Domains

Domains puts the hosted identity flows on your own hostname: "Use your own domain for your identity flows."

Without a custom domain, users signing in to your app see an Authdog hostname in the address bar. With one, they see auth.yourcompany.com — which matters for trust, for cookie scoping, and for anything that inspects the issuer.

Custom domain

The page holds a single Custom domain card with a Hostname field, fixed to https:// and pre-filled with the placeholder auth.yourcompany.com. A copy button sits at the end of the field.

The helper text states the constraint: "Use a hostname on a verified domain. It replaces the default Authdog domain for identity flows."

The two-step model

Custom domains involve two different levels of the hierarchy, which is the part that trips people up:

Verification happens once per tenant. Assignment happens per environment, so dev and prod can use different hostnames — for example auth-dev.yourcompany.com and auth.yourcompany.com — from the same verified APEX domain.

If the hostname field rejects your entry, the APEX domain is not verified yet. Go back to Tenant Settings, confirm the domain shows Verified rather than Pending DNS, then return here.

Certificates

TLS certificates for the hostname are issued and renewed automatically once the DNS record resolves to Authdog's edge. There is nothing to upload.

What changes once it is set

• Hosted sign-in, sign-up, and account pages serve from your hostname.
• The OIDC issuer and discovery document reflect the new host, so tokens carry your domain in iss.
• Session cookies are scoped to your domain.
• The Trusted domain reminder in Authentication > Features — "Only sign in if you recognize this address" — displays your hostname instead of Authdog's, which is the whole point of that feature.

Related