it "just a theme layer," proposing a wildcard certificate for reseller-owned domains, planning to add tenant_id "later," and quoting mobile apps as one submission. Ask for a live demo of a tenant switch, a custom domain going from CNAME to green padlock, and the audit log of a support impersonation. Those three demos separate people who have shipped this from people who have read about it.