You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/logto-cloud/custom-domain.mdx
+81-17Lines changed: 81 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,41 +1,62 @@
1
1
---
2
2
id: custom-domain
3
-
title: Custom domain
3
+
title: Custom domains
4
4
sidebar_position: 4
5
5
---
6
6
7
-
# Custom domain
7
+
# Custom domains
8
8
9
-
Your Logto tenant comes with a default free domain `{{tenant-id}}.app.logto`. However, you can elevate your user experience and brand recognition by using a custom domain, like `auth.example.com`.
9
+
:::note
10
+
Changing the domain after publishing your service may cause troubles because your application code and integrations might still reference the old domain. To ensure a smooth transition, we recommend **setting up your custom domains at the beginning** during Production tenant creation.
11
+
:::
10
12
11
-
Your custom domain is used for several functions:
13
+
Your Logto tenant comes with a default free domain `{{tenant-id}}.app.logto`. However, you can elevate your user experience and brand recognition by using custom domains, like `auth.example.com`.
14
+
15
+
Your custom domains are used for several functions:
12
16
13
17
-[Sign-in and registration page](/end-user-flows/sign-up-and-sign-in) URLs
14
-
-[Passkey](/end-user-flows/mfa/webauthn) linking URLs (Changing the domain after users have linked Passkeys may block their authentication).
15
18
- Callback URIs for [social connectors](/connectors/social-connectors) or [enterprise SSO connectors](/connectors/enterprise-connectors).
19
+
-[Passkey](/end-user-flows/mfa/webauthn) linking URLs (Changing the domain after users have linked Passkeys may block their authentication).
16
20
-[SDK endpoint](/integrate-logto/application-data-structure#openid-provider-configuration-endpoint) for integrating Logto with your application.
17
21
18
-
:::note
19
-
Changing the domain after publishing your service may cause troubles because your application code and integrations might still reference the old domain. To ensure a smooth transition, **set up your custom domain at the beginning** during a Production tenant creation.
1. We will auto-verify your records every 10 seconds until the custom domain is added. Just ensure that the entered domain name or DNS Records are accurate.
37
56
2. Verification typically takes a few minutes but can take up to 24 hours, depending on the DNS provider. Feel free to navigate away during the process.
38
57
58
+
To add multiple custom domains, simply repeat the above steps for each domain you want to configure.
59
+
39
60
## Troubleshooting \{#troubleshooting}
40
61
41
62
<details>
@@ -106,7 +127,7 @@ Also verify that the redirect URIs registered in <CloudLink to="/applications">C
106
127
107
128
</details>
108
129
109
-
## Use custom domain\{#use-custom-domain}
130
+
## Use custom domains\{#use-custom-domains}
110
131
111
132
Once you've configured your settings, both your custom domain name and the default Logto domain name will be available for your tenant. However, certain configurations are required to activate your custom domain name.
112
133
@@ -127,6 +148,8 @@ const client = new LogtoClient({
127
148
});
128
149
```
129
150
151
+
On the detail page of your application in <CloudLinkto="/applications">Console > Applications</CloudLink>, scroll to the "Endpoints & Credentials" section. Switch the domain dropdown to view and copy the corresponding endpoints for updating your application settings.
152
+
130
153
### Modifying auth endpoints for other applications \{#modifying-auth-endpoints-for-other-applications}
131
154
132
155
If you have applications that aren't using the Logto SDK, it's necessary to update their auth endpoints.
@@ -137,8 +160,49 @@ You can locate the auth endpoints at the well-known URL:
### Updating the social connector's callback URI \{#updating-the-social-connectors-callback-uri}
163
+
### Updating social connector redirect URIs \{#updating-social-connector-redirect-uris}
164
+
165
+
[Social connectors](/connectors/social-connectors) use the OIDC/OAuth protocol. When users sign in through a custom domain, the redirect URI will automatically use that custom domain. You need to update the redirect URI in your social provider's developer console.
166
+
167
+
**Steps:**
168
+
169
+
1. Navigate to <CloudLinkto="/connectors/social">Console > Connectors > Social Connectors</CloudLink> and select your connector.
170
+
2. Copy the redirect URI shown in the connector details. Logto lists all available redirect URIs for your configured custom domains.
171
+
3. Add this redirect URI to your social provider's developer console (e.g., Google, GitHub, Facebook).
172
+
173
+
**For multiple custom domains:**
174
+
175
+
- Add all redirect URIs for each custom domain you've configured. This ensures social login works regardless of which domain users access.
176
+
- The default Logto domain (`*.logto.app`) remains valid. Include it only if you want to support logins through the default domain as well.
177
+
- For the GitHub connector, use GitHub Apps instead of OAuth apps configured in the GitHub dashboard, as GitHub Apps support multiple redirect URIs. OAuth apps only support a single redirect URI.
[SAML-based enterprise connectors](/connectors/enterprise-connectors) use an Assertion Consumer Service (ACS) URL instead of a redirect URI.
194
+
195
+
**Steps:**
196
+
197
+
1. Navigate to <CloudLinkto="/enterprise-sso">Console > Enterprise SSO</CloudLink> and select your SAML connector.
198
+
2. In the "Configure in the IdP" section, use the domain dropdown to switch between your custom domains.
199
+
3. Copy the ACS URL for the domain you want to support.
200
+
4. Add these ACS URLs to your SAML identity provider configuration.
201
+
202
+
**Important:** The domain you select determines where users are redirected after SSO authentication. Configure this based on which domain your application expects to receive the SAML response.
203
+
204
+
### Passkey for MFA \{#passkey-for-mfa}
141
205
142
-
The social connector's callback URI will be updated automatically if your users are using the custom domain. You need to go to the social provider's developer console to update the callback URI.
206
+
[Passkeys for multi-factor authentication (MFA)](/end-user-flows/mfa/webauthn) are bound to the domain where they were registered. Users must sign in through the same domain to use their Passkeys.
143
207
144
-
When your users are using the custom domain, the social connector's callback URI will be using the new domain. Therefore, you need to navigate to the social provider's developer console to manually update the callback URI.
208
+
Current limitation: Logto does not yet support cross-domain Passkey verification. If a user registers a Passkey on `auth.us.example.com`, they must sign in through `auth.us.example.com` to use that Passkey for authentication. The Passkey registered on one domain cannot be used when signing in through a different custom domain.
Copy file name to clipboardExpand all lines: docs/logto-cloud/system-limit.mdx
+8-7Lines changed: 8 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,15 +4,15 @@ At Logto, we've set generous limits across all plans and provide flexible pay-as
4
4
5
5
You may notice that some items on the pricing page are marked as _unlimited_ or as _continuous pay-as-you-go without a ceiling_. This means they can generally be used without restriction, but Logto reserves the right to adjust these actual limits over time to maintain fair use for all users. In other words, entity limits are strict caps that protect the platform's overall health. They are not part of pricing, though they may vary across different plan groups.
6
6
7
-
If your use case is reasonable but reaches a system limit, feel free to contact us and share your feedback. This helps us better understand real-world usage patterns and adjust system limits to better support our loyal customers.
7
+
If your use case is reasonable but reaches a system limit, feel free to [contact us](https://logto.io/contact) and share your feedback. This helps us better understand real-world usage patterns and adjust system limits to better support our loyal customers.
For Dev tenants, users can take advantage of Logto's free features and offerings. To prevent abuse and set clear expectations, we define certain system limits. These limits help us manage our platform sustainably while still providing free access for testing and development purposes.
13
+
For [Development tenants](/logto-cloud/tenant-settings#development), users can take advantage of Logto's free features and offerings. To prevent abuse and set clear expectations, we define certain system limits. These limits help us manage our platform sustainably while still providing free access for testing and development purposes.
14
14
15
-
If you'd like to increase your quota, you can contact us for assistance. We also recommend upgrading from **Dev** to **Pro**, which removes the cap and gives you full access immediately.
15
+
If you'd like to increase your quota, you can contact us for assistance. We also recommend [upgrading from **Dev** to **Pro**](/logto-cloud/billing-and-pricing#dev-tenant-upgrade-to-pro), which removes the cap and gives you full access immediately.
@@ -39,11 +39,12 @@ If you'd like to increase your quota, you can contact us for assistance. We also
39
39
|**Developers and platform**||
40
40
| Webhooks | 10 |
41
41
| Audit log retention | 14 days |
42
+
| Custom domains | 2 |
42
43
| Tenant members | 20 |
43
44
44
-
### Pro tenant\{#pro-tenant}
45
+
### Pro tenants\{#pro-tenants}
45
46
46
-
For Pro tenants, entity limits define the upper ceiling for add-ons and other "unlimited" entities such as applications. The details of the Pro plan's system limits are listed below.
47
+
For Pro plan tenants, entity limits define the upper ceiling for add-ons and other "unlimited" entities such as applications. The details of the Pro plan's system limits are listed below.
@@ -74,6 +75,6 @@ For Pro tenants, entity limits define the upper ceiling for add-ons and other "u
74
75
| Custom domains | 10 |
75
76
| Tenant members | 100 |
76
77
77
-
### Enterprise \{#enterprise}
78
+
### Enterprise tenants \{#enterprise-tenants}
78
79
79
-
For Enterprise plans, limits and features are fully customizable and managed through a the contract. Please [contact us](https://logto.io/contact) for more details.
80
+
For Enterprise plans, limits and features are fully customizable and managed through the contract. Please [contact us](https://logto.io/contact) for more details.
0 commit comments