Skip to main content

Custom Domain Changes and 2FA Implications

Users with Yubikey, WebAuthn, or FIDO authentication are tied specifically to the login domain of your site. If you change your site's custom domain settings, every user with this type of 2FA enabled will need to remove their existing 2FA settings and re-configure them. This follows the WebAuthnExternal LinkThis link leads to an external website and will open in a new tab requirement that devices generate site-specific public/private key pairs.

When the change would affect users, you'll see a message similar to this when you attempt to change the domain:

If your site has X users using a Yubikey or Webauthn-based two-factor authentication (2FA) method. These methods are tied to the existing domain. If you change your domain, these 2FA methods will be removed and users will be required to re-register these methods.

Additional Custom Domains

Yubikey, WebAuthn, and FIDO 2FA methods can only be set up while logged in through your Primary Custom Domain. If you try to configure one of these methods while logged in through a site alias Custom Domain, you'll see a message like this:

Your account is configured for login using a custom domain https://your-primary-domain.com, and the chosen 2FA method is tied specifically to the custom domain of your site to align with the WebAuthn / FIDO2 standards requirement. To set up this selected 2FA type, please log in using the custom domain URL https://your-primary-domain.com.

Starting a login with an already-configured Yubikey, WebAuthn, or FIDO credential works from any configured Custom Domain. The authentication step happens against your Primary Custom Domain automatically, and your session ends up on the Primary Custom Domain rather than the address you started at.