Tenancy
Custom login domain
Serving a hosted login page on a hostname the customer owns, such as login.example.com.
What Custom login domain means
A custom login domain lets a hosted login page appear on a hostname the tenant owns rather than the identity provider's domain. Users see a familiar address, cookies and passkeys are scoped to the customer's domain, and the OpenID Connect issuer may change with it — which is why it must be planned before integrations depend on the issuer value.
How it works
It requires the customer to prove domain ownership, point DNS at the provider, and have a certificate issued for the hostname. The provider then serves the login experience and protocol endpoints under that name.
Passkeys are bound to a relying party ID derived from a domain, so the domain chosen for login determines which passkeys work there.
The mistake people actually make
Treating it as cosmetic. If the issuer URL changes, every relying party's ID token validation changes with it.
In Authreads
How this applies here
Custom login domains are In progress on the Authreads roadmap.
Every capability is listed on /roadmap as Available, In progress or Planned. Nothing is described as available here that is not listed as Available there.
Guides that go deeper
Related terms
Hosted login
A sign-in page served by the identity provider, which the application redirects to.
OpenID Connect (OIDC)
An identity layer on top of OAuth 2.0 that lets an application verify who a user is, not just what it may access.
Passkey
A phishing-resistant sign-in credential: a key pair, scoped to one website, created and used through WebAuthn.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.