ICP’s New Canonical URL Is an Identity and Trust Boundary

The Internet Computer’s canonical frontend address is shifting to icp.net, but developers should treat the change as an application-boundary update, not a cosmetic URL replacement.

The first clear signal came from icp-cli 1.0.0, whose release notes made icp.net the default gateway domain instead of icp0.io. Current ICP documentation now presents https://<canister-id>.icp.net as the standard mainnet address for asset canisters and uses that hostname in custom-domain verification examples.

That matters because an application’s origin participates in authentication. Internet Identity derives a user principal from the frontend origin. The current authentication guide says that serving an application from multiple domains can produce different principals; specifically, moving from a canister URL to a custom domain requires alternative-origin configuration if users are expected to retain the same identity. The guide also documents a special compatibility rule for icp0.io and ic0.app, but that rule should not be generalized to arbitrary domains.

For builders, the migration checklist is therefore short but consequential:

1. Make the canonical production URL explicit in deployment notes, environment configuration, and integration tests.
2. Test login continuity when moving between any old gateway URL, icp.net, and a custom domain.
3. If two genuine custom origins must share users, publish /.well-known/ii-alternative-origins from the primary origin with exact origins and no paths or trailing slashes.
4. Keep JavaScript, CSS, and other security-sensitive assets on the certified canister origin whenever possible.

The last point is the security angle. ICP’s canister-control guidance warns that loading JavaScript from an untrusted domain gives that domain control over the application’s browser context, including the ability to compromise credentials managed by the JavaScript agent. The same guidance identifies <canister-id>.icp.net as the trusted certified origin and warns that raw gateway domains do not provide the same asset-certification guarantee.

The practical lesson is that icp.net is becoming a useful canonical anchor for both routing and security review. A URL migration can still break sessions if the origin changes, and a visually identical frontend can still be unsafe if its scripts come from a different host.

Caveat: the sources establish the current icp.net default and its identity implications, but they do not specify a universal deadline for removing older gateway URLs. Migration timing may vary by tool and application.