Hosted sign-in & custom domains

The way in, designed once and used by every app

Hosted sign-in, sign-up, reset and second-factor pages in your colours and on your own domain. Choose the steps and their order in the console; every app that reads the flow follows, with no redeploy.

Book a demo How the flow works

Sign-in flow · Objiq · ProductionLive

1Passkey

2Approve on Vaarta Authenticator

3One-time code by email or WhatsApp

4Magic link by email

5Password

Passwords are off. Every app reading this flow stops showing the field as soon as you save.

Why it matters

Stop maintaining login forms

One front door for every app

Sign-in, sign-up, reset, verification, magic links, recovery and onboarding pages we host.

Change it without a release

Reorder steps or turn passwords off, and every app reading the flow changes at once.

Your brand, your domain

Colours, logo, font, words and a verified custom domain.

How it works

From the console to the page

1ConsoleOrder the stepsPer journey: sign-in, sign-up, onboarding, password reset; per app or per organization.
2PolicyReconcile with policySteps the policy forbids are dropped, a required second factor is added, and a lockout is impossible by design.
3Hosted page or SDKRead the surfacefetchLoginSurface returns the plan; a frozen fallback covers an unreadable plan.
4PersonSign inOnly the methods you switched on are shown.

Capabilities

Everything the front door needs

Capability	Details	Status
Hosted pages	Sign-in, sign-up, forgot and reset password, verify, magic link, recover, onboarding, second factor.	Live
Branding	Six colours, logo, favicon, font, corner radius, titles and subtitles, a "powered by" switch, email from and reply-to.	Live
Copy and languages	Fixed copy slots up to 200 characters; up to 20 languages an app, right-to-left supported; English and Hindi shipped.	Live
Social sign-in	Google, Microsoft (with an Entra tenant), GitHub and LinkedIn ready-made, plus any OpenID Connect provider.	Live
Company sign-in over SAML	Per-organization SAML connections.	Early access
Custom domains	Ownership by DNS TXT at _identity-verify.<domain>, a CNAME to our edge and a managed certificate. Our team activates each domain.	Live
Templates and senders	Edit email templates with checked variables; send email, SMS and WhatsApp through your own provider.	Live
Passwordless approve-on-phone	Type a login ID, then tap the matching number; no password at all.	Early access

Configuration

Per-application settings

Option	Values	Default
Branding colours	Primary, secondary, background and three more, strict hex	your choice
logo_url · favicon_url	Images for the pages	none
font_family · border_radius	Font and corner radius up to 64	Inter · 12
supported_locales	Up to 20 languages	English
allow_password_login	Show the password field at all	on
Custom domain	A subdomain you own, verified by DNS	none

Under the hood

What protects it

From the code

@vaarta/auth-flowthe web package

import { fetchLoginSurface, FALLBACK_LOGIN_SURFACE }
  from '@vaarta/auth-flow';

// The steps you set in the console, in your order,
// already reconciled with policy.
const surface = (await fetchLoginSurface(authConfig))
  ?? FALLBACK_LOGIN_SURFACE;

surface.fields   // passkey, email code, password ...

Security notes

Policy always wins over the flow: a method you switched off is simply not there.
Verified domains are re-checked daily.
Every hosted page is protected by the bot check you configured.
Hosted pages pick the language from the request, then the browser, then the app default.

Works with

Part of one platform

Passkeys & MFA The factors the flow offers.CAPTCHA The bot check on every page.SAML single sign-on Company sign-in.SDKs Render the flow yourself.

Which plans include it, and the limits that apply, are on the plans page.See plans →

Explore the platform

One platform, every piece of sign-in and access

Ship a sign-in people actually like

Design the flow, brand the pages and switch on passkeys today.

Book a demo Start free trial