Set up and access a custom domain for a public secure connections Looker (Google Cloud core) instance

You can serve your instance through a custom web domain rather than through the default domain that Looker (Google Cloud core) provides.

This documentation page describes custom domain setup for instances that meetone of the following criteria:

  • The instance uses public secure connections.
  • The instance uses hybrid connections.

If you create a custom domain with an instance that uses a public network connection, Google provides a managed, auto-renewing SSL certificate.

To implement a custom domain for this kind of instance, you must perform the following steps:

  1. Set up the custom domain.
  2. Create the DNS A record.
  3. Update the OAuth credentials.
Important: If your instance has hybrid connections, you can follow the instructions on this page; however, if you change to a private connections configuration at any point, your custom domain will be invalidated and you will need to recreate it for your private connections configuration.

Set up a custom domain

After your Looker (Google Cloud core) instance has been created, you can set up a custom domain.

Before you begin

Note: Custom domains cannot be created using a looker.com domain.

Before you can customize the domain of your Looker (Google Cloud core) instance, identify where your domain's DNS records are stored, so that you can update them.

Required roles

To get the permissions that you need to create a custom domain for a Looker (Google Cloud core) instance, ask your administrator to grant you theLooker Admin (roles/looker.admin) IAM role on the project the instance resides in. For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

Create a custom domain

Note: You cannot modify a custom domain once it is created. If you want to make changes to the custom domain, you must delete the existing custom domain and create a new one.

In the Google Cloud console, follow these steps to customize the domain of your Looker (Google Cloud core) instance:

  1. On theInstances page, click the name of the instance for which you would like to set up a custom domain.
  2. Click theCustom domain tab.

  3. ClickAdd a custom domain.

    This opens theAdd a new custom domain panel.

  4. Using only letters, numbers, and dashes, enter the hostname of up to 64 characters for the web domain that you would like to use — for example:looker.examplepetstore.com.

  5. ClickDONE on theAdd a new custom domain panel to return to theCUSTOM DOMAIN tab.

Updating the custom domain takes 10 to 15 minutes to complete.

Once your custom domain is set up, it is displayed in theDomain column on theCUSTOM DOMAIN tab of the Looker (Google Cloud core)instance details page in the Google Cloud console.

After your custom domain has been created, you canview information about it, ordelete it.

Access the custom domain

To set up access to a custom domain for a Looker (Google Cloud core) instance that uses public secure connections, create a DNS record and update the OAuth credentials.

Before you begin

To get the permissions that you need to set up access to a public secure connections custom domain, ask your administrator to grant you the following IAM roles on the project the instance resides in:

For more information about granting roles, seeManage access to projects, folders, and organizations.

You might also be able to get the required permissions throughcustom roles or otherpredefined roles.

Create a DNS record

Wherever your DNS records are stored, create an A record in the DNS zone for your domain. For an instance that uses a public network connection, use the Looker (Google Cloud core) instance's ingress public IP for the A record's IP address. The ingress public IP can be found on theDetails tab of the Looker (Google Cloud core) instance in the Google Cloud console. (It is also displayed in theData field in theUpdate your DNS records section of theAdd a new custom domain panel.)

If aVERIFY DOMAIN button appears on theCUSTOM DOMAIN tab of the Looker (Google Cloud core) instance, your DNS record may require additional configuration. ClickVERIFY DOMAIN to complete the setup of your custom domain.

Note: It may take up to 24 hours for any changes to your DNS record to take effect. The SSL certificate that is associated with your DNS record may require several minutes to activate.

Once your domain's DNS records are updated and your domain has been verified in the Google Cloud console, thestatus of the custom domain that is mapped to the instance will be updated fromUnverified toAvailable on theCustom domain tab.

Update the OAuth credentials

Note: You can use any OAuth client to create authorization credentials for your Looker (Google Cloud core) instance. As an example, these steps walk you through updating the credentials using the Google Cloud console. If you are using a different client, adjust the steps accordingly.
  1. Access your OAuth client by navigating in the Google Cloud console toAPIs & Services > Credentials and selecting the OAuth client ID for the OAuth client that is used by your Looker (Google Cloud core) instance.

  2. Click theAdd URI button to update theAuthorized JavaScript origins field in your OAuth client to include the same DNS name that your organization will use to access Looker (Google Cloud core). For example, if your custom domain islooker.examplepetstore.com, you would enterlooker.examplepetstore.com as the URI.

  3. Update or add the custom domain to the list ofAuthorized redirect URIs for theOAuth credentials that you used when you created the Looker (Google Cloud core) instance. Add/oauth2callback to the end of the URI. For example, if your custom domain islooker.examplepetstore.com, you would enterlooker.examplepetstore.com/oauth2callback.

Add users

Once the preceding steps are completed, the custom domain URL is accessible to users.

Ensure that theuser authentication method is completely set up for the Looker (Google Cloud core) instance before adding users to the instance.

What's next

Except as otherwise noted, the content of this page is licensed under theCreative Commons Attribution 4.0 License, and code samples are licensed under theApache 2.0 License. For details, see theGoogle Developers Site Policies. Java is a registered trademark of Oracle and/or its affiliates.

Last updated 2026-02-18 UTC.