An unfinished domain picks a different host, not a refusal

FixSecurityService
Shipped
August 25, 2026 at 5:16 PM UTC
Author
Kamo
Commit
8f85a21

Entering an org was refused outright unless its own custom domain had finished DNS and SSL. That was right while entering meant navigating to https://internal.<that domain>, because an unfinished host serves nothing and entering could only burn a one-time key on a dead tab. An org is reachable on the platform host now whatever state its own domain is in, which is the point of no longer requiring one — so the question is no longer whether to allow entry but which host to open. workspaceHostFor picks the org's own internal.<domain> when that domain is actually finished and the platform's otherwise, and enter-as now always returns a url so no caller has to work that out for itself. A domain that is merely CONFIGURED is not a host anyone can open: without its certificate a browser shows an interstitial rather than a workspace, and the key is spent either way.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing