Custom (vanity) domains
Replace your default SecureAuth tenant URL with a custom domain that matches your brand. A vanity domain gives your users a familiar, trusted URL at sign-in and across all OAuth/OIDC endpoints.
URL examples
| What | Default URL | With vanity domain |
|---|---|---|
| Sign-in page | https://acme.us.connect.secureauth.com/acme/default/login | https://auth.acme.com/acme/default/login |
| OAuth authorization | https://acme.us.connect.secureauth.com/acme/default/oauth2/authorize | https://auth.acme.com/acme/default/oauth2/authorize |
| Token endpoint | https://acme.us.connect.secureauth.com/acme/default/oauth2/token | https://auth.acme.com/acme/default/oauth2/token |
| OIDC discovery | https://acme.us.connect.secureauth.com/acme/default/.well-known/openid-configuration | https://auth.acme.com/acme/default/.well-known/openid-configuration |
| Issuer URL | https://acme.us.connect.secureauth.com/acme/default | https://auth.acme.com/acme/default |
Only the hostname changes. The tenant ID, workspace ID, and path structure remain the same.
Why use a vanity domain
- Brand trust – users see your domain (
auth.acme.com) instead ofsecureauth.comat sign-in - Simpler URLs – shorter, easier to communicate and remember
- Cookie scope – authentication cookies are scoped to your domain, which can simplify SSO across your applications
- Compliance – some regulatory frameworks require authentication endpoints on your own domain
Setup options
You can configure vanity domains in two ways:
- Customer-managed infrastructure: Use a web application firewall (WAF), content delivery network (CDN), or custom proxy.
- Direct through SecureAuth: Let SecureAuth handle the domain setup.
Implementation methods
WAF/CDN/proxy setup
Use your existing WAF, CDN, or proxy as a reverse proxy. TLS is terminated at the proxy level.
Best for: Organizations with existing proxy infrastructure.
SecureAuth provides an x-acp-domain-key when your vanity domain is created. Your proxy must include this header in every request to SecureAuth so the platform can identify and route traffic to your tenant.
Learn how to configure this setup
Direct setup with SecureAuth
SecureAuth handles domain traffic directly if you don't have a proxy or WAF.
Best for: Organizations without proxy infrastructure.
How it works:
- SecureAuth creates a custom Ingress for your vanity domain.
- You configure a CNAME record pointing to the SecureAuth ingress endpoint.
- SecureAuth maps and routes the traffic to your tenant.
Learn how to configure this setup
Getting started
To set up a custom domain for your organization, contact SecureAuth Support.