Custom domains
Serve sign-in from auth.yourapp.com, and why it matters more for passkeys than for any other kind of login.
On paid plans, Gatekeep can serve sign-in from your own domain, such as auth.yourapp.com, instead of a gatekeepauth.com subdomain.
Why it matters for passkeys
A passkey is bound to the domain it was created on (its relying party ID). Passkeys made on acme.gatekeepauth.com only ever work on acme.gatekeepauth.com.
So if you start on a Gatekeep subdomain and move to your own domain later, every user has to set up a new passkey. Starting on your own domain means your users’ passkeys belong to you, whatever happens behind it.
Set up your custom domain before you launch, while there are no passkeys to move.
Set it up
- Choose a subdomain you don’t use for anything else, like
auth.yourapp.com. - Tell us the domain. We’ll send you a
CNAMErecord to add at your DNS provider. - We issue and renew the TLS certificate automatically.
- Update your apps’ issuer to
https://auth.yourapp.com.
Users see your domain in the address bar and in their device’s passkey prompt.