Skip to content
Open the app

Domains and white-label URLs

Developers4 min read

A common question during onboarding is whether an institution gets its own web address: does UniSC go from app.firstsix.com.au to unisc.firstsix.com.au? This page explains how addressing works today, and what a dedicated subdomain involves if you want one.

The short version: a separate URL is not required for your institution to be fully branded. Branding is applied after sign-in, per institution, on the shared addresses. A vanity subdomain is an optional extra, not a prerequisite.

How it works today

Every institution uses the same two addresses:

  • app.firstsix.com.au — the student app
  • console.firstsix.com.au — the staff console

First Six does not pick your institution from the URL. It picks it from who signs in: the tenant is resolved from the authenticated user's institution, and your white-labelPresenting the product under your institution's own colour, logo, and identity rather than a generic First Six look. branding (logo, accent colour, font, crisis resources) is applied from that.

Branding follows the login, not the URL

A UniSC student visits app.firstsix.com.au, signs in with UniSC single sign-on, and lands in a fully UniSC-branded app. The address bar still says app.firstsix.com.au, but everything inside is theirs. The same shared app serves every tenant, isolated by row-level security and branded per login.

So "going from app.firstsix.com.au to a UniSC experience" already happens today — at sign-in, not in DNS.

What a dedicated subdomain adds

A vanity subdomain like unisc.firstsix.com.au changes one thing: the address your students see before they sign in. It is cosmetic and trust-building (the URL on a poster reads as the university's own), not a functional requirement, and it is offered as a setup option rather than a self-serve toggle.

Here is what standing one up involves:

  1. We create the subdomain

    We point unisc.firstsix.com.au at the First Six app and issue its TLS certificate. Because it sits under firstsix.com.au, which we control, there is no DNS work on your side for this option.

  2. We map the host to your tenant

    The app is taught that this host belongs to UniSC, so a visitor who arrives there sees UniSC branding and the UniSC sign-in immediately, before authenticating.

  3. You add the new sign-in URL to your IdP

    Your identity provider needs the new callback URL added to its allowed redirect URIs, so single sign-on works from the new host. This is the one step on your side. See the OIDC flow.

  4. We switch it on

    Once DNS, TLS, host mapping, and the IdP redirect URI all line up, the subdomain goes live alongside the shared address.

A domain on your own zone

Some institutions want the address on their own domain (for example firstsix.unisc.edu.au rather than a firstsix.com.au subdomain). That is a bigger piece of work because it lives in your DNS zone:

  • You create a CNAMEA DNS record that points one hostname at another, so traffic to firstsix.unisc.edu.au is served by First Six. from the chosen hostname to a target we provide.
  • We provision the TLS certificate for that hostname and map it to your tenant.
  • You add the new sign-in URL to your IdP's redirect URIs, as above.

This needs coordination with your IT and DNS owners, so plan it into onboarding rather than launch week.

One thing that always has to change: SSO redirect URIs

Whichever option you choose, every new host that students sign in from must be added to your identity provider's allowed redirect URIs. If sign-in works on the shared address but fails on a new subdomain, a missing redirect URI is the first thing to check.

Common questions

Do we need our own subdomain to be branded?

No. Branding is applied per institution after sign-in on the shared app.firstsix.com.au, so your students get the full UniSC look without any domain change. A subdomain only changes the pre-login address.

Is unisc.firstsix.com.au self-serve in the console?

Not today. It's a setup option we configure with you (DNS, TLS, host mapping), not a toggle in settings. Raise it during onboarding if you want it.

Can students still use the shared address after we get a subdomain?

Yes. A dedicated subdomain runs alongside the shared address; both resolve to the same branded experience for your tenant.

What breaks if we change the address?

The usual culprit is single sign-on: the new host has to be in your IdP's redirect URIs. Old links to the shared address keep working, so it's additive, not a cutover.

The OIDC flowHow First Six does single sign-on — the OIDC authorization-code flow, per-tenant config, and how a login links to a student or staff record.BrandFor partners embedding or referring to First Six — logo, colour, and voice in brief.Onboarding, step by stepWhat rolling out First Six actually involves — who needs to be at the table, the sequence, and the pre-launch checklist.
Was this helpful?
Need more help?

The fastest answer is usually one question away.

Edit this page on GitHub