— 01
Your domain, no compromises
CNAME setup, automatic TLS, HTTP/3 at the edge. auth.acme.com, not acme.authaz.io.
Auth on auth.your-domain.com.
Not ours.
Host every login, invite, and email on your own domain. Theme tokens for color, type, copy, and radius. Buyers see your brand — not a vendor.
$authaz domains add auth.acme.com --tenant=acme
# 1. add this CNAME at your dns provider:
| HOST | TYPE | VALUE | TTL |
|---|---|---|---|
| auth | CNAME | acme.tenants.authaz.io. | 300 |
| _acme-chal.auth | TXT | authaz-verify=9F2C…41E8 | 60 |
$authaz domains verify auth.acme.com
✓CNAME → tenants.authaz.ioresolved
✓TXT challenge accepted14s
✓TLS issued · Let's Encrypt · ECDSAauto-renew
✓HSTS · 31536000enabled
✔ ready — login pages now serve from https://auth.acme.com
$▍
🔒auth.authaz.io/login?t=acme
Az
Authaz
Sign in to acme
CONTINUE →
BEFOREvendor-branded
🔒auth.acme.com/login
A
Acme
Welcome back
SIGN IN →
AFTER · YOUR DOMAINyour tokens
Why it matters
Auth is the most-seen page in your product. It should look like it belongs there.
A vendor login URL is a procurement red flag and a brand inconsistency. Authaz hides itself completely — your domain, your tokens, your copy, your sender.
— 02
Tokens, not screenshots
Color, font, radius, copy. Set them per tenant; we apply them across login, invite, MFA, recovery — every surface.
— 03
Email from you
Send from your domain with SPF, DKIM, and DMARC handled. Buyers see your sender; deliverability stays high.
What it covers
Brand consistency at every touchpoint.
— 01
A CNAME and a TLS cert. We do the rest.
Add one DNS record. We provision the certificate, route the domain through our edge, and renew automatically. No CDN to configure, no nginx to babysit.
- ACME-issued · auto-renew at 30d
- HTTP/3 + 0-RTT at the edge
- wildcard option for sub-tenants
/* tokens.css — your tenant's theme */
--brand: #f43f5e;
--brand-fg: #ffffff;
--bg: #0b0d12;
--ink: #f5f5f5;
--font-display: "Manrope";
--radius: 10px;
--logo: https://acme.com/logo.svg;
--copy.cta: "Sign in to Acme";
— 02
One theme set, every tenant unique.
Each tenant defines its own tokens — no templates to fork, no CSS to deploy. We render the tenant's theme on every request, validated against your design system.
- live preview while editing
- CSS escape hatch for fine control
- per-locale copy overrides
🔒auth.acme.com / login
A
Sign in to Acme
Use your work email
val@acme.com
Continue →
🔒auth.lumen.ai / login
L
Welcome back to Lumen
Continue with passkey or email
name@lumen.ai
Continue →
— 03
Email that arrives — and looks right.
Sign-in links, invites, MFA notices. From your domain, with your sender, your subject, your branded template. We handle deliverability infra; you ship.
- SPF + DKIM + DMARC managed
- click + open telemetry
- fallback templates if buyer overrides break
from: noreply@acme.comspf · dkim · dmarc
A
Sign in to Acme
Click the button below to sign in. This link expires in 10 minutes and is only valid on the device where you requested it.
Continue to Acme →
API
Brand the whole stack with one call.
POST /v1/brandingper-tenant
await authaz.branding.set("org_acme", {
domain: "auth.acme.com",
email_from:"noreply@acme.com",
logo: "https://acme.com/logo.svg",
tokens: { brand: "#f43f5e", radius: "10px" },
copy: { cta: "Sign in to Acme" },
});
Spec
The fine print, up front.
Hosting
CNAME · per-tenant subdomain · wildcard support
TLS
auto-issued · auto-renewed · HSTS preload-ready
Theme tokens
color · type · radius · spacing · logos · copy · per-locale
Surfaces themed
login · signup · invite · MFA · recovery · errors · emails
Email
send-as your domain · SPF + DKIM + DMARC · delivery telemetry
Localization
38 languages built-in · custom strings per tenant
Live preview
tenants edit + preview without deploys
Pricing model
unlimited tenants on standard plan · custom-cert add-on
Pairs with
One platform. Every primitive.
Every Authaz product shares the same primitives — sessions, policies, audit, tenants. Pick what you need today; add the rest when you do.
01 · AUTHENTICATION FLOWS
Authentication Flows
Password, magic code/link, and social login out of the box.
Read more →
02 · ADMIN & DASHBOARD ACCESS
Admin & Dashboard Access
Authentication that works for back-office and internal tools.
Read more →
03 · ENTERPRISE SSO
Enterprise SSO
SAML SSO with IdP- and SP-initiated flows.
Read more →
Get started
Make auth feel like part of your product.
CNAME, theme tokens, branded email — every touchpoint, your domain.