Custom domain with Auth0-managed TLS: CNAME, verification, feature switchover

Custom domain setup

1. Add the domain

Dashboard > Branding > Custom Domains > Add. Enter login.YOUR-DOMAIN. Choose Auth0-managed certificates unless you have a reason to bring your own (managed = issuance + renewal handled).

2. DNS

Add the CNAME record Auth0 shows, pointing your hostname at the Auth0 edge. Then complete verification in the dashboard. Verification proves control of the domain.

3. Switchover order

1. Verify the domain first; do not point SDKs at it before verification completes.
2. Update SDK/API domain values to the custom domain.
3. Update Allowed Callback URLs, Logout URLs, and Web Origins to the custom domain (keep the canonical entries during the transition, remove after).
4. Check the feature-compatibility table in the docs: a few features still use the canonical domain. Do not assume everything moves.
5. Token iss: by default the issuer remains the canonical domain. API validators must accept the canonical issuer unless you change the issuer configuration. This is the number one post-migration 401 cause.

Why bother

• Branding: users see your domain in the URL bar during login.
• First-party cookies: fixes Safari ITP silent-auth breakage with no code changes.
• Consistent security posture for enterprise customers inspecting URLs.

Checklist

• Verified before cutover; both domains registered during transition.
• API issuer validation handles the canonical issuer.
• Renewal: managed certs auto-renew; self-managed need a calendar reminder.

Auth0's custom domains doc describes the custom domain as a mask for the tenant domain, Auth0-managed vs self-managed certificates, CNAME verification, the feature compatibility table, and token/URI behavior. Verified against live docs 2026-09-26.