diff --git a/.claude/skills/docs-writing.md b/.claude/skills/docs-writing.md index d08927ed..c5ca6881 100644 --- a/.claude/skills/docs-writing.md +++ b/.claude/skills/docs-writing.md @@ -217,6 +217,35 @@ When documenting features that are in early access, add a standardized warning c - Include the explanation of what early access means - Use "share feedback" (not "have any feedback") +## Hosting region references (default instance vs. EU data residency) + +C1 runs two hosting options — a **default instance** (`conductor.one`) and an **EU data residency instance** (`c1eu.ai`). A tenant is provisioned in one region, and every tenant-specific URL, hostname, or IP address reflects it. See the "Hosting regions" table in [Create a C1 tenant](/product/how-to/qs-set-up-c1) for the canonical explainer — link there rather than re-explaining the concept on other pages. + +Anywhere a region-specific value appears, use one of the two treatments below based on how the value is used — not on which section of the docs it's in. + +**Single fixed values the reader pastes somewhere** (an OAuth redirect URI, an MCP callback URL, a firewall allowlist entry) — show both values explicitly, labeled by instance, instead of printing only the default: + +```mdx +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` +``` + +Lead into the pair with wording that tells the reader how to choose — "whichever matches your C1 tenant's domain" — rather than assuming they already know which hosting option they're on. This applies even when the value is tenant-specific (contains a placeholder like `` or `YOUR_DOMAIN`): show both domain suffixes, not just `conductor.one`. + +Don't use this pattern for a value the reader copies directly from their own C1 account (for example, an MCP server URL shown on an "AI connections" page) — the product already displays the tenant's real, region-correct value, so there's nothing to disambiguate. + +**Reference and example-heavy pages** (API docs, CLI docs, service-principal/workload-federation guides) where `conductor.one` appears repeatedly inside code blocks or curl examples — don't rewrite every example. Add one callout near the section the examples belong to instead: + +```mdx +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. +``` + +- Place the callout immediately before the section whose examples it covers, not at the top of the page if the examples don't start until much later — "these examples" should mean the ones the reader is about to see. +- If a page has more than one cluster of examples separated by unrelated content, repeat the callout at each cluster rather than relying on one mention to cover the whole page. +- Reserve this pink `` (`icon="globe"`, `color="#c937ae"`) for hosting-region notes specifically. Standard content notes still use ``, ``, ``, or ``. + +**Choosing between the two**: is this a single value the reader picks once and pastes into a form field or config (dual-value), or a domain suffix baked into many illustrative examples across a section (callout)? A page can need both — a one-time setup step plus a pile of reference examples further down. + ## Navigation (docs.json) - Pages map to MDX files (no extension) diff --git a/baton/aws.mdx b/baton/aws.mdx index 2e6fcf87..e26feac0 100644 --- a/baton/aws.mdx +++ b/baton/aws.mdx @@ -794,10 +794,7 @@ spec: - Log into [C1](https://accounts.conductor.one/accounts). - - - Click **Connectors** > **AWS Connector**. + In C1, click **Connectors** > **AWS Connector**. Copy and save the **External ID** populated in the **External ID** field. We'll use this in Step 2. diff --git a/baton/azure-devops.mdx b/baton/azure-devops.mdx index fd9c5ccb..c8707ccd 100644 --- a/baton/azure-devops.mdx +++ b/baton/azure-devops.mdx @@ -97,7 +97,10 @@ You can authenticate the Azure DevOps connector in three ways: OAuth (interactiv Give the new app a name and select the **Accounts in any organizational directory** option. - Enter `https://accounts.conductor.one/oauth/callback` as a **Web** redirect URI. + Enter whichever redirect URI matches your C1 tenant's domain as a **Web** redirect URI: + + - Default instance: `https://accounts.conductor.one/oauth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback` Click **Register**. diff --git a/baton/dropbox.mdx b/baton/dropbox.mdx index fb85af75..a973ea1b 100644 --- a/baton/dropbox.mdx +++ b/baton/dropbox.mdx @@ -96,11 +96,10 @@ A user with the **Team Admin** role in Dropbox must perform this task. Carefully copy and save the app key and app secret. - Under **OAuth 2**, add the following redirect URI and click **Add**: + Under **OAuth 2**, add whichever redirect URI matches your C1 tenant's domain, and click **Add**: - ``` - https://accounts.conductor.one/oauth/callback - ``` + - Default instance: `https://accounts.conductor.one/oauth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback` Give the app the relevant set of permissions: diff --git a/baton/freshbooks.mdx b/baton/freshbooks.mdx index 780e1ee0..f570641f 100644 --- a/baton/freshbooks.mdx +++ b/baton/freshbooks.mdx @@ -39,7 +39,10 @@ Give the app the following scopes: - user:account:write -Enter `https://accounts.conductor.one/oauth/callback` as the **Redirect URI**. +Enter whichever redirect URI matches your C1 tenant's domain as the **Redirect URI**: + +- Default instance: `https://accounts.conductor.one/oauth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback` Save the app. diff --git a/baton/ironclad.mdx b/baton/ironclad.mdx index 62612d75..1a6ebea4 100644 --- a/baton/ironclad.mdx +++ b/baton/ironclad.mdx @@ -49,7 +49,10 @@ In the **Grant Types** area, select the grant type that matches your authenticat - **Authorization Code**: Requires logging in and authorizing. Only available for cloud-hosted connectors. -If you selected **Authorization Code**, enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field. +If you selected **Authorization Code**, enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field: + +- Default instance: `https://accounts.conductor.one/oauth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback` In the **Scopes** area, give the app the following scopes: diff --git a/baton/lucidchart.mdx b/baton/lucidchart.mdx index b4ebc2a9..d4429648 100644 --- a/baton/lucidchart.mdx +++ b/baton/lucidchart.mdx @@ -70,7 +70,10 @@ Give the new app a name, then click **Create**. Select the new app's **OAuth 2.0** tab. -Enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field. +Enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field: + +- Default instance: `https://accounts.conductor.one/oauth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback` Click **Create OAuth 2.0 client**. diff --git a/baton/v1/aws.mdx b/baton/v1/aws.mdx index a9e4b860..0568d074 100644 --- a/baton/v1/aws.mdx +++ b/baton/v1/aws.mdx @@ -230,10 +230,7 @@ As an alternative to the instructions above, use the following Terraform script -Log into [C1](https://accounts.conductor.one/accounts). - - -Navigate to **Integrations** > **Connectors** > **AWS Connector**. +In C1, navigate to **Integrations** > **Connectors** > **AWS Connector**. Copy and save the **External ID** populated in the **External ID** field (we'll use this in Step 2. diff --git a/conductorone-api/authenticate.mdx b/conductorone-api/authenticate.mdx index b01bc2c7..e45f7334 100644 --- a/conductorone-api/authenticate.mdx +++ b/conductorone-api/authenticate.mdx @@ -3,6 +3,8 @@ title: How to authenticate requests description: "To use the C1 API, you must authenticate your requests. This document guides you through the process of obtaining and utilizing an API key, as well as establishing an access token." --- +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Step 1: Obtain an API key The first step in the process is to obtain your API key from C1: diff --git a/conductorone-api/pagination.mdx b/conductorone-api/pagination.mdx index 62252be8..30293f7e 100644 --- a/conductorone-api/pagination.mdx +++ b/conductorone-api/pagination.mdx @@ -3,6 +3,8 @@ title: Pagination in the C1 API description: "When making `LIST` or `SEARCH` requests to the C1 API, use the `page_size` and `page_token` parameters to navigate through the list of results." --- +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Using page\_size Include the `page_size` parameter to tell the API how many search or list results to show on each page. diff --git a/product/admin/c1-mcp.mdx b/product/admin/c1-mcp.mdx index a2eeda7c..3a482063 100644 --- a/product/admin/c1-mcp.mdx +++ b/product/admin/c1-mcp.mdx @@ -81,6 +81,8 @@ Click **Save**. If you configure IP restrictions, AI assistants will only work from the specified IP ranges. This is useful for restricting usage to corporate networks or VPNs. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Connect an AI assistant Follow these steps to connect your AI assistant to C1 via MCP. diff --git a/product/admin/code-mode.mdx b/product/admin/code-mode.mdx index 69968000..5c5cd9bf 100644 --- a/product/admin/code-mode.mdx +++ b/product/admin/code-mode.mdx @@ -96,6 +96,8 @@ export default async function main(input) { Response shapes differ from tool to tool. The `records` and `nextPageToken` keys above belong to this tool; read the real keys from `describe` output rather than carrying an envelope key over from a different tool. Optional keys should be omitted entirely — never passed as `undefined`. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Reading the results Most calls return what you'd expect: the upstream tool's normal output, minus anything a post-tool-use hook redacted or capped. diff --git a/product/admin/enterprise-managed-authorization/overview.mdx b/product/admin/enterprise-managed-authorization/overview.mdx index c9d0b7e8..91673f0d 100644 --- a/product/admin/enterprise-managed-authorization/overview.mdx +++ b/product/admin/enterprise-managed-authorization/overview.mdx @@ -88,6 +88,8 @@ The full path, end to end: Before you start, the MCP server's authorization server must be configured to trust C1 as an issuer. That work is done by the server's owner — see [Support enterprise-managed authorization in your MCP server](/product/admin/enterprise-managed-authorization/support-in-your-app). +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Key concepts | Concept | Description | diff --git a/product/admin/enterprise-managed-authorization/support-in-your-app.mdx b/product/admin/enterprise-managed-authorization/support-in-your-app.mdx index a963d81a..55e24a8a 100644 --- a/product/admin/enterprise-managed-authorization/support-in-your-app.mdx +++ b/product/admin/enterprise-managed-authorization/support-in-your-app.mdx @@ -21,6 +21,8 @@ To support enterprise-managed authorization, your server does two things: C1 issues an ID-JAG, a short-lived JWT whose audience is your authorization server's issuer. Your authorization server verifies C1's signature, confirms the token is meant for it, and returns one of your own access tokens that the agent then uses to call your API. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Trust C1 as an issuer Configure your authorization server to recognize C1 as a token issuer and to advertise the grant C1 relies on. @@ -87,6 +89,8 @@ C1 does not send a SAML `NameID` (`sub_id`) or a resource-server-specific user i C1 can sign ID-JAGs with ES256 (the default), RS256, or EdDSA. Pick the algorithm your authorization server verifies, and tell your C1 admin which one to use for your system. C1 uses the chosen algorithm with no silent fallback, so the algorithm your admin configures must be one your authorization server accepts. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Example The following are taken from a verified end-to-end exchange against a live C1 tenant. The protected-resource metadata document shows the fields C1 reads during discovery, and the decoded ID-JAG shows the claims your authorization server verifies. diff --git a/product/admin/functions-api.mdx b/product/admin/functions-api.mdx index cf962e51..22662d81 100644 --- a/product/admin/functions-api.mdx +++ b/product/admin/functions-api.mdx @@ -8,6 +8,8 @@ sidebarTitle: "Manage via the API" Manage functions programmatically through the C1 REST API to automate deployments or work outside the web UI. For the web UI workflow, see [Create and test functions](/product/admin/functions-create). +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Authentication All API calls require a bearer token from a personal API key or service principal credential. See [C1 API and keys](/conductorone-api/api) for setup. diff --git a/product/admin/mcp-server/bitbucket.mdx b/product/admin/mcp-server/bitbucket.mdx index 82bfbf04..8edbede4 100644 --- a/product/admin/mcp-server/bitbucket.mdx +++ b/product/admin/mcp-server/bitbucket.mdx @@ -54,7 +54,9 @@ In Bitbucket, go to your **Workspace settings** > **OAuth consumers** and select Fill in the registration form: - **Name** — a recognizable name such as `C1`. -- **Callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. +- **Callback URL** — set this exactly to whichever matches your C1 tenant's domain: + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Under **Permissions**, grant only the scopes you need for the operations you plan to govern, such as read access to Account, Repositories, Pull requests, and Issues. diff --git a/product/admin/mcp-server/box.mdx b/product/admin/mcp-server/box.mdx index f587b7ce..6aa3c590 100644 --- a/product/admin/mcp-server/box.mdx +++ b/product/admin/mcp-server/box.mdx @@ -48,7 +48,10 @@ In the Box Developer Console, create a new custom app that uses standard OAuth 2 Give the app a recognizable name such as `C1`. -In the app's configuration, set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`. +In the app's configuration, set the **redirect URI** exactly to whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Grant only the scopes you need, such as read access to the content you plan to govern. Copy the **client ID** and **client secret**. diff --git a/product/admin/mcp-server/confluence.mdx b/product/admin/mcp-server/confluence.mdx index bd0c971e..05474432 100644 --- a/product/admin/mcp-server/confluence.mdx +++ b/product/admin/mcp-server/confluence.mdx @@ -46,11 +46,10 @@ Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as Open the **Permissions** tab. Next to **Confluence API**, select **Add**, then **Configure**, and add the scopes from [Confluence scopes](#confluence-scopes) below — the default read scopes, plus any optional write or delete scopes you need. -Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to: +Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Save changes**. diff --git a/product/admin/mcp-server/gemini-enterprise.mdx b/product/admin/mcp-server/gemini-enterprise.mdx index ea0c7b18..069de194 100644 --- a/product/admin/mcp-server/gemini-enterprise.mdx +++ b/product/admin/mcp-server/gemini-enterprise.mdx @@ -41,6 +41,8 @@ Confirm all of these before you start. The organization policy change in particu - Someone who holds `roles/orgpolicy.policyAdmin` at the organization level. Project **Owner** does not include it, and a project-level grant is not sufficient for the policy change below. - **Optional.** The [gcloud CLI](https://cloud.google.com/sdk/docs/install), authenticated with `gcloud auth login`, if you prefer the command line for the Google Cloud steps. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Collect the values you'll reuse The steps below reuse these values. Collect them once. @@ -156,6 +158,8 @@ curl -s -X POST \ An app created this way has no subscription attached. Add one under **Manage users** in the console before you assign licenses. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Allow custom MCP data connectors Google Cloud blocks custom MCP data connectors by default through the `constraints/discoveryengine.managed.disableCustomMcpServerConnector` organization policy. Turn it off for this project before you create the data store. @@ -347,6 +351,8 @@ curl -s -X POST \ }' ``` +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Get the OAuth client ID Gemini Enterprise authenticates each user to C1 with the OAuth 2.0 authorization code flow, and it needs an OAuth client that already exists. It does not register one itself, and it does not publish a client identity you can point at. @@ -463,6 +469,8 @@ Organization policy changes take a minute or two to take effect, in both directi +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Create the data store Connect the C1 MCP gateway to your Gemini Enterprise app. @@ -723,6 +731,8 @@ The connection is working, and every tool call is attributed to the user who mad If the agent does not call a tool, returns nothing, or reports a denial, see [Troubleshoot Gemini Enterprise connection errors](#troubleshoot-gemini-enterprise-connection-errors). A denial that names a missing toolset or access profile is C1 working as configured, not a broken integration. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Troubleshoot Gemini Enterprise connection errors | Symptom | Cause | Fix | diff --git a/product/admin/mcp-server/github.mdx b/product/admin/mcp-server/github.mdx index 62ada7dc..0d3407f0 100644 --- a/product/admin/mcp-server/github.mdx +++ b/product/admin/mcp-server/github.mdx @@ -58,7 +58,9 @@ Fill in the registration form: - **Application name** — a recognizable name such as `C1`. - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`. -- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps. +- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps): + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Register application**, then copy the **Client ID**. Select **Generate a new client secret** and copy the secret — GitHub shows it only once. Store it securely, and if it's ever exposed, generate a new one, update C1, then delete the old one ([best practices for creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/best-practices-for-creating-an-oauth-app)). @@ -178,7 +180,9 @@ Fill in the registration form: - **Application name** — a recognizable name such as `C1`. - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`. -- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth apps allow only one callback URL. +- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth apps allow only one callback URL): + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Register application**. diff --git a/product/admin/mcp-server/google-analytics-admin.mdx b/product/admin/mcp-server/google-analytics-admin.mdx index ec7ff5e8..9adcde0a 100644 --- a/product/admin/mcp-server/google-analytics-admin.mdx +++ b/product/admin/mcp-server/google-analytics-admin.mdx @@ -63,7 +63,10 @@ Go to **APIs & Services** > **OAuth consent screen**. Choose **Internal** for a Go to **APIs & Services** > **Credentials** > **Create Client** > **Web application**. For full details, see Google's [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257) documentation. -Under **Authorized redirect URIs**, add exactly `https://accounts.conductor.one/auth/callback`. +Under **Authorized redirect URIs**, add exactly whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Create**, then copy the **Client ID** and **Client secret**. Google shows the client secret only once. diff --git a/product/admin/mcp-server/google-analytics.mdx b/product/admin/mcp-server/google-analytics.mdx index 818a762e..358a1997 100644 --- a/product/admin/mcp-server/google-analytics.mdx +++ b/product/admin/mcp-server/google-analytics.mdx @@ -59,7 +59,10 @@ Go to **APIs & Services** > **OAuth consent screen**. Choose **Internal** for a Go to **APIs & Services** > **Credentials** > **Create Client** > **Web application**. For full details, see Google's [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257) documentation. -Under **Authorized redirect URIs**, add exactly `https://accounts.conductor.one/auth/callback`. +Under **Authorized redirect URIs**, add exactly whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Create**, then copy the **Client ID** and **Client secret**. Google shows the client secret only once. diff --git a/product/admin/mcp-server/google-cloud-project-setup.mdx b/product/admin/mcp-server/google-cloud-project-setup.mdx index 694318ff..67ac9301 100644 --- a/product/admin/mcp-server/google-cloud-project-setup.mdx +++ b/product/admin/mcp-server/google-cloud-project-setup.mdx @@ -170,11 +170,10 @@ Create the OAuth client, then capture its ID and secret. Go to **APIs & Services** > **Credentials** > **Create Client** > **Web application**. For details, see Google's [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257) documentation. -Under **Authorized redirect URIs**, add exactly: +Under **Authorized redirect URIs**, add exactly whichever matches your C1 tenant's domain: -```text -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` The value must match exactly — even a trailing-slash difference fails the authorization flow. @@ -417,7 +416,7 @@ Connectors without a dedicated page above use the same [Register an MCP server]( | :--- | :--- | :--- | | `PERMISSION_DENIED: Caller does not have required permission to use project ...` | The caller lacks `serviceusage.services.use` on the quota project. | Grant the **Service Usage Consumer** role — see [Grant users permission to use the project](#grant-users-permission-to-use-the-project). | | `SERVICE_DISABLED` / "API has not been used in project ... before or it is disabled" | The connector's API isn't enabled in the quota project. | Enable it — see [Enable the APIs for your connectors](#enable-the-apis-for-your-connectors). | -| Authorization flow fails after the user consents | The redirect URI doesn't match. | Set it to exactly `https://accounts.conductor.one/auth/callback` — see [Create the client credentials](#create-the-client-credentials). | +| Authorization flow fails after the user consents | The redirect URI doesn't match. | Set it to exactly whichever matches your C1 tenant's domain (default instance: `https://accounts.conductor.one/auth/callback`; EU data residency instance: `https://accounts.c1eu.ai/auth/callback`) — see [Create the client credentials](#create-the-client-credentials). | | A restricted-scope warning blocks External users | The app needs Google verification for restricted scopes. | Use an **Internal** consent screen for Workspace-only use, or complete Google's verification for External use. | | "Google hasn't verified this app" blocks sign-in | The External app isn't verified and the user isn't a test user. | Add the user as a **test user** on the consent screen, or complete Google's verification. | diff --git a/product/admin/mcp-server/google-drive.mdx b/product/admin/mcp-server/google-drive.mdx index a0551860..1ea8d425 100644 --- a/product/admin/mcp-server/google-drive.mdx +++ b/product/admin/mcp-server/google-drive.mdx @@ -53,7 +53,7 @@ If you already completed [Set up a Google Cloud project for MCP servers](/produc -Follow [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) to create or select a project, grant your users the **Service Usage Consumer** role, and create an OAuth client with the redirect URI set to `https://accounts.conductor.one/auth/callback`. +Follow [Set up a Google Cloud project for MCP servers](/product/admin/mcp-server/google-cloud-project-setup) to create or select a project, grant your users the **Service Usage Consumer** role, and create an OAuth client with the redirect URI set to whichever matches your C1 tenant's domain — default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback`. In the same project, also enable the **Google Drive MCP API** (`drivemcp.googleapis.com`): go to **APIs & Services** > **Library**, search for **Google Drive MCP API**, and select **Enable**. Google's hosted Drive MCP server requires this API alongside the Google Drive API. See Google's [Enable the MCP services](https://developers.google.com/workspace/drive/api/guides/configure-mcp-server#enable-mcp-services) documentation. @@ -150,7 +150,10 @@ Go to **APIs & Services** > **OAuth consent screen**. Choose **Internal** for a Go to **APIs & Services** > **Credentials** > **Create Client** > **Web application**. For full details, see Google's [Manage OAuth Clients](https://support.google.com/cloud/answer/15549257) documentation. -Under **Authorized redirect URIs**, add exactly `https://accounts.conductor.one/auth/callback`. +Under **Authorized redirect URIs**, add exactly whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Create**, then copy the **Client ID** and **Client secret**. Google shows the client secret only once. diff --git a/product/admin/mcp-server/jira-service-management.mdx b/product/admin/mcp-server/jira-service-management.mdx index 25c9c080..6752a985 100644 --- a/product/admin/mcp-server/jira-service-management.mdx +++ b/product/admin/mcp-server/jira-service-management.mdx @@ -46,11 +46,10 @@ Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as Open the **Permissions** tab. Next to **Jira Service Management API**, select **Add**, then **Configure**, and add the scopes C1 needs for the operations you plan to govern, such as reading requests, queues, and customers. -Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to: +Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Save changes**. diff --git a/product/admin/mcp-server/jira.mdx b/product/admin/mcp-server/jira.mdx index f72afbf8..0b9a556b 100644 --- a/product/admin/mcp-server/jira.mdx +++ b/product/admin/mcp-server/jira.mdx @@ -46,11 +46,10 @@ Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as Open the **Permissions** tab. Next to **Jira API**, select **Add**, then **Configure**, and add the scopes from [Jira scopes](#jira-scopes) below — the default read scopes, plus any optional write or admin scopes you need. -Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to: +Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select **Save changes**. diff --git a/product/admin/mcp-server/linear.mdx b/product/admin/mcp-server/linear.mdx index e4baa30e..dbe13c57 100644 --- a/product/admin/mcp-server/linear.mdx +++ b/product/admin/mcp-server/linear.mdx @@ -173,11 +173,10 @@ Create an OAuth application in Linear so users can authorize C1 with their own L As a Linear workspace admin, open **Settings** > **API** > **OAuth applications** and select **Create new**. -Set the **Redirect URI** exactly to: +Set the **Redirect URI** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select the scopes C1 needs for the operations you plan to govern, such as `read`, `write`, `issues:create`, and `comments:create`. diff --git a/product/admin/mcp-server/linkedin.mdx b/product/admin/mcp-server/linkedin.mdx index ca73049c..0cde0a22 100644 --- a/product/admin/mcp-server/linkedin.mdx +++ b/product/admin/mcp-server/linkedin.mdx @@ -43,7 +43,10 @@ In the LinkedIn Developer Portal, select **Create app**. For details, see Linked Give the app a recognizable name such as `C1` and associate it with a LinkedIn Page you administer. -On the **Auth** tab, set the **authorized redirect URL** exactly to `https://accounts.conductor.one/auth/callback`. +On the **Auth** tab, set the **authorized redirect URL** exactly to whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` On the **Products** tab, request the products that grant the scopes you need, such as profile, email, and organization access. diff --git a/product/admin/mcp-server/lucid.mdx b/product/admin/mcp-server/lucid.mdx index 8c15674f..f648f5ce 100644 --- a/product/admin/mcp-server/lucid.mdx +++ b/product/admin/mcp-server/lucid.mdx @@ -131,7 +131,10 @@ Register an OAuth 2.0 application in Lucid that users will authorize through. Fo In Lucid, go to **Account settings** > **Developer** and create a new OAuth 2.0 application. -Set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`. +Set the **redirect URI** exactly to whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Add the **scopes** your tools need, such as `lucidchart.document.content:readonly`, `folder:readonly`, `teams:readonly`, and `account.user:readonly`. Add write or admin scopes only if you plan to govern those operations. diff --git a/product/admin/mcp-server/notion.mdx b/product/admin/mcp-server/notion.mdx index 4f4d6160..148448c8 100644 --- a/product/admin/mcp-server/notion.mdx +++ b/product/admin/mcp-server/notion.mdx @@ -123,11 +123,10 @@ In Notion's developer portal, select **New integration**. See Notion's [Create i Enter a recognizable name such as `C1`, select the associated workspace, and set **Type** to **Public**. -Set the **Redirect URI** exactly to: +Set the **Redirect URI** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` On the **Capabilities** tab, enable only what C1 needs: **Read content** for read operations, plus **Update content** or **Insert content** if C1 should edit or create pages, and the comment and user-information capabilities you need. diff --git a/product/admin/mcp-server/okta.mdx b/product/admin/mcp-server/okta.mdx index 47ca1f4f..33c06d88 100644 --- a/product/admin/mcp-server/okta.mdx +++ b/product/admin/mcp-server/okta.mdx @@ -58,7 +58,10 @@ Select **OIDC - OpenID Connect** as the sign-in method and **Web Application** a Give the app a recognizable name, such as `C1`. -Set the **Sign-in redirect URI** to exactly `https://accounts.conductor.one/auth/callback`. The value must match exactly — even a trailing-slash difference fails the authorization flow. +Set the **Sign-in redirect URI** to exactly whichever matches your C1 tenant's domain — the value must match exactly, even a trailing-slash difference fails the authorization flow: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Under **Assignments**, limit who can authorize the app to the administrators who will connect it, then select **Save**. diff --git a/product/admin/mcp-server/pagerduty.mdx b/product/admin/mcp-server/pagerduty.mdx index ad0e1548..2d3cdcd1 100644 --- a/product/admin/mcp-server/pagerduty.mdx +++ b/product/admin/mcp-server/pagerduty.mdx @@ -60,11 +60,10 @@ In PagerDuty, go to **Integrations** > **App Registration** and select **New App Select **OAuth 2.0** as the app's functionality, then leave **Scoped OAuth** selected on the next screen — it's the default and the only mode with the granular, per-object scopes below. The other option, **Classic User OAuth**, only supports coarse read (and unreliable write) access, so C1 doesn't use it. -Set the **Redirect URL** exactly to: +Set the **Redirect URL** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Select the scopes C1 needs. For full functionality, grant: @@ -209,7 +208,10 @@ Add an **OAuth 2.0** functionality to the app and choose the authorization code -Set the **Redirect URL** exactly to `https://accounts.conductor.one/auth/callback`, then choose the scopes the server needs, such as read access to incidents, services, and users. +Set the **Redirect URL** exactly to whichever matches your C1 tenant's domain, then choose the scopes the server needs, such as read access to incidents, services, and users: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Save the app, then copy the **Client ID** and **Client Secret**. PagerDuty shows the secret only once. diff --git a/product/admin/mcp-server/ramp.mdx b/product/admin/mcp-server/ramp.mdx index dd666a45..9dc7e11b 100644 --- a/product/admin/mcp-server/ramp.mdx +++ b/product/admin/mcp-server/ramp.mdx @@ -48,7 +48,10 @@ In Ramp, open **Settings** > **Developer** and create a new app. See Ramp's [Acc Give the app a recognizable name such as `C1`. -For per-user OAuth, set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`. +For per-user OAuth, set the **redirect URI** exactly to whichever matches your C1 tenant's domain: + +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Grant only the scopes you need, such as read access to the resources you plan to govern. Copy the **client ID** and **client secret**. Ramp may show the secret only once. diff --git a/product/admin/mcp-server/salesforce.mdx b/product/admin/mcp-server/salesforce.mdx index 6f62a05d..87c59682 100644 --- a/product/admin/mcp-server/salesforce.mdx +++ b/product/admin/mcp-server/salesforce.mdx @@ -47,11 +47,10 @@ Fill in **Basic Information**: - **Contact Email** — your team's email. -Under **API (Enable OAuth Settings)**, select **Enable OAuth Settings**, then set the **Callback URL** exactly to: +Under **API (Enable OAuth Settings)**, select **Enable OAuth Settings**, then set the **Callback URL** exactly to whichever matches your C1 tenant's domain: -``` -https://accounts.conductor.one/auth/callback -``` +- Default instance: `https://accounts.conductor.one/auth/callback` +- EU data residency instance: `https://accounts.c1eu.ai/auth/callback` The URL must match character for character, including any trailing slash. diff --git a/product/admin/mcp-server/slack.mdx b/product/admin/mcp-server/slack.mdx index 322d5ade..ab14b8a7 100644 --- a/product/admin/mcp-server/slack.mdx +++ b/product/admin/mcp-server/slack.mdx @@ -54,6 +54,8 @@ Sign in at [api.slack.com/apps](https://api.slack.com/apps) and select **Create Paste the manifest below and select **Next**, then **Create**. It turns on MCP support and sets the redirect URL and C1's default, read-only **User Token Scopes** for you, instead of clicking through Slack's scope picker. Slack ignores YAML comments on import, so the commented-out write scopes stay disabled until you uncomment them and reimport. +The manifest below uses the default instance's redirect URL. If your tenant is on the EU data residency instance, change `redirect_urls` to `https://accounts.c1eu.ai/auth/callback` before you paste it in. + ```yaml @@ -143,7 +145,7 @@ With per-user OAuth, each person authorizes individually and tool calls run unde -In the app settings, open **OAuth & Permissions** and confirm the redirect URL (`https://accounts.conductor.one/auth/callback`) and the **User Token Scopes** match the manifest — see [Slack MCP scopes](#slack-mcp-scopes) above. +In the app settings, open **OAuth & Permissions** and confirm the redirect URL and the **User Token Scopes** match the manifest — see [Slack MCP scopes](#slack-mcp-scopes) above. The redirect URL should be whichever matches your C1 tenant's domain: default instance `https://accounts.conductor.one/auth/callback`, EU data residency instance `https://accounts.c1eu.ai/auth/callback`. If you created the app from scratch, add them now: under **Redirect URLs**, select **Add New Redirect URL**, enter the URL exactly, select **Add**, then **Save URLs**; then add the scopes under **Scopes**. @@ -251,6 +253,8 @@ Sign in to the Slack apps dashboard and select **Create New App** > **From an ap Paste the manifest below and select **Next**, then **Create**. It sets the redirect URL and C1's default, read-only **User Token Scopes** for you, instead of clicking through Slack's scope picker. Slack ignores YAML comments on import, so the commented-out scopes stay disabled until you uncomment them and reimport. +The manifest below uses the default instance's redirect URL. If your tenant is on the EU data residency instance, change `redirect_urls` to `https://accounts.c1eu.ai/auth/callback` before you paste it in. + ```yaml @@ -290,7 +294,7 @@ settings: -To create the app by hand instead, select **From scratch**, then add the redirect URL (`https://accounts.conductor.one/auth/callback`) under **Redirect URLs** on **OAuth & Permissions**, and the scopes under **Scopes**. +To create the app by hand instead, select **From scratch**, then add whichever redirect URL matches your C1 tenant's domain under **Redirect URLs** on **OAuth & Permissions** (default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback`), and the scopes under **Scopes**. In the app's left sidebar, open **OAuth & Permissions** and confirm the redirect URL and **User Token Scopes** match the manifest. Add any optional scopes your write or admin tools need from [Slack scopes](#slack-scopes) below. User token scopes let the app act as each authorizing user. diff --git a/product/admin/requirements.mdx b/product/admin/requirements.mdx index a835276e..46682eef 100644 --- a/product/admin/requirements.mdx +++ b/product/admin/requirements.mdx @@ -13,7 +13,9 @@ If you use C1's cloud-hosted connectors and your SaaS or cloud applications enfo ### Connector egress IPs -Cloud-hosted connectors use the following source IP addresses when syncing data and provisioning accounts: +Cloud-hosted connectors use the following source IP addresses when syncing data and provisioning accounts. Allowlist the set that matches your tenant's hosting region. + +**Default instance:** ``` 35.85.212.195 @@ -22,15 +24,33 @@ Cloud-hosted connectors use the following source IP addresses when syncing data 54.68.132.142 ``` +**EU data residency instance:** + +``` +3.69.81.141 +63.180.33.73 +18.198.220.235 +63.177.161.92 +``` + ### Function egress IPs -[Functions](/product/admin/functions) use the following source IP addresses: +[Functions](/product/admin/functions) use the following source IP addresses. Allowlist the set that matches your tenant's hosting region. + +**Default instance:** ``` 54.214.48.9 54.212.53.161 ``` +**EU data residency instance:** + +``` +63.185.50.191 +3.123.76.40 +``` + ## Self-hosted connectors: outbound access to C1 Self-hosted connectors have the following network behavior: @@ -50,6 +70,9 @@ If users access the C1 web application or MCP server from corporate devices behi | `.conductor.one` | 443 | Web application and API endpoints | | `-mcp.conductor.one` | 443 | AI traffic (MCP protocol) | | `accounts.conductor.one` | 443 | Login and SSO flow | +| `.c1eu.ai` | 443 | Web application and API endpoints (for EU instances) | +| `-mcp.c1eu.ai` | 443 | AI traffic (MCP protocol) (for EU instances) | +| `accounts.c1eu.ai` | 443 | Login and SSO flow (for EU instances) | Replace `` with your organization's C1 tenant name. diff --git a/product/admin/service-principals/aws-iam.mdx b/product/admin/service-principals/aws-iam.mdx index e5baec9e..40c570ac 100644 --- a/product/admin/service-principals/aws-iam.mdx +++ b/product/admin/service-principals/aws-iam.mdx @@ -10,6 +10,8 @@ sidebarTitle: AWS IAM AWS IAM outbound identity federation lets your AWS workloads (EC2 instances, Lambda functions, ECS tasks, and more) obtain signed JWTs that C1 can trust directly. No long-lived API keys to store or rotate. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Prerequisites - A service principal with an AWS IAM federation trust. See [set up federation](/product/admin/service-principals/federation-setup) if you haven't created one yet. Use the **AWS IAM Outbound** preset. diff --git a/product/admin/service-principals/client-credentials.mdx b/product/admin/service-principals/client-credentials.mdx index fc35db05..fc891d33 100644 --- a/product/admin/service-principals/client-credentials.mdx +++ b/product/admin/service-principals/client-credentials.mdx @@ -59,6 +59,8 @@ This guide gets you from zero to a working API call in under 5 minutes. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Step 3: Get an access token Exchange the client credentials for a bearer token: diff --git a/product/admin/service-principals/custom-oidc.mdx b/product/admin/service-principals/custom-oidc.mdx index d464c6df..6a89d1be 100644 --- a/product/admin/service-principals/custom-oidc.mdx +++ b/product/admin/service-principals/custom-oidc.mdx @@ -10,6 +10,8 @@ sidebarTitle: Custom OIDC providers Any platform that issues OIDC tokens can be used with workload federation. This guide covers the generic token exchange flow for providers that don't have a built-in preset. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Provider requirements Your OIDC provider must: diff --git a/product/admin/service-principals/github-actions.mdx b/product/admin/service-principals/github-actions.mdx index 1956904e..314d412b 100644 --- a/product/admin/service-principals/github-actions.mdx +++ b/product/admin/service-principals/github-actions.mdx @@ -10,6 +10,8 @@ sidebarTitle: GitHub Actions The `conductorone/oidc-token-action` GitHub Action exchanges a GitHub Actions OIDC token for a C1 access token in a single step. No secrets to store or rotate. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Prerequisites - A service principal with a GitHub Actions federation trust. See [set up federation](/product/admin/service-principals/federation-setup) if you haven't created one yet. diff --git a/product/admin/service-principals/gitlab-ci.mdx b/product/admin/service-principals/gitlab-ci.mdx index a06543e4..93324d61 100644 --- a/product/admin/service-principals/gitlab-ci.mdx +++ b/product/admin/service-principals/gitlab-ci.mdx @@ -10,6 +10,8 @@ sidebarTitle: GitLab CI GitLab CI/CD can issue OIDC tokens for each job via the `id_tokens` keyword. You exchange this token for a C1 access token using a curl command in your pipeline. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Prerequisites - A service principal with a GitLab CI federation trust. See [set up federation](/product/admin/service-principals/federation-setup) if you haven't created one yet. Use the **GitLab CI/CD** preset. diff --git a/product/admin/service-principals/hcp-terraform.mdx b/product/admin/service-principals/hcp-terraform.mdx index ef8eed1f..80b74785 100644 --- a/product/admin/service-principals/hcp-terraform.mdx +++ b/product/admin/service-principals/hcp-terraform.mdx @@ -10,6 +10,8 @@ sidebarTitle: HCP Terraform HCP Terraform (formerly Terraform Cloud) can issue workload identity tokens for each run. The C1 Terraform provider auto-detects these tokens, so your runs authenticate without stored secrets. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Prerequisites - A service principal with an HCP Terraform federation trust. See [set up federation](/product/admin/service-principals/federation-setup) if you haven't created one yet. Use the **HCP Terraform** preset. diff --git a/product/admin/service-principals/spiffe.mdx b/product/admin/service-principals/spiffe.mdx index e87ab244..15516bb7 100644 --- a/product/admin/service-principals/spiffe.mdx +++ b/product/admin/service-principals/spiffe.mdx @@ -10,6 +10,8 @@ sidebarTitle: SPIFFE SPIFFE (Secure Production Identity Framework For Everyone) issues workloads a cryptographically verifiable identity in the form of a JWT-SVID (JWT SVID). C1 can trust JWT-SVIDs directly from any SPIFFE implementation, including [SPIRE](https://spiffe.io/docs/latest/spire-about/), so your workloads authenticate without stored secrets. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Prerequisites - A SPIFFE implementation (for example SPIRE) issuing JWT-SVIDs to your workloads, with a publicly accessible SPIFFE bundle endpoint diff --git a/product/admin/service-principals/workload-federation.mdx b/product/admin/service-principals/workload-federation.mdx index e21bb18e..909ff9ad 100644 --- a/product/admin/service-principals/workload-federation.mdx +++ b/product/admin/service-principals/workload-federation.mdx @@ -44,6 +44,8 @@ C1 includes presets for common platforms: | **SPIFFE** | Your trust domain's SPIFFE bundle endpoint | For SPIFFE/SPIRE workload identities | | **Custom OIDC** | Any HTTPS issuer URL | For other OIDC-capable platforms | +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ### Trusts A **trust** binds a provider to a specific service principal with conditions. It controls which tokens from that provider are accepted and what permissions they receive. diff --git a/product/admin/step-up-auth.mdx b/product/admin/step-up-auth.mdx index d9c99d6d..7f603989 100644 --- a/product/admin/step-up-auth.mdx +++ b/product/admin/step-up-auth.mdx @@ -75,7 +75,9 @@ Select **OIDC - OpenID Connect** and **Web Application**, then click **Next**. Configure the application: - **Name**: C1 Step Up Authentication - **Grant type**: Authorization Code - - **Sign-in redirect URIs**: `https://accounts.conductor.one/auth/callback` + - **Sign-in redirect URIs** (use whichever matches your C1 tenant's domain): + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` - **Controlled access**: Select options based on your security requirements @@ -171,7 +173,9 @@ Click **New registration**. Configure the application: - **Name**: C1 Step-Up Authentication - **Supported account types**: Accounts in this organizational directory only (Single tenant) - - **Redirect URI**: Platform: Web, URI: `https://accounts.conductor.one/auth/callback` + - **Redirect URI**: Platform: Web. URI (use whichever matches your C1 tenant's domain): + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Click **Register**. @@ -315,7 +319,9 @@ Click **New registration**. Configure the application: - **Name**: C1 Step-Up Authentication - **Supported account types**: Accounts in this organizational directory only (Single tenant) - - **Redirect URI**: Platform: Web, URI: `https://accounts.conductor.one/auth/callback` + - **Redirect URI**: Platform: Web. URI (use whichever matches your C1 tenant's domain): + - Default instance: `https://accounts.conductor.one/auth/callback` + - EU data residency instance: `https://accounts.c1eu.ai/auth/callback` Click **Register**. diff --git a/product/admin/webhooks-inbound.mdx b/product/admin/webhooks-inbound.mdx index 9a80168e..dacfba49 100644 --- a/product/admin/webhooks-inbound.mdx +++ b/product/admin/webhooks-inbound.mdx @@ -37,6 +37,8 @@ External system C1 |<---------------------------------------| ``` +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Set up an inbound webhook diff --git a/product/admin/webhooks.mdx b/product/admin/webhooks.mdx index 78bee07d..dfbd0e5a 100644 --- a/product/admin/webhooks.mdx +++ b/product/admin/webhooks.mdx @@ -69,6 +69,8 @@ Click **View history** to see details of the webhook's payload and status. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Webhook requests Every webhook is delivered as an HTTP POST request with a JSON body and these headers: diff --git a/product/cli/c1i-agent-skills.mdx b/product/cli/c1i-agent-skills.mdx index 57ec689b..4b2befca 100644 --- a/product/cli/c1i-agent-skills.mdx +++ b/product/cli/c1i-agent-skills.mdx @@ -128,6 +128,8 @@ Copy the output and paste it into the user rules text area. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Set up c1i with other agents The skill file is plain markdown with YAML frontmatter, so it works with any AI coding agent that accepts context files. The general pattern: diff --git a/product/cli/c1i-commands.mdx b/product/cli/c1i-commands.mdx index afefb2da..30a0cf18 100644 --- a/product/cli/c1i-commands.mdx +++ b/product/cli/c1i-commands.mdx @@ -152,6 +152,8 @@ c1i docs skill -o .cursor/rules/c1i.md For step-by-step setup instructions for Claude Code, Cursor, and other agents, see [Use c1i with AI agents](/product/cli/c1i-agent-skills). +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Auth Manage authentication credentials. @@ -743,6 +745,8 @@ Exits `0` for a valid condition, `2` for an invalid one — so `c1i policies val This validates the CEL environment rules run in (`subject`, `account`, `entitlement`, `task`) — not the same environment an approval step's `expression` approver runs in. An expression that's valid in one may not compile in the other. +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## MCP gateway Call the C1 MCP gateway directly over its MCP transport — the same handshake an MCP host performs — to verify what a registered server actually exposes. This closes the configure-then-verify loop: register a server, approve its tools, then list or call them here. diff --git a/product/cli/c1i.mdx b/product/cli/c1i.mdx index 8366c4e6..e730726d 100644 --- a/product/cli/c1i.mdx +++ b/product/cli/c1i.mdx @@ -49,6 +49,8 @@ brew install conductorone/baton/c1i docker pull public.ecr.aws/conductorone/c1i: ``` +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Configure your C1 URL c1i needs to know your C1 tenant URL. You can provide it in any of these ways (listed in order of precedence): diff --git a/product/cli/install.mdx b/product/cli/install.mdx index 10eb02c0..439169be 100644 --- a/product/cli/install.mdx +++ b/product/cli/install.mdx @@ -87,6 +87,8 @@ brew install conductorone/cone/cone docker pull public.ecr.aws/conductorone/cone: ``` +These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames. + ## Authorize Cone To authorize `cone`: diff --git a/product/how-to/qs-set-up-c1.mdx b/product/how-to/qs-set-up-c1.mdx index 8cb528d4..2ae652a2 100644 --- a/product/how-to/qs-set-up-c1.mdx +++ b/product/how-to/qs-set-up-c1.mdx @@ -14,11 +14,23 @@ To complete this guide, you'll need: - A C1 enrollment code (if you don't have an enrollment code, contact [support@c1.ai](mailto:support@c1.ai)) - Ability to create an SSO app in the IdP (if using Okta, OneLogin, or JumpCloud) +## Hosting regions + +C1 runs two hosting options: a **default instance** and an **EU data residency instance**. Your tenant is provisioned in one region, and every tenant-specific URL — login, redirect URIs, API and webhook endpoints, MCP server, and CLI configuration — reflects that region. + +| | Default instance | EU data residency instance | +|---|---|---| +| Domain | `yourcompany.conductor.one` | `yourcompany.c1eu.ai` | +| Data storage location | United States | European Union | +| Who it's for | Organizations without a specific data residency requirement | Organizations that need customer data stored and processed in the EU | +| Redirect and callback URLs | `accounts.conductor.one` | `accounts.c1eu.ai` | +| API, webhook, and MCP endpoints | `conductor.one` | `c1eu.ai` | + ## Step 1: Register your C1 domain -Go to [https://accounts.conductor.one/accounts/signup](https://accounts.conductor.one/accounts/signup). +Go to [accounts.conductor.one/accounts/signup](https://accounts.conductor.one/accounts/signup) or [accounts.c1eu.ai/accounts/signup](https://accounts.c1eu.ai/accounts/signup) for EU instances. In the **Domain** field, enter the domain you want to use for your C1 instance. @@ -165,7 +177,7 @@ Click **Save**. On the **Configuration** tab, fill out the specified fields as follows: - Login Url: Leave this field blank - - Redirect URI's: Enter `https://accounts.conductor.one/auth/callback` + - Redirect URI's: Enter whichever matches your C1 tenant's domain — default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback` - Post Logout Redirect URIs: Leave this field blank @@ -250,9 +262,9 @@ Click **Save**. On the **SSO** tab, fill out the specified fields as follows: - - Redirect URIs: Enter `https://accounts.conductor.one/auth/callback` + - Redirect URIs: Enter whichever matches your C1 tenant's domain — default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback` - Client Authentication Type: Client Secret POST - - Login URL: `https://YOUR_DOMAIN.conductor.one/login?sso_operation=initiate_login` (use the C1 domain you chose in Step 1) + - Login URL: use the C1 domain you chose in Step 1 — default instance: `https://YOUR_DOMAIN.conductor.one/login?sso_operation=initiate_login`, EU data residency instance: `https://YOUR_DOMAIN.c1eu.ai/login?sso_operation=initiate_login` In the **User Attribute Mapping** section, enter `email` in the **Service Provider Attribute Name** field and select `email` in the **JumpCloud Attribute Name** field, then click **Add Attribute**. @@ -350,8 +362,8 @@ Click **Save**. On the **Configuration** tab, click **Edit** and fill out the specified fields as follows: - Token Endpoint Authentication Method: Client Secret Post - - Redirect URI's: Enter `https://accounts.conductor.one/auth/callback` - - Initiate Login URI: Enter `https://your_domain.conductor.one/login` + - Redirect URI's: Enter whichever matches your C1 tenant's domain — default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback` + - Initiate Login URI: use your own C1 domain — default instance: `https://your_domain.conductor.one/login`, EU data residency instance: `https://your_domain.c1eu.ai/login` Click **Save**. @@ -383,7 +395,7 @@ Click **Sign up with PingOne**. PingOne will now guide you through the SSO sign- In a new browser tab, log into your identity provider and create a new OIDC application. - - Configure the redirect URI to use `https://accounts.conductor.one/auth/callback`. + - Configure the redirect URI to use whichever matches your C1 tenant's domain — default instance: `https://accounts.conductor.one/auth/callback`, EU data residency instance: `https://accounts.c1eu.ai/auth/callback`. - Ensure the authorization code flow is enabled. diff --git a/product/release-notes.mdx b/product/release-notes.mdx index 40e506cd..7d636131 100644 --- a/product/release-notes.mdx +++ b/product/release-notes.mdx @@ -8,6 +8,14 @@ sidebarTitle: Release notes --- {/* Editor Refresh: 2026-08-21 */} + + +## EU instance now available + +TK + + + ## Product digest: August 21, 2026