**Domains** puts the hosted identity flows on your own hostname: _"Use your own domain for your identity flows."_

![Domains](/content/console/domains.png)

Without a custom domain, users signing in to your app see an Authdog hostname in the address bar. With one, they see `auth.yourcompany.com` — which matters for trust, for cookie scoping, and for anything that inspects the issuer.

## Custom domain

The page holds a single **Custom domain** card with a **Hostname** field, fixed to `https://` and pre-filled with the placeholder `auth.yourcompany.com`. A copy button sits at the end of the field.

The helper text states the constraint: _"Use a hostname on a verified domain. It replaces the default Authdog domain for identity flows."_

## The two-step model

Custom domains involve two different levels of the hierarchy, which is the part that trips people up:

| Step | Where | What you do |
|------|-------|-------------|
| 1. Verify the APEX domain | [Tenant Settings > Domains](/docs/console/tenants) | Prove you own `yourcompany.com` with a DNS TXT record or manual review. |
| 2. Assign a hostname | This page | Point one environment at a subdomain of that verified domain. |

Verification happens once per tenant. Assignment happens per **environment**, so `dev` and `prod` can use different hostnames — for example `auth-dev.yourcompany.com` and `auth.yourcompany.com` — from the same verified APEX domain.

If the hostname field rejects your entry, the APEX domain is not verified yet. Go back to Tenant Settings, confirm the domain shows **Verified** rather than **Pending DNS**, then return here.

## Certificates

TLS certificates for the hostname are issued and renewed automatically once the DNS record resolves to Authdog's edge. There is nothing to upload.

> **Tip**
>
> Set the custom domain before you register redirect URIs with any external
> identity provider. Changing the identity hostname later means updating the
> callback URL in every provider you have connected.

## What changes once it is set

- Hosted sign-in, sign-up, and account pages serve from your hostname.
- The OIDC issuer and discovery document reflect the new host, so tokens carry your domain in `iss`.
- Session cookies are scoped to your domain.
- The **Trusted domain reminder** in [Authentication > Features](/docs/console/authentication) — _"Only sign in if you recognize this address"_ — displays your hostname instead of Authdog's, which is the whole point of that feature.

## Related

| Read | To learn how to |
|------|-----------------|
| [Tenants](/docs/console/tenants) | Verify the APEX domain this hostname must sit under |
| [Redirects](/docs/console/redirects) | Set the URLs hosted flows return to |
| [Branding](/docs/console/branding) | Style the pages served from your domain |
| [Authentication](/docs/console/authentication) | Turn on the trusted domain reminder |
| [Custom domains](/docs/custom-domains) | DNS records and the full setup reference |