Use your own domain for Stytch assets and API calls

When using a service like Stytch to implement part of your application's functionality, your users's browsers will be making API calls and requesting assets that are handled by Stytch's servers. While it is often workable to have these requests go directly to Stytch, it is usually desirable, and sometimes necessary, to configure your application to serve these requests from your own domain.

Having the URL for components of your application served from your own domain instead of calling out to stytch.com is a better experience for your users. In essence, it is a form of "white labeling" to show all requests coming to and from your app. As your users are less likely to be familiar with Stytch, not only is it confusing if they see requests coming to our servers, they may consider this to be a security or vulnerability concern.

In addition, some Stytch products are more directly affected by not using a custom domain. Fraud protection, for instance, is more likely to be blocked by ad blockers. Emails to your users, such as those sent by Magic Links, will appear to come from an stytch.com address instead of your domain. More info on how custom domains interact with our products can be found below.

Setting up a custom domain is an important part of integrating Stytch seamlessly with your app.

In order to configure a custom domain, there are two sources which you will need to update:

• Your DNS records will need to be updated with your provider to include a CNAME record. This will create a subdomain on your site which acts as an alias for a subdomain of stytch.com
• Your Stytch configuration will need to be updated to inform Stytch of the details of your subdomain.

It's best to approach this process by doing both steps in parallel.

1

Adding a custom domain

Start by going to your Project details in the Stytch dashboard. Scroll down in the Project Settings view until you see the "Custom domain setup" section.

Click the "+ Add New" button to open a dialog with information needed for the next step. Take note of the URL provided, {SUBDOMAIN}.stytch.com, as we will need it for the next step.

Custom domains can have a far-reaching impact on how your app interacts with Stytch. These are some of our products which benefit from a custom domain:

In order for our device fingerprinting product to operate successfully we provide a script that infers details about the end users’ environment. This type of introspection can be flagged by ad blockers. Serving this script from your own domain provides some assurance that the script should be allowed to run.

For more detailed information about fraud prevention please reach out to support@stytch.com.

Stytch's SDKs will make requests to api.stytch.com by default, but HttpOnly cookies cannot be used across domains. To properly use HttpOnly cookies with Stytch's SDKs your app will need to configure a custom domain.

If Stytch is not configured with a custom domain, emails sent by Stytch to your users (for instance, when using magic links) will appear to come from a Stytch email address (e.g. login@stytch.com). Using a custom domain can alleviate user confusion and affect how your email is processed by spam filters.

For some OAuth providers (such as Google), the domain used for logging in must be authorized by the provider in order to properly display your app's consent screen. In order for the consent screen to indicate that it is returning to your app instead of to stytch.com, the redirect URI provided to the login flow must be owned by your authorized domain.

Read more about the above products for more specifics about how they each work.

For questions, reach out to support@stytch.com.