White-Label

Your brand everywhere.
Zero fingerprints.

Custom domains, full branding control, per-organization overrides. Your users never see AuthFI.

Available on Starter and above. See pricing

Start free Read the docs

Branded login

Your brand on the page. None of ours.

White-label is a multi-tenant rendering problem, not a fork. Every login page is served by one AuthFI runtime, but the brand it paints is resolved from the request hostname: auth.hospital.com renders City Hospital's logo and palette; login.acmecorp.io renders Acme's. Tenant theme tokens — logo, primary color, background, custom CSS — are injected as CSS custom properties at render time, so a colour change is data, not a deploy.

  • The problem it removes: shipping and hosting a per-customer login app — the thing that turns "10 enterprise logos" into 10 codebases.
  • Theming is a token override, not a CSS rewrite — the markup, a11y, and security posture stay identical across every tenant.
  • The payoff: your users sign in at your address and see your brand — no AuthFI fingerprints, one surface to patch.
auth.hospital.com
City Hospital
name@company.com
Sign in
login.acmecorp.io
Acme Corp
name@company.com
Sign in

Same runtime, two hostnames, two brands. The tenant theme is resolved per request.

DNS yourcompany.com zone
STEPRECORDRESOLVES TO
CNAMEauth.yourcompany.comAuthFI edge
TLSACME / RFC 8555auto-renew
Emailnoreply@yourcompany.comSPF · DKIM · DMARC
CNAME to AuthFI · SSL auto-provisioned · zero config after the record lands.

Custom domains

Your domain end to end — auth and email.

A vanity auth domain is one CNAME — auth.yourcompany.com points at the AuthFI edge, no IP for you to own. TLS is issued and rotated automatically over ACME (RFC 8555), served with SNI per host and HSTS, so certificates never become a 2 a.m. page. The sender is yours too: noreply@yourcompany.com with SPF and DKIM configured, so branded mail authenticates as your domain.

  • Auth domain: auth.yourcompany.com — CNAME to AuthFI, SSL auto-provisioned, zero config.
  • Email sender: noreply@yourcompany.com — SPF/DKIM configured, your brand in every email.
  • Per-org overrides: each B2B customer gets their own domain, logo, and colors — e.g. login.clientA.com.

Branded email that lands

Transactional mail that authenticates as you.

A password reset that hits the spam folder is a support ticket and a churned signup. Sending from noreply@yourcompany.com only works if receivers can prove the mail is really yours — which is exactly what the three email-auth standards do. AuthFI signs and aligns every transactional template so it passes DMARC from your own domain.

SPF

RFC 7208

It authorizes the sending IPs for your domain.

DKIM

RFC 6376

It signs each message with a key in your DNS.

DMARC

RFC 7489

It tells receivers what to do on a failure.

Transactional templates · branded per tenant
Welcome emailPassword resetMFA verificationMagic linkInvitation
Each renders with the tenant's logo and colors and ships SPF/DKIM-signed from their domain.

Full branding control

One theme. Login, portal, and email.

Logo, colors, fonts, backgrounds, button styles, email templates — all customizable from the dashboard, and all resolved from a single per-tenant theme. Set it once and it propagates to every surface a user touches; for B2B, each organization carries its own override, so one platform serves a hundred brands without a fork.

Login page

  • Logo (light + dark)
  • Primary color
  • Background image/gradient
  • Custom CSS

User portal

  • Logo
  • Colors
  • Custom CSS
  • Domain

Email templates

  • Welcome email
  • Password reset
  • MFA verification
  • Magic link
  • Invitation

Per-org overrides

Every B2B customer gets their own domain, logo, and colors. The override lives with the organization, so login.clientA.com and login.clientB.com render from the same engine — no code branch per customer.

Get started

Ready to get started?

Free for 5,000 monthly active users. No credit card required.

Start free Read the docs