customization

Branding, methods & hosted screens

Configure once in the dashboard

Console → your app → Branding: app name, logo, primary color, theme, allowed origins, and method toggles — with a live preview of the exact component our SDKs render.

The branding contract

shared across every sdk

{
  "name": "Acme Health",
  "logo": "https://cdn.acme.com/logo.png",
  "color": "#0070f3",
  "accent": "#52a8ff",         // optional — links
  "theme": "dark",             // dark | light
  "securedBy": true            // "Secured by NexAuth" footer
}

Methods

Toggle per environment: whatsapp · sms · email · voice · google · passkey · magiclink · password. Disabled methods never render in hosted/SDK screens and are rejected server-side.

"Secured by NexAuth"

Free tier — badge is rendered and cannot be removed (that's the deal)
Scale — securedBy: false or dashboard toggle

Allowed origins

Publishable keys only respond to requests whose Origin header matches your allowlist (branding.allowed_origins ∪ redirect_uris). Non-browser callers (mobile, server) are exempt — they can't be spoofed by a hostile site anyway. Empty list = allow all (dev mode).