Domains

Serve sign-in on your own domain, such as id.acme.com, and prove you own the email domains your users sign in with.

Every organization has a URL on fobauth.com, such as https://acme.fobauth.com. On Settings > Domains you can add two kinds of domain:

Used for	Example	What it does
Sign-in	id.acme.com	Serves your sign-in pages, OpenID Connect, SAML and APIs on your own domain.
Email	acme.com	Proves you own the domain in your users' email addresses. Identity providers need it.

Permission

Needs Change sign-in, branding, domains and keys.

Add a domain

1. On Settings > Domains, choose Add domain.

2. Choose Sign-in or Email under Used for, enter the hostname without https://, and choose Add domain.

3. At your DNS provider, add the TXT record Fob shows:

   _fob-verification.id.acme.com.  TXT  "fob-verification=3f9c2a7d0b1e4c58a6d2f0e9b7c41a2d"

4. For a sign-in domain, also add the CNAME record:

   id.acme.com.  CNAME  cname.fobauth.com.

5. Choose Verify. If the record isn't found yet, the domain shows Waiting for DNS with the reason. Fix the record and choose Verify again; there's no caching to wait out.

A sign-in domain gets its TLS certificate on its first request after it's verified.

To see the records again later, choose DNS records in the domain's menu.

Keep the TXT record

Fob checks the record once a day. If it's missing, the domain shows Record missing. After three days without it, the domain stops being verified:

• A sign-in domain stops serving your sign-in pages.
• An email domain is removed from your identity providers, so they're no longer offered or required for it.

Fob emails your organization's owners when this happens. To restore the domain, add the record back and choose Verify. You'll need to add an email domain back to your identity providers yourself.

Each domain can belong to only one organization. Enter internationalized domain names in their xn-- form.

Custom domains

A verified sign-in domain serves everything your fobauth.com URL does. Apps can use either URL.

The issuer is the URL the app uses. An app configured with https://id.acme.com gets tokens with iss set to https://id.acme.com. If you move an app to another URL later, the issuer changes, and users have to sign in again because sessions are per URL. Choose one URL per app before you launch.

The primary domain

Choose Make primary on a verified sign-in domain to use it in the URLs Fob gives out:

• links in emails, such as invitations and password resets
• the sign-on URL for SAML apps
• the redirect URI and ACS URL for identity providers
• the API and SCIM URLs shown in the console, and WebFinger responses

SAML entity IDs and metadata URLs always stay on fobauth.com, so they never change.

Warning

When you change the primary domain, update the sign-on URL in your SAML apps, and the redirect URI and ACS URL in your identity providers.

To go back to your fobauth.com URL, choose Make primary on its row.

Passkeys

Passkeys stay registered to your fobauth.com URL, so adding a custom domain doesn't break them. Browsers that support related origins let users use the same passkeys on your custom domains.

Email domains

Verify every domain your users have addresses at, such as acme.com and acme-labs.com. Identity providers only work for verified email domains.

WebFinger

Some tools, such as Tailscale, find a user's identity provider from their email with WebFinger:

GET https://acme.fobauth.com/.well-known/webfinger?resource=acct:ada@acme.com

{
  "subject": "acct:ada@acme.com",
  "links": [{ "rel": "http://openid.net/specs/connect/1.0/issuer", "href": "https://acme.fobauth.com" }]
}

Fob responds for any address on a verified email domain, whether or not the user exists, so it never reveals who has an account. Other addresses get 404.

These tools look on the email domain itself, such as https://acme.com/.well-known/webfinger. To answer there, proxy that path, with its query string, to your Fob URL.

Remove a domain

Choose Remove domain in the domain's menu.

• A removed sign-in domain stops serving sign-in. If it was primary, your fobauth.com URL becomes primary again.
• A removed email domain is also removed from every identity provider that used it.