Brand your login pages

Branding changes how hosted login, the account portal and emails look. Settings are inherited in this order: platform default, environment, application, organization. Each token takes the value from the most specific level that defines it.

What you can set

Colors: color.primary, color.primary_contrast, color.background, color.surface, color.text, color.text_muted, color.border, color.link, color.focus_ring, color.error and color.success, as sRGB hex. Light and dark have separate values, and mode is light, dark or system.
Fonts: font.body and font.heading from the allowed font list, or an uploaded font; font.size_base from 14 to 18 px.
Shape: radius.card from 0 to 24 px and radius.control from 0 to 16 px.
Layout: center, split_left or split_right.
Images: logo, logo_height (24 to 80 px), favicon, and background_image (only with a split_* layout).

Organizations can override only the logo and color.primary tokens. An organization's brand is shown only when the organization context is verified, for example from a valid invitation or after the organization picker. A bare organization parameter does not change the look of the page.

Contrast protection

When you save, KeenAuth checks these pairs, for light and dark separately:

Pair	Minimum ratio
Text on background	4.5:1
`color.link` on background	4.5:1
`color.primary_contrast` on `color.primary`	4.5:1
Control border on background	3:1
Focus ring (`color.focus_ring`) on background	3:1

A pair below its minimum is rejected by the Management API with 422 brand_contrast_insufficient (RFC 9457). The error body names the field and suggests the closest color that passes; the suggestion keeps the hue and chroma and only moves the lightness. The dashboard offers the same suggestion with one click. A value that fails cannot be published. See Publish branding for the error format.

Custom CSS (Startup plan) can lower contrast, and KeenAuth does not correct that. A preview scan reports problems as warnings in the dashboard, and conformance of changes made with custom CSS is your responsibility.

Assets

Upload images and fonts with POST /v1/branding/assets. Images are at most 1 MB and fonts at most 300 KB. PNG, JPEG and WebP are accepted, ICO only for favicons and WOFF2 only for fonts. SVG is rejected. Images are re-encoded as PNG, scaled down to at most 1024×1024 px, and stripped of metadata. An environment can hold 200 files and 50 MB.

Custom CSS and templates

On the Startup plan and above you can add custom CSS and a page template. The security-critical parts of a page are drawn in a protected layer that your CSS cannot hide or cover: the application name and verified origin on consent screens, the list of requested permissions, the allow and deny buttons, security warnings, the environment banner and the legal links. Customer JavaScript does not run on any plan.

Use logical CSS properties (margin-inline-start, not margin-left); physical properties are rejected so that your styles work in right-to-left languages too. See Languages and right-to-left.

KeenAuth mark

Hosted login, the account portal and emails show a small "Secured by KeenAuth" line in the protected layer. On the Business and Enterprise plans, and in development environments, it is not shown. The plan is checked each time a page or email is drawn, so the line comes back if the plan changes. Custom CSS and text overrides cannot hide or change it.

Publish

Changes are saved as a draft and go live when you publish. Previous versions can be listed and rolled back. The API pages are under /docs/api/management/branding/, starting with Publish branding.