From 054b03f20c1bb37c7d61d62368c27ea72661618e Mon Sep 17 00:00:00 2001 From: Livio Spring Date: Tue, 20 Jan 2026 10:38:47 +0100 Subject: [PATCH] chore: naming trusted domain (#11384) # Which Problems Are Solved As part of the consistent naming effort, this PR focuses on "Trusted Domains". # How the Problems Are Solved - All terms referring to a domain that is used in API responses were changed to "Trusted Domain" or "trusted domain". # Additional Changes None # Additional Context - closes #11297 --------- Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- .../guides/integrate/login-ui/login-app.mdx | 4 +-- .../guides/integrate/login/hosted-login.mdx | 2 +- docs/sidebars.js | 2 +- proto/zitadel/instance/v2/instance.proto | 2 +- .../instance/v2/instance_service.proto | 26 +++++++++---------- 5 files changed, 18 insertions(+), 18 deletions(-) diff --git a/docs/docs/guides/integrate/login-ui/login-app.mdx b/docs/docs/guides/integrate/login-ui/login-app.mdx index d9628b487..dee963b65 100644 --- a/docs/docs/guides/integrate/login-ui/login-app.mdx +++ b/docs/docs/guides/integrate/login-ui/login-app.mdx @@ -119,7 +119,7 @@ In order to run the new Login app, make sure to follow the instructions in the [ #### How to setup domains for OIDC When setting up the new Login app for OIDC, the domain must be registered on your instance and use https. -To register your login domain on your instance, [add](/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) your domain on your instances trusted domains. +To register your login domain on your instance, [add](/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) your domain on your instances Trusted Domains. #### OIDC Proxy @@ -140,7 +140,7 @@ You can review an example implementation of a middleware [here](https://github.c To deploy your own version on Vercel, navigate to your instance and create a service user. Create a personal access token (PAT) for the user and copy and set it as `ZITADEL_SERVICE_USER_TOKEN`, then navigate to Default settings and make sure it gets `IAM_LOGIN_CLIENT` permissions. Finally set your instance url as `ZITADEL_API_URL`. Make sure to set it without trailing slash. -Also ensure your login domain is registered on your instance by adding it as a [trusted domain](/docs/apis/resources/admin/admin-service-add-instance-trusted-domain). +Also ensure your login domain is registered on your instance by adding it as a [Trusted Domain](/docs/apis/resources/admin/admin-service-add-instance-trusted-domain). If you want to enforce users to have their email verified, you can set the optional `EMAIL_VERIFICATION` variable to `true` in your environment and your users will be enforced to verify their email address before they can log in. diff --git a/docs/docs/guides/integrate/login/hosted-login.mdx b/docs/docs/guides/integrate/login/hosted-login.mdx index c8b93d723..e24e7bff8 100644 --- a/docs/docs/guides/integrate/login/hosted-login.mdx +++ b/docs/docs/guides/integrate/login/hosted-login.mdx @@ -186,7 +186,7 @@ You can also activate the v2 login for your apps, so users are redirected to `/u 4. If you have used the deploy button in the steps before, you will automatically be asked for this step. Enter the environment variables in Vercel - PAT - ZITADEL_API_URL (Example: https://my-domain.zitadel.cloud, no trailing slash) - 5. Add the domain where your login UI is hosted to the [trusted domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in Zitadel. (Example: my-new-zitadel-login.vercel.app) + 5. Add the domain where your login UI is hosted to the [Trusted Domains](https://zitadel.com/docs/apis/resources/admin/admin-service-add-instance-trusted-domain) in Zitadel. (Example: my-new-zitadel-login.vercel.app) 6. Use the new login in your application. You have three different options on how to achieve this: diff --git a/docs/sidebars.js b/docs/sidebars.js index 111678705..14a7617df 100644 --- a/docs/sidebars.js +++ b/docs/sidebars.js @@ -1094,7 +1094,7 @@ module.exports = { title: "Instance Service API", slug: "/apis/resources/instance_service_v2", description: - "This API is intended to manage instances, Custom Domains and trusted domains in ZITADEL.\n" + + "This API is intended to manage instances, Custom Domains and Trusted Domains in ZITADEL.\n" + "\n" + "This v2 of the API provides the same functionalities as the v1, but organised on a per resource basis.\n" + "The whole functionality related to domains (custom and trusted) has been moved under this instance API." diff --git a/proto/zitadel/instance/v2/instance.proto b/proto/zitadel/instance/v2/instance.proto index 146bdf130..9b6621023 100644 --- a/proto/zitadel/instance/v2/instance.proto +++ b/proto/zitadel/instance/v2/instance.proto @@ -193,7 +193,7 @@ message TrustedDomainFilter { oneof filter { option (validate.required) = true; - // Filter for a specific trusted domain. + // Filter for a specific Trusted Domain. DomainFilter domain_filter = 1; } } diff --git a/proto/zitadel/instance/v2/instance_service.proto b/proto/zitadel/instance/v2/instance_service.proto index c1dc52d93..0b512b4c9 100644 --- a/proto/zitadel/instance/v2/instance_service.proto +++ b/proto/zitadel/instance/v2/instance_service.proto @@ -148,7 +148,7 @@ service InstanceService { // Add Trusted Domain // - // Adds a trusted domain to the instance. + // Adds a Trusted Domain to the instance. // By default the instance will be determined by the context of the request, // e.g. the host header. // You can optionally pass an InstanceID to list the domains of a specific instance. @@ -159,7 +159,7 @@ service InstanceService { // email templates, and more. // This can be used in cases where the API is accessed through a different domain // than the Custom Domain, e.g. proxy setups and custom login UIs. - // Unlike Custom Domain, trusted domains are not used to route requests to this instance + // Unlike Custom Domains, Trusted Domains are not used to route requests to this instance // and therefore do not need to be uniquely assigned to an instance. // // Required permissions: @@ -175,7 +175,7 @@ service InstanceService { // Remove Trusted Domain // - // Removes a trusted domain from the instance. + // Removes a Trusted Domain from the instance. // By default the instance will be determined by the context of the request, // e.g. the host header. // You can optionally pass an InstanceID to list the domains of a specific instance. @@ -195,7 +195,7 @@ service InstanceService { // List Trusted Domains // - // Lists trusted domains of the instance. + // Lists Trusted Domains of the instance. // By default the instance will be determined by the context of the request, // e.g. the host header. // You can optionally pass an InstanceID to list the domains of a specific instance. @@ -405,7 +405,7 @@ message ListCustomDomainsResponse { } message AddTrustedDomainRequest { - // InstanceID is the unique ID of the instance to which the trusted domain will be added. + // InstanceID is the unique ID of the instance to which the Trusted Domain will be added. // If not set, the instance in the current context (e.g. identified by the host header) will be used. // If an ID is set, the caller must have additional permissions. string instance_id = 1 [ @@ -416,13 +416,13 @@ message AddTrustedDomainRequest { } ]; - // Trusted domain to be added to the instance. + // Trusted Domain to be added to the instance. // Must be a valid domain name. // Once the domain is added, it can be used in API responses like OIDC discovery, // email templates, and more. // This can be used in cases where the API is accessed through a different domain // than the Custom Domain, e.g. proxy setups and custom login UIs. - // Unlike Custom Domains, trusted domains are not used to route requests to this instance + // Unlike Custom Domains, Trusted Domains are not used to route requests to this instance // and therefore do not need to be uniquely assigned to an instance. string trusted_domain = 2 [ (validate.rules).string = {min_len: 1, max_len: 253}, @@ -436,7 +436,7 @@ message AddTrustedDomainRequest { } message AddTrustedDomainResponse { - // CreationDate is the timestamp when the trusted domain was added. + // CreationDate is the timestamp when the Trusted Domain was added. google.protobuf.Timestamp creation_date = 1 [ (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"2025-01-23T10:34:18.051Z\""; @@ -445,7 +445,7 @@ message AddTrustedDomainResponse { } message RemoveTrustedDomainRequest { - // InstanceID is the unique ID of the instance from which the trusted domain will be removed. + // InstanceID is the unique ID of the instance from which the Trusted Domain will be removed. // If not set, the instance in the current context (e.g. identified by the host header) will be used. // If an ID is set, the caller must have additional permissions. string instance_id = 1 [ @@ -456,7 +456,7 @@ message RemoveTrustedDomainRequest { } ]; - // The trusted domain to remove from the instance. + // The Trusted Domain to remove from the instance. string trusted_domain = 2 [ (validate.rules).string = {min_len: 1, max_len: 253}, (google.api.field_behavior) = REQUIRED, @@ -469,7 +469,7 @@ message RemoveTrustedDomainRequest { } message RemoveTrustedDomainResponse { - // DeletionDate is the timestamp when the trusted domain was removed. + // DeletionDate is the timestamp when the Trusted Domain was removed. google.protobuf.Timestamp deletion_date = 1 [ (grpc.gateway.protoc_gen_openapiv2.options.openapiv2_field) = { example: "\"2025-01-23T10:34:18.051Z\""; @@ -478,7 +478,7 @@ message RemoveTrustedDomainResponse { } message ListTrustedDomainsRequest { - // InstanceID is the unique ID of the instance whose trusted domains will be listed. + // InstanceID is the unique ID of the instance whose Trusted Domains will be listed. // If not set, the instance in the current context (e.g. identified by the host header) will be used. // If an ID is set, the caller must have additional permissions. string instance_id = 1 [ @@ -500,7 +500,7 @@ message ListTrustedDomainsRequest { } message ListTrustedDomainsResponse { - // The list of trusted domains matching the query. + // The list of Trusted Domains matching the query. repeated TrustedDomain trusted_domain = 1; // Contains the total number of domains matching the query and the applied limit.