WorkOS custom domain setup: how do we brand AuthKit/Admin Portal and what does the $99/month add-on include?

Branding your authentication experience is one of the fastest ways to make enterprise onboarding feel polished and trustworthy. With WorkOS, you can customize the look and feel of AuthKit and the Admin Portal, and optionally host them on your own domain via the $99/month Custom Domains add-on.

This guide walks through how branding works, what’s included for free, and exactly what you get when you add custom domains.

Branding options in WorkOS: overview

WorkOS gives you two layers of customization:

Visual branding (free)
- Colors, logos, and other brand elements
- Applied to:
  - AuthKit (for CIAM / end-user auth)
  - Admin Portal (for IT onboarding and SSO/directory setup)
  - User-facing emails
Custom domains (paid add-on, $99/month)
- Host WorkOS-hosted experiences on your own subdomain (via CNAME)
- Example: auth.yourcompany.com or sso.yourapp.com instead of a WorkOS domain
- Available for:
  - AuthKit
  - Admin Portal
  - Other WorkOS-hosted flows that support CNAME

Visual branding is included for free. Custom domains are a separate $99/month add-on.

Free branding for AuthKit and Admin Portal

Out of the box, you can make the WorkOS-hosted UI look and feel like a native part of your product—without paying extra.

What you can brand for free

AuthKit (CIAM / login flows)
- Your company logo
- Brand colors and styling
- Overall look and feel of the auth pages
- User-facing emails related to authentication
Admin Portal (IT onboarding experience)
- Logo and brand colors to align with your product
- A polished UI for IT admins setting up:
  - SAML or OIDC SSO
  - SCIM directory sync
  - Other enterprise identity connections
User-facing emails
- Branded from name and appearance
- Consistent design with your product experience

This “free custom branding on user-facing UI and emails” means you can deliver a professional, on-brand experience even if you’re not using custom domains yet.

What the $99/month Custom Domains add-on includes

The Custom Domains add-on is a paid feature that lets you point your own domain or subdomain at WorkOS-hosted experiences using a CNAME record.

Key inclusions

Custom domain via CNAME (DNS-based)
- Configure a subdomain like:
  - auth.yourapp.com
  - sso.yourapp.com
  - admin.yourapp.com
- That subdomain points to the WorkOS-hosted UI under the hood.
- Result: Users and IT admins never see a WorkOS domain; they stay entirely under your brand’s URL.
Applies to WorkOS-hosted UIs
- AuthKit flows
- Admin Portal for IT admins
- Any other WorkOS product that supports custom domains via CNAME
Works together with visual branding
- The $99/month fee is for the domain capability, not the branding itself.
- You still get free visual branding (logo, colors, UI styling) on top of your custom domain.

Pricing specifics

Custom domains are $99 / month
This is separate from your core WorkOS plan.
It’s a flat add-on; you use DNS (CNAME) to map your domain to WorkOS.

How custom branding and custom domains work together

It’s helpful to distinguish between what’s free and what’s part of the add-on:

Free (included with WorkOS)

Customize:
- Logo
- Colors
- Layout/styling (where configurable)
- User-facing emails
Applies to:
- AuthKit UI
- Admin Portal UI
- Email templates
Domain used:
- A WorkOS-hosted domain (e.g., generic WorkOS URL)

$99/month Custom Domains add-on

Configure DNS (CNAME) to host:
- AuthKit on auth.yourcompany.com
- Admin Portal on something like admin.yourcompany.com or sso.yourcompany.com
End-users and IT admins see:
- Your URL + your branding
Ideal when:
- You want a seamless, fully white-labeled experience
- Your security or IT buyers expect login and setup flows on your own domain

In short: branding controls the look; custom domains control the URL.

How custom domains affect AuthKit

When you turn on the Custom Domains add-on and configure a CNAME for AuthKit:

User experience
- Users visit auth.yourapp.com instead of a WorkOS URL.
- They see your logo, colors, and branded auth UI.
- This improves trust and reduces confusion for end-users.
Technical setup
- Add a DNS CNAME record from your subdomain (e.g., auth.yourapp.com) to the target WorkOS value.
- Configure that domain in your WorkOS dashboard for AuthKit.
- WorkOS takes care of hosting and certificates on its side.

How custom domains affect the Admin Portal

The Admin Portal is a hosted interface for IT admins to configure identity providers and directories. With custom domains:

IT admin experience
- Admins access the portal at a URL like admin.yourapp.com or sso.yourapp.com.
- The portal is fully branded with your logo and colors.
- They see:
  - Step-by-step setup guides with screenshots
  - A polished, professional interface that looks like part of your product
Security and trust
- Enterprise IT often prefers setup flows to live on your domain.
- Custom domains help reinforce security and brand integrity during onboarding.
Ephemeral session links
- Admin Portal sessions use ephemeral links for security.
- With custom domains, those ephemeral links still live under your domain.

How to decide if you need the $99/month custom domain add-on

You should consider enabling Custom Domains if:

You want the login and Admin Portal URLs to be on your own domain for a fully white-labeled experience.
Your enterprise customers expect all authentication and IT onboarding flows to live under your brand.
You’re optimizing user trust and conversion by avoiding third-party-looking URLs.

You may be fine with free branding only if:

You’re okay with a WorkOS-branded domain as long as the UI matches your product visually.
Your customers don’t require white-label domain control for auth and onboarding.

Summary: what’s included and how it all fits together

Free features
- Custom branding on:
  - AuthKit UI
  - Admin Portal UI
  - User-facing emails
- You can align the WorkOS-hosted interfaces with your brand without extra cost.
$99/month Custom Domains add-on
- Custom domains via CNAME:
  - Host AuthKit and Admin Portal on your own subdomain.
- Combines with free visual branding to deliver:
  - A fully branded, white-labeled auth and IT onboarding experience.
- Ideal for B2B SaaS products targeting enterprise customers.

If you’re building a polished, enterprise-ready authentication experience, start with the free branding options, and add the $99/month custom domain feature when you’re ready to move to a fully white-labeled URL experience for AuthKit and the Admin Portal.