Preview hosted identity flows in one workspace

Theming hosted auth page-by-page produced drift: sign-in looked finished, sign-up did not, and consent or TOTP never got a preview. A dedicated branding workspace now lets you preview and customize those flows together.

This is the longer note behind the November 30 changelog entry.

How it works

Branding is the workspace. Environment configuration stores:

• light and dark appearance (enable_dark_mode, default_dark_mode, plus theme_palette light/dark bundles)
• separate layouts for sign-in and sign-up (theme_layout_login, theme_layout_signup)
• shared fonts, logo, favicon, and badge flags

The designer previews sign-in and sign-up independently (theme_active_page). Consent, magic-link, TOTP, MFA, forgot-password, and error pages consume the same palette and fonts so they stay visually aligned without a per-page theme file.

If a custom domain is configured, the preview iframe switches to that host only after the domain is synchronized.

Set it up

In the console, open Branding:

1. Enable light and, if needed, dark mode.
2. Preview sign-in and sign-up as separate pages.
3. Set shared colors and fonts.
4. Save, then open hosted consent, magic-link, or TOTP and confirm they pick up the same styling.

A designer preview is not published until you save.

Trust boundaries

The workspace is environment configuration, not an authentication bypass. Previewing a page does not create a user or issue a token.

Custom-domain preview follows sync status. An unsynced host in the iframe is the default identity host.

Try it

Toggle dark mode, switch the preview from sign-in to sign-up, and save. Product notes are on Authentication. The original release note is in the changelog.