Branding and custom domains

Branding#

Set per environment in the dashboard's Branding editor, which previews every hosted screen as you change it:

• Logo, colors for light and dark schemes, corner radius and font.
• Appearance: always light, always dark, or following the visitor's system setting.
• Layout: the card alone, or split with your own content panel beside it on wide screens.
• Languages offered and the default one (16 available), and Terms and Privacy links.
• Custom CSS, for anything the options don't cover.

Your 3een subdomain#

Every environment gets a 3een subdomain for its hosted pages as soon as it exists; the dashboard shows it on the environment's domain settings. handleAuth finds it through your API key, so your code never needs to know it.

A custom domain#

1. In Domains, enter a domain you control for AuthKit, such as auth.example.com.
2. Add the TXT record shown, at _verification.auth.example.com, and the Google site-verification TXT record if one is shown (it lets a certificate be issued for the domain).
3. Verify. The dashboard then shows a CNAME record pointing your domain at your 3een subdomain; add it.

Once DNS has propagated, your hosted pages answer on your domain with the same branding.

Limits#

• Cloudflare Turnstile protects the hosted pages on 3een subdomains, not on custom domains.
• Passkeys are bound to the domain they were registered on. Moving to a custom domain means users register a new one there.