Issuers and custom domains

Identity generates a managed issuer at tenant creation. The identifier in the managed host is opaque and does not depend on an editable display name or slug.

Custom-domain sequence

1. Create the tenant and retain its generated managed issuer.
2. Configure DNS for the desired host.
3. Provision TLS and route the host to the Identity service.
4. Verify discovery from that exact external host.
5. Save the custom issuer through the Management API.
6. Register exact client callbacks under the final origins.
7. Configure resource servers to trust the final exact issuer.

Forwarded host and scheme headers must come only from a trusted edge. Browser protocol routes and their session cookies must observe the same external issuer origin.

An issuer change alters token identity and discovery URLs. Identity rejects unsafe post-use changes rather than silently migrating subjects, grants or clients.