Custom domains

Use a custom identity-flow domain such as auth.example.com so hosted sign-in and other identity flows use your brand's hostname instead of the default Authdog hostname. Configuration is environment-specific.

Verify the parent domain

First prove control of the parent domain at tenant level:

1. In the Authdog console, open tenant Settings > Domains.
2. Add the apex domain, such as example.com.
3. Copy the displayed validation subdomain and validation token.
4. Create the requested DNS TXT record with that exact name and value.
5. After DNS propagation, choose Retry DNS Verification.

Authdog queries the displayed validation name for a TXT value exactly matching the token. Keep the record until the console marks the domain Verified.

Verification belongs to the tenant. A verified apex domain can then back an environment hostname at the apex or one subdomain level, such as example.com or auth.example.com.

Configure the environment hostname

1. Select the target project and environment.
2. Open Domains.
3. Enter Identity Flows URI as a hostname only, for example auth.example.com.
4. Save it.
5. Under Vanity domains, add the same hostname (Sync Domain will also register it if missing).
6. At your DNS provider, create a CNAME from that hostname to the regional edge target shown by the console (for example nbg1-dns.authdog.com). Use grey-cloud / DNS-only — do not proxy through Cloudflare orange-cloud.
7. In Verified Domains, select Sync Domain. This verifies DNS against the vanity edge, binds the hostname for routing, and probes HTTPS so the edge can issue a certificate.
8. Wait until status shows Synchronized (ready or active).
9. Test sign-in and callback behavior on the custom hostname before sending production traffic.

DNS changes may take time to propagate. Synchronization requires a verified matching tenant domain and a CNAME already pointing at the regional vanity edge.

Hostname rules

Enter only a hostname:

• No http:// or https://
• No path, query, fragment, or port
• No localhost
• ASCII hostname labels only
• Maximum one subdomain level, such as auth.example.com

The hostname can be at most 253 characters, with each label at most 63 characters.

Security guidance

• Verify domain ownership before binding an environment.
• Keep DNS and Authdog ownership aligned. Remove the Authdog vanity hostname before deleting or repointing its DNS record.
• Use separate hostnames for development, staging, and production.
• Do not point an unverified customer-controlled hostname at your production identity environment.
• Recheck OAuth and SSO provider allowlists after hostname changes. Their redirect URI must match the callback URI shown by the Authdog connection form.
• Treat certificate or DNS failure as an authentication outage; keep DNS changes controlled and reviewed.

Operational notes

• Not yet in verified domains: verify the parent apex in tenant settings, then retry Sync Domain.
• Domain is not pointing to the edge host: check the CNAME name and target (must match the regional edge), wait for propagation, and sync again.
• Vanity status Pending / Failed: fix DNS, refresh under Vanity domains, then Sync Domain again.
• Synchronized but HTTPS fails: open the hostname once after sync; certificate issuance can finish on the first request.
• Provider callback fails: copy the current redirect URI from Authentication > Providers into the upstream provider's allowlist.
• Moving a hostname: register and sync the replacement first. DNS and certificate propagation can make immediate cutovers unreliable.

Saving Identity Flows URI updates environment configuration. Sync Domain is the step that binds the verified hostname to the Kubernetes vanity edge for TLS and routing.

Related

• Deployments: environment-specific configuration
• Account Portal: hosted identity screens
• SSO: callback and provider setup
• Authentication: identity-flow model
• Security: session and key security