Manage a tenant without crossing its boundaries.

Understand the hierarchy

Assign a SubdomainAdmin the OrgAdmin role for the organization they use as their default organization. Authentication continues to enforce the organization-level assignment while the additional role enables subdomain-wide administration.

Create an OAuth client

1. Open the admin portal for the same tenant host used by the application issuer.
2. Create the OAuth client and select the required scopes and authorization code grant.
3. Add the application callback URI exactly, including its base path and provider id.
4. Submit the client form and store the generated client secret outside source control.
5. Configure the application with the matching issuer, client id, and client secret.

Manage organizations and users

1. Open Organizations and select an organization to view its Details, Roles, and Users tabs.
2. A SubdomainAdmin can open, rename, and manage users for organizations in the assigned subdomain.
3. Search for an existing user to add, remove, or change their default organization.
4. A user must belong to the selected organization before it can become their default organization.
5. Use the organization Roles tab to create, rename, or delete roles for that organization.

SubdomainAdmin access does not make the administrator a member of every organization. A user must belong to an organization before it can become their default. Operations outside the assigned subdomain are rejected.

Manage organization roles

Select an organization, then open Roles. An OrgAdmin for that organization or a SubdomainAdmin for its subdomain can create, rename, and delete its roles.

A role is bound to the selected organization when it is created. There is no separate role-to-organization assignment step. The organization in the URL is authoritative, and cross-subdomain access is rejected.

Delegate subdomain administration

Open Subdomain, then Users. Eligible users can be assigned or removed with the SubdomainAdmin action in the user table.

The user must have a default organization in this subdomain and be OrgAdmin for it. The final SubdomainAdmin cannot be removed.

Enroll and use passkeys

Open Your Profile, select Passkeys, and register a platform authenticator or another device. A user who opens the page without an authorization-server session is sent through sign-in before passkey management is displayed.

Test from a guest browser profile to verify the complete flow. Cross-device authentication may show a QR code and ask for biometric confirmation on the device that stores the passkey.

Diagnose common failures

OAuth client not found

Confirm the client was submitted and belongs to the current issuer host.

Redirect URI mismatch

Match scheme, host, base path, callback path, and provider id exactly.

User cannot open an organization

Verify the user is OrgAdmin for it or SubdomainAdmin for the subdomain that contains it.

Organization belongs to another subdomain

Use an organization mapped to the current admin host. Cross-subdomain administration is denied.

Subdomain menu is missing

Verify the user has a SubdomainAdmin assignment for the current subdomain, then start a new session.

Passkeys returns unauthorized

Start from the profile link and complete authorization-server sign-in when prompted.