Hi! We transition our app so every customer has their own subdomain (e.g mycustomer.venice.io) Some QQ: 1. Is it possible to identify the tenant from the subdomain to trigger different behavior? e.g select the active tenant, select a specific login logo, auto trigger their SSO, etc? 2. Can I have the SSO redirect URI somehow set to the correct subdomain automatically, assuming the subdomain is the tenant name? I see on your docs that it can be overridden by API, but what happens if the flow was triggered from their IdP app? 3. Can I set the login cookie to the subdomain of the customer instead of the full domain? I can't see this option in the project settings on the dropdown.

Tenant Identification from Subdomain Yes, you can identify tenants from subdomains and trigger different behaviors. You can pass the tenant name, ID, or email domain to Descope's authentication methods . Extract the subdomain from the URL and use it as the tenant identifier when calling SSO or authentication flows.

// Extract tenant from subdomain
const subdomain = window.location.hostname.split('.')[0]; // 'mycustomer' from '<http://mycustomer.venice.io|mycustomer.venice.io>'
// Use in SSO initiation
const descopeSdk = useDescope();
await descopeSdk.sso.start(subdomain, redirectURL, loginOptions);

Dynamic SSO Redirect URIs Descope supports dynamic redirect URLs using tenant information . You can configure redirect URLs with template variables like

{{tenant.name}}

or

{{tenant.domain}}

in your SSO settings. When the flow is triggered from an IdP app, Descope will automatically substitute these variables with the actual tenant values. For IdP-initiated flows, the redirect URL configured in your SSO settings will be used, and the tenant context will be preserved through the authentication process. Cookie Domain Configuration Cookie domain settings are configured at the project level through your custom domain setup . Descope sets cookies with

SameSite=Strict

on your configured custom domain and its subdomains. You'll need to set up a CNAME record pointing to Descope's servers, and cookies will be accessible across all subdomains of your configured domain. The cookie domain cannot be set per-tenant - it's a project-wide setting that applies to all authentication sessions. SSO with Client SDK | Descope Documentation SSO Settings Guide | Descope Documentation Refresh Token Storage in Project | Descope Documentation