Branded auth and domains

Branded sign-in

An App that isn't Public shows visitors a sign-in screen before any of the App loads. Visitors sign in with their Cheqq account through Continue with Cheqq; the screen is content only, and the sign-in itself is always Cheqq's. Someone you invited who's new to Cheqq creates an account there with the email you invited, or continues with Google, and comes straight back to the App. Ask the App Builder to change:

• Headline and subhead text
• Logo — falls back to the App's own logo or your workspace's brand kit logo if you don't set one for the sign-in screen
• Self sign-up (Invited Apps) — whether any signed-in Cheqq user may enter without an invite, or only people you've invited
• Custom CSS for further styling

Your workspace's brand kit (logo, colors, fonts) feeds into this screen as the default look, and is also used as context for the App Builder when it generates pages — set it once at the workspace level and every App can draw from it.

What custom CSS may do

The sign-in screen runs no script, and your CSS is read as a stylesheet and written back with only what it recognises:

• Style rules using layout, spacing, color, type, border, and similar properties, including inside @media, @supports, @container, @layer, and @keyframes.
• Images and fonts loaded over https or embedded in the stylesheet, and @font-face with an https or embedded source.

Anything else — @import, expression(), javascript: URLs, backslash escapes — is left out rather than passed through. A stylesheet is kept to 32 KB.

Visitor roles

Signed-in App visitors get one of three roles: owner (you, the author), member, or guest. Which roles are allowed depends on the App's audience — a Team App only admits workspace members, while an Invited App can admit guests you've specifically added.

Sessions

An App visitor's sign-in session lasts 7 days. If you're previewing your own unpublished App changes, you get a separate, short-lived 5-minute preview session instead — long enough to check a change without leaving a long-lived session open on a draft.

Each App keeps its own sign-in, which no other App can read or reuse. Cheqq checks a visitor's access again at least once a minute, so a guest you revoke, a member who leaves the workspace, or someone whose Cheqq email changes loses access within a minute.

Custom domains

Every App gets a working *.cheqq.site address the moment it's published. On a Pro or higher workspace, you can point a custom domain at a published App as well:

1. Open Domain in the App Builder's header, enter your domain (e.g. www.example.com), and select Connect domain.
2. Add the verification records Cheqq shows you.
3. Add the routing record that points your domain to Cheqq.
4. Status updates on its own while the dialog is open as DNS propagates; Check status asks again right away.

Your generated *.cheqq.site address keeps working even after a custom domain is connected, so it's always available as a fallback.

For the click-through, see Manage an App.