Sign-in problems on a custom domain
Fix sign-in loops, missing sessions, and OAuth handoff problems on a custom domain.
Use this article when you sign in successfully but get sent back to login, lose your session when switching between hosts, or OAuth and SSO fail only on a custom domain.
Clipido stores session cookies on the exact hostname you use. Cookies set on {slug}.clipido.app are not shared with media.yoursite.com, and vice versa. Custom domains therefore use a dedicated auth handoff during Google, Microsoft, and SAML sign-in.
Start sign-in on the hostname you will use
Always open the workspace on the URL you want to keep using:
- Your assigned custom domain (for example
media.yoursite.com), or - The default deployment subdomain (
{slug}.clipido.app)
Do not start OAuth or SSO on one hostname and expect to land signed in on the other unless the custom domain is fully configured and Clipido redirects you there automatically.
How the auth handoff works
For social and SSO sign-in on custom domains, Clipido:
- Starts the flow on your current host and sets a short-lived verifier cookie (10 minutes, path
/auth) - Completes the provider callback on Clipido's managed auth infrastructure
- Redirects back to your custom domain with a one-time handoff token (5 minutes)
- Sets host-only session cookies on your custom domain
If any step fails, you may return to /login with no toast message. Common causes include an expired handoff token, a missing verifier cookie, or starting the flow on an unrecognized host.
Custom domain not fully live yet
Clipido only treats a custom domain as canonical when it is verified, assigned to the deployment, has ingress configured, and the SSL certificate status is "ready".
Until then:
- Automatic redirects from the default subdomain to your custom domain may not run
- OAuth and SAML handoff may not send you to the custom domain correctly
- You may appear signed in on
{slug}.clipido.appbut not on the custom hostname
Finish DNS verification, assignment in Admin Center "Branding", and wait for certificate provisioning before asking members to use the custom domain for daily sign-in.
Signed in on the default subdomain but not the custom domain
This usually means you signed in before the custom domain was ready, or you bookmarked the wrong URL.
Fix:
- Sign out or clear cookies for both hostnames
- Confirm the custom domain loads without certificate errors
- Open the custom domain directly and sign in again from that URL
- Link Google or Microsoft under Settings → Profile again if needed after switching hosts
Browser and network issues
| Issue | What to try |
|---|---|
| Third-party cookies blocked | Allow cookies for your custom domain and Clipido auth hosts; try another browser |
| Private browsing | Session cookies still work, but handoff verifier cookies must survive the redirect chain |
| VPN or corporate proxy | May strip cookies or block redirects between auth hosts |
| Multiple tabs | Close stale login tabs and restart sign-in in one tab |
SSO-specific problems on custom domains
SAML and SSO use the same handoff as Google and Microsoft. If "Continue with {connection name}" works on the default subdomain but not the custom domain, verify the custom domain is fully live and start SSO from the custom domain URL.
When SSO is "Required for all", Google and Microsoft are hidden. Make sure members use the SSO button on the same hostname they will work on afterward.
Rate limiting during repeated attempts
Auth endpoints are rate limited to "15 requests per minute". If you retry sign-in many times quickly, wait a minute before trying again.
When to contact support
Contact Clipido support if:
- DNS and assignment are correct but certificate status never reaches "ready"
- Every sign-in method fails on the custom domain while the default subdomain works after a clean retry
- Your organization uses a custom domain plus strict SSO enforcement and new members cannot complete first sign-in
Include the exact URL you start from and whether Google, Microsoft, mail, or SAML is affected.