Whitelabel eSIM platform integration guide

A technical overview for partners integrating the Airalo White Label e-commerce platform on their own domain.

The goal: a seamless brand experience

This document explains how to integrate the Airalo White Label e-commerce platform so it's served directly from your partner domain. The architecture is designed to meet three key requirements for a successful partnership.


🔗 Seamless user experience	Users see your domain (e.g. `airgsm.com`) in the address bar at all times, ensuring brand consistency and trust.
⚙️ Full partner control	You retain complete control over your domain's SEO, traffic analytics, and routing rules.
🛡️ Robust security	The direct platform instance is shielded from public access, protecting your integration.

The solution: reverse proxy architecture

The integration is achieved using a reverse proxy. This is a standard, secure, and highly effective architecture for White Label solutions. Your reverse proxy server acts as the "front door" for your domain. It receives all user traffic and intelligently forwards it to the Airalo platform, while ensuring your domain remains in the user's address bar. This process is completely invisible to the end-user.

Platform services overview

The White Label solution consists of two distinct services, each with a specific audience and interaction flow. In the diagrams below, blue marks infrastructure you own and coral marks services Airalo runs.

Management flow

Partner Platform is your secure administrative backend to manage the e-shop, set prices, control inventory, review support requests, and configure payment information. Access can be integrated with your SSO.

Customer flow

White Label Storefront is the customer-facing e-shop where users browse, purchase, top-up, and manage their eSIMs under your brand, accessed seamlessly via your domain.

End-user data flow deep dive

How a customer's request to the White Label Storefront travels through the system. The request flows down through your infrastructure into Airalo's; the response retraces the same path back, so the browser only ever shows your domain.

User request — an end-user types https://airgsm.com into their browser.

DNS resolution — the partner's DNS points the domain to the public IP of their reverse proxy.

Proxy receives & forwards — the reverse proxy receives the request and forwards it to the Airalo White Label Storefront's origin URL.

IP whitelist check — the Airalo firewall checks that the request is from the partner's whitelisted proxy IP.

Platform response — the Airalo storefront processes the request and sends the e-shop page back to the proxy.

Response relay — the response travels back from the Airalo firewall to the partner's proxy.

Final response — the proxy serves the page to the user, who still sees https://airgsm.com in their browser.

Email communication setup

To maintain brand consistency, transactional emails (like order confirmations) must come from your domain. The Airalo platform uses Postmark for reliable delivery. You have two options to authorize the Airalo platform to send emails on your behalf.

Option 1: Full domain verification (recommended) 👍

How it works: You add specific DNS records (DKIM and Return-Path) that Airalo provides to your domain's configuration.

This is the industry-standard method for maximum email deliverability and security. It allows the Airalo platform to send emails from any address on your domain (e.g. support@airgsm.com), providing full flexibility.

Option 2: Single email address verification

How it works: Provide a single email address to Airalo. Postmark will send a verification link to this address, which you must click.

This is a simpler setup but is less flexible. The Airalo platform will only be able to send emails from that one exact address.

Who does what? A clear breakdown

Successful integration is a partnership with a clear division of ownership: you own the edge (your domain, proxy, certificates, and analytics), while Airalo owns the platform (the storefront and Partner Platform, their availability, and the firewall). The detailed responsibilities for each party are below.

Partner's responsibilities

DNS management — point domain's A or CNAME records to your proxy server.

Reverse proxy — procure, configure, and maintain the proxy server.

SSL certificate — manage and install the SSL certificate for your domain.

Email verification — add DNS records or verify a single sender email address.

SEO & traffic control — implement analytics, caching, and SEO rules on your proxy.

Cookie/consent management — provide the script for your consent management tool.

Airalo's responsibilities

Admin access to Partner Platform — provide administration access to Partner Platform, to allow the partner to configure SSO/SCIM or manually onboard their team.

Platform availability — ensure uptime and performance of both the Partner Platform and Storefront.

Provide origin URL — supply the stable URL for your White Label Storefront instance.

IP whitelisting — securely maintain the list of approved partner IP addresses.

Provide email DNS records — supply the correct DKIM and Return-Path records.

Reverse proxy technology

The reverse proxy architecture is flexible and can be implemented using a variety of modern proxy servers. Common choices include Nginx, HAProxy, Caddy, and Traefik. The Airalo team can provide guidance based on your specific technical environment.

Example configuration

The two things that most commonly break a White Label setup are the Host header (the storefront needs to know which brand is being served) and the forwarded-client headers (so the platform sees the real visitor, not your proxy). A minimal Nginx server block illustrating the idea:

The exact directives, header names, and TLS settings depend on your chosen proxy and Airalo's origin requirements — use this only as a conversation starter with your platform team.

A note on SSL/TLS

There are two separate TLS connections in this setup, and it's worth confirming both with Airalo:

Visitor → your proxy — you manage and install the certificate for your own domain (e.g. airgsm.com). This is the certificate end-users see.

Your proxy → Airalo origin — your proxy should connect to the Airalo origin URL over HTTPS and validate that connection (proxy_ssl_server_name in the example above). Confirm with Airalo whether anything specific is expected on this leg.

Key benefits of this approach

🎨 Full brand consistency — the user journey, from website to email, happens entirely on your domain.

📈 Complete SEO control — manage meta tags, robots.txt, and sitemaps directly on your proxy.

🔒 Enhanced security — IP whitelisting prevents unauthorized scraping and direct access. Note that this whitelist is effectively the only barrier between the public internet and the storefront origin, so keeping your proxy's IP list accurate and up to date is critical: if it drifts, you risk either exposing the origin or breaking your own storefront.

📊 Flexibility & analytics — integrate your own analytics, caching, or even a Web Application Firewall.

Frequently asked questions

How can we manage SEO for the White Label e-shop?

Who is responsible for on-page SEO elements like header tags (h1, h2)?

Can we use our own analytics and cookie consent tools?

Why is a reverse proxy necessary? Can't we just use a CNAME redirect?

Validation checklist

Before reaching out to Airalo for support, run through these quick self-checks to confirm the integration is behaving as expected:

✅ Proxy resolves — https://airgsm.com loads the storefront without errors.

✅ Domain stays masked — the browser address bar shows your domain throughout the journey (browsing, checkout, account), never the Airalo origin URL.

✅ Origin is shielded — visiting the raw Airalo origin URL directly (from an IP that is not whitelisted) is blocked.

✅ Email arrives from your domain — a test order produces a confirmation email sent from your domain (e.g. support@airgsm.com), not an Airalo address.

✅ Forwarded headers reach the platform — the storefront sees the correct host and the real visitor IP (confirm with Airalo if unsure).

✅ Analytics & consent fire — your cookie/consent banner appears and your analytics records the visit.

If any check fails, note which one before contacting Airalo — it usually points straight at the cause (header handling, whitelist drift, DNS, or email verification).

Next steps & requirements

🚀 To begin the integration process, Airalo requires three key pieces of information from you.

Your proxy IP address — a static, public IPv4 address (or range) of your reverse proxy server for the Airalo firewall whitelist.

Email verification choice — your choice of email verification method (full domain or single address) and the required details.

Cookie and consent management script — the JavaScript snippet for your cookie and consent management tool to ensure compliance with privacy regulations.

Whitelabel eSIM platform integration guide

Table of contents#

The goal: a seamless brand experience#

The solution: reverse proxy architecture#

Platform services overview#

Management flow#

Customer flow#

End-user data flow deep dive#

Email communication setup#

Option 1: Full domain verification (recommended) 👍#

Option 2: Single email address verification#

Who does what? A clear breakdown#

Partner's responsibilities#

Airalo's responsibilities#

Reverse proxy technology#

Example configuration#

A note on SSL/TLS#

Key benefits of this approach#

Frequently asked questions#

Validation checklist#

Next steps & requirements#

Table of contents