Use a custom domain with Kinde

Use a custom domain with Kinde and add trust to your users. Follow the steps below:

What you need

Link to this section

• A Kinde account with Admin access. (Sign up for free)
• A custom domain name and access to your domain control panel.

This is a guide for setting up a custom domain for your Kinde business. If you are setting up custom domains for your organizations, then see this guide: Custom domain for organizations.

General setup

Link to this section

1. Add your custom domain in Kinde

Link to this section

1. Go to your Kinde dashboard > Settings > Environment > Custom domains.

2. Select Add custom domain.

3. In the dialog, enter your custom domain. Be sure to include the subdomain, for example auth.yourbusiness.com.

4. Select Save. DNS details appear.

5. Copy the CNAME records for your domain control panel. See the next step.

   

2. Add DNS records to your domain provider

Link to this section

DNS settings vary from provider to provider. Here are the general steps:

1. Go to your domain provider website.

2. Select your domain, and select Update DNS configuration.

3. Select Add record and enter the following:

   • Record type: CNAME
   • Name/Host: The DNS entry part of your domain you used in Kinde, for example auth
   • Target/Value: The Value from Kinde
   • TTL: Leave as default
   • Routing policy: Leave as default
   If you are using Cloudflare, you need to add a DNS-only record, not proxied.

   

4. Select Save.

5. Repeat the process for the other CNAME record.

   Domain provider specific instructions:

   • GoDaddy
   • Cloudflare
   • NameCheap

3. Check verification status in Kinde

Link to this section

Once you have created the DNS entries, Kinde will start the verification process. This can take anywhere from a few minutes to a couple of hours. You will see Provisioning in progress next to your custom domain:

When it completes, the verification status will change to Provisioned and an SSL certificate will be provisioned.

Your domain will then be used instead of Kinde’s. You will also receive an email notification when the process is complete.

1. Go to your Kinde dashboard > select View details for any of your applications.

2. Select Details.

3. The custom domain will be listed under App keys section.

   

Your next step is to update your code to use the custom domain.

If you encounter any errors during the setup, see the troubleshooting tips below.

Advanced setup

Link to this section

CAA records (if you use them)

Link to this section

If your domain has CAA (Certificate Authority Authorization) records, they restrict which certificate authorities can issue SSL certificates for your domain. Kinde provisions and renews certificates using ZeroSSL and Let’s Encrypt, so you must allow both in your CAA records or certificate issuance will fail.

Add CAA records that authorize both providers. For your custom domain (or the subdomain you use, e.g. auth), add two CAA records like this:

Host	Record type	Value
auth (or your subdomain)	CAA	0 issue "sectigo.com"
auth (or your subdomain)	CAA	0 issue "letsencrypt.org"

• ZeroSSL uses the CA domain sectigo.com
• Let’s Encrypt uses the CA domain letsencrypt.org

If you only list one CA in your CAA records, add the other. If you have no CAA records, you don’t need to add any; certificate issuance will work as normal.

Add the custom domain to social sign-in

Link to this section

When you use social connections to authenticate users, you need to add the callback URL to the provider app so that the custom domain shows on the sign-in form, instead of kinde.com.

If you haven’t set this up, follow these instructions for the relevant social provider.

If you already have social auth set up, make sure you add the custom domain callback (e.g. auth.yourbusiness.com/login/callback) as an authorized redirect URI in the provider app.

Using multi-level subdomains

Link to this section

If you are using a multi-level subdomain, like multi.subdomain.yourbusiness.com, how you set up DNS records will depend on how your zones are set up.

The details provided in the admin console assume the domain entered is adding a single level to your DNS zone, but if you are adding more than one level you’ll need to create others.

So if your business is multi.subdomain.yourbusiness.com and your zone is yourbusiness.com, you need to create a DNS entry for multi.subdomain, as well as for _acme-challenge.multi.subdomain.

There are many different ways people manage multi-level domains and zones, and unfortunately we can’t cover all variations in these instructions. Please contact Kinde support if you need help.

Troubleshoot Chrome ‘Dangerous site’ warning

Link to this section

Chrome can block your custom domain with a red Dangerous site page. Users cannot open the sign-in screen on that domain.

Google Safe Browsing shows this warning. It is usually not an SSL problem. Your certificate can be valid and the warning can still appear. To rule out setup issues, see Check verification status in Kinde.

Common reasons Google may flag the domain:

• The domain is new. Google has no history for it yet, so a new sign-in page can look suspicious.
• The domain name recently changed. You have repointed the auth hostname, for example by removing one custom domain and attaching another.
• The sign-in page looks like another brand. If the page title, logo, or favicon doesn’t match your product, or looks like a well-known login page (for example, Google or Microsoft), Google may treat it as phishing.
• Other content on the same domain was flagged. If your main domain or another subdomain has a security issue, the warning can affect your custom domain too.
• The domain had a bad history. If you bought a domain that was used for spam or malware before, Google may still flag it.
• Someone reported the page. User reports to Google Safe Browsing can trigger a review.

Check that sign-in still works on your Kinde domain

Link to this section

Your Kinde domain looks like your_subdomain.kinde.com. You chose it when you created your account. Find it in Kinde under Settings > Business > Details.

Open that domain in a private browser window. If the sign-in page loads there and Chrome only blocks the custom domain, your Kinde account is fine. The warning is on the new domain name.

Ask Google to review the domain

Link to this section

You own the domain, so the review has to come from you.

1. In Google Search Console, add and verify your domain if you haven’t already. Open Security issues to see why Google flagged the domain. Fix any issue listed there, then select Request review.
2. Also submit a report here: Report a Safe Browsing error.

Kinde cannot send this review for you.

Let users sign in while you wait

Link to this section

Keep the custom domain in Kinde. Do not delete it.

In your app’s config, change the Kinde domain (often set as KINDE_ISSUER_URL) to your Kinde subdomain:

https://your_subdomain.kinde.com

Leave your app URL and your callback URLs as they are.

Users will need to sign in again. Sign-in on the Kinde domain does not carry over to the custom domain, or back again.

If you use your own Google, GitHub, or other social app, add this redirect URL in that app:

https://your_subdomain.kinde.com/login/callback

Switch back when the warning is gone

Link to this section

1. Open your custom domain in a private browser window and confirm the red page is gone.
2. Change the Kinde domain in your app’s config back to your custom domain, for example https://auth.example.com.
3. Leave the CNAME and _acme-challenge DNS records in place.

Users will need to sign in again.

Also check Design > Brand in Kinde. The page title, favicon, and logo on the sign-in page should match your product.

Use Google Search Console

Link to this section

Add and verify your custom domain in Google Search Console as soon as you set it up. Google will notify you if the domain is ever flagged, and having a verified domain may also be a positive signal to Google.

Custom domain FAQs

Link to this section

How long does it take to make the custom domain live?

Link to this section

The verification process can take anywhere from 5 minutes to a few hours, depending on who your domain provider is. If it’s taking longer than expected, check your DNS records are correct on your provider site.

Why use a custom domain?

Link to this section

Using a custom domain on Kinde gives your users a seamless experience, improves branding, and helps with security.

By default, Kinde issues a Kinde subdomain when you first register. But for your production environment you can use your own custom domain instead of Kinde’s as your URL. For example, auth.yourbusiness.com instead of your_business.kinde.com.

Here’s why you might want to use a custom domain:

• Seamless experience: It will give your users the impression they have never left your application to authenticate, creating a seamless user experience.
• Security: For Single Page Applications (SPAs), it means we can securely set a first-party cookie, so authentication state persists across full-page refreshes and new tabs.
• Branding: If you also register the domain in the configuration for any social providers you are using, the social providers auth screen will be customized with your app details.

When to still use the Kinde domain

Link to this section

Even if you use custom domains, you need to use your Kinde domain for Kinde Management API access and machine-to-machine applications.

Do I need to keep the challenge DNS record after verification?

Link to this section

Yes, the challenge DNS record needs to remain in place after verification in order for us to renew your SSL certificate on an ongoing basis.

Does Kinde support local domains?

Link to this section

Currently, Kinde only supports *.localhost for non-https traffic.

Glossary

Link to this section

Custom domain tips

Link to this section

• Name your custom domain. It needs to include a subdomain for this procedure to work. Common subdomain names include account, id, or auth, e.g. auth.yourbusiness.com.
• Make sure your application is configured to use the exact custom domain. This includes updating the environment variables and any relevant configuration files. For example, the KINDE_ISSUER_URL needs to be updated to the custom domain.
• Keep the callback and logout redirect URLs in your Kinde settings pointed to your application destinations. Update only the issuer setting, such as KINDE_ISSUER_URL, to use the custom domain.

Domains and auth endpoints

Link to this section

Auth endpoints are available for both custom domains and your Kinde subdomain. You can get tokens from either endpoint, but they are not interchangeable. For example, if you get an ID and access token from auth.yourbusiness.com, it cannot be used with your_business.kinde.com.

Tips for the DNS set up

Link to this section

When you create the DNS records for linking your own domain to Kinde, be sure to match the format you have used above.

For example, if your custom domain is auth.yourbusiness.com, then:

• Host: auth
• Record type: CNAME
• Value: The exact Value shown in Kinde for your domain
• TTL: Leave as default
• Routing policy: Leave as default

Get support

Link to this section

If you need help, contact Kinde support.