Note: Once released, this feature will be in an experimental phase until marked stable. While you are free to start using it right from the start, there might still be some protocol changes in the coming weeks. The current plan is to stabilize this feature by end of July.
the short of it is - if you add a json-encoded array of strings at /.well-known/ii-alternative-origins for the domains you’re redirecting from, you can instead host the serviceworker at the custom domain, and then pass a derivationOrigin during authClient.login, specifying the canister id url that you have been redirecting to.
Full tutorial to come, plus there will be official support in the next releases of agent-js and dfx