HOLD FOR LAUNCH Docs update for EU instance

.claude/skills/docs-writing.md

@@ -216,6 +216,35 @@ When documenting features that are in early access, add a standardized warning c
 - Include the explanation of what early access means
 - Use "share feedback" (not "have any feedback")
 
+## Hosting region references (default instance vs. EU data residency)
+
+C1 runs two hosting options — a **default instance** (`conductor.one`) and an **EU data residency instance** (`c1eu.ai`). A tenant is provisioned in one region, and every tenant-specific URL, hostname, or IP address reflects it. See the "Hosting regions" table in [Create a C1 tenant](/product/how-to/qs-set-up-c1) for the canonical explainer — link there rather than re-explaining the concept on other pages.
+
+Anywhere a region-specific value appears, use one of the two treatments below based on how the value is used — not on which section of the docs it's in.
+
+**Single fixed values the reader pastes somewhere** (an OAuth redirect URI, an MCP callback URL, a firewall allowlist entry) — show both values explicitly, labeled by instance, instead of printing only the default:
+
+```mdx
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
+```
+
+Lead into the pair with wording that tells the reader how to choose — "whichever matches your C1 tenant's domain" — rather than assuming they already know which hosting option they're on. This applies even when the value is tenant-specific (contains a placeholder like `<tenantName>` or `YOUR_DOMAIN`): show both domain suffixes, not just `conductor.one`.
+
+Don't use this pattern for a value the reader copies directly from their own C1 account (for example, an MCP server URL shown on an "AI connections" page) — the product already displays the tenant's real, region-correct value, so there's nothing to disambiguate.
+
+**Reference and example-heavy pages** (API docs, CLI docs, service-principal/workload-federation guides) where `conductor.one` appears repeatedly inside code blocks or curl examples — don't rewrite every example. Add one callout near the section the examples belong to instead:
+
+```mdx
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+```
+
+- Place the callout immediately before the section whose examples it covers, not at the top of the page if the examples don't start until much later — "these examples" should mean the ones the reader is about to see.
+- If a page has more than one cluster of examples separated by unrelated content, repeat the callout at each cluster rather than relying on one mention to cover the whole page.
+- Reserve this pink `<Callout>` (`icon="globe"`, `color="#c937ae"`) for hosting-region notes specifically. Standard content notes still use `<Note>`, `<Tip>`, `<Warning>`, or `<Info>`.
+
+**Choosing between the two**: is this a single value the reader picks once and pastes into a form field or config (dual-value), or a domain suffix baked into many illustrative examples across a section (callout)? A page can need both — a one-time setup step plus a pile of reference examples further down.
+
 ## Navigation (docs.json)
 
 - Pages map to MDX files (no extension)

baton/aws.mdx

@@ -794,10 +794,7 @@ spec:
 
 <Steps>
     <Step>
-    Log into [C1](https://accounts.conductor.one/accounts).
-    </Step>
-    <Step>
-    Click **Connectors** > **AWS Connector**.
+    In C1, click **Connectors** > **AWS Connector**.
     </Step>
     <Step>
     Copy and save the **External ID** populated in the **External ID** field. We'll use this in Step 2.

baton/azure-devops.mdx

@@ -97,7 +97,10 @@ You can authenticate the Azure DevOps connector in three ways: OAuth (interactiv
   Give the new app a name and select the **Accounts in any organizational directory** option.
   </Step>
   <Step>
-  Enter `https://accounts.conductor.one/oauth/callback` as a **Web** redirect URI.
+  Enter whichever redirect URI matches your C1 tenant's domain as a **Web** redirect URI:
+
+  - Default instance: `https://accounts.conductor.one/oauth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
   </Step>
   <Step>
   Click **Register**.

baton/deploy.mdx

@@ -375,7 +375,7 @@ Service mode requires outbound HTTPS only:
 - No inbound ports required
 - Works behind NAT and most firewalls
 
-If you have egress filtering, allow HTTPS to `*.conductorone.com`.
+If you have egress filtering, allow HTTPS to whichever domain matches your C1 tenant's hosting region — default instance: `*.conductor.one`, EU data residency instance: `*.c1eu.ai`.
 
 ### Resource requirements
 

baton/dropbox.mdx

@@ -96,11 +96,10 @@ A user with the **Team Admin** role in Dropbox must perform this task.
   Carefully copy and save the app key and app secret.
   </Step>
   <Step>
-  Under **OAuth 2**, add the following redirect URI and click **Add**:
+  Under **OAuth 2**, add whichever redirect URI matches your C1 tenant's domain, and click **Add**:
 
-  ```
-  https://accounts.conductor.one/oauth/callback
-  ```
+  - Default instance: `https://accounts.conductor.one/oauth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
   </Step>
   <Step>
   Give the app the relevant set of permissions:

baton/freshbooks.mdx

@@ -39,7 +39,10 @@ Give the app the following scopes:
     - user:account:write
 </Step>
 <Step>
-Enter `https://accounts.conductor.one/oauth/callback` as the **Redirect URI**.
+Enter whichever redirect URI matches your C1 tenant's domain as the **Redirect URI**:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 Save the app. 

baton/ironclad.mdx

@@ -49,7 +49,10 @@ In the **Grant Types** area, select the grant type that matches your authenticat
    - **Authorization Code**: Requires logging in and authorizing. Only available for cloud-hosted connectors.
 </Step>
 <Step>
-If you selected **Authorization Code**, enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field.
+If you selected **Authorization Code**, enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 In the **Scopes** area, give the app the following scopes:

baton/lucidchart.mdx

@@ -70,7 +70,10 @@ Give the new app a name, then click **Create**.
 Select the new app's **OAuth 2.0** tab.
 </Step>
 <Step>
-Enter `https://accounts.conductor.one/oauth/callback` in the **Redirect URI** field.
+Enter whichever redirect URI matches your C1 tenant's domain in the **Redirect URI** field:
+
+- Default instance: `https://accounts.conductor.one/oauth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/oauth/callback`
 </Step>
 <Step>
 Click **Create OAuth 2.0 client**.

baton/v1/aws.mdx

@@ -230,10 +230,7 @@ As an alternative to the instructions above, use the following Terraform script
 
 <Steps>
 <Step>
-Log into [C1](https://accounts.conductor.one/accounts).
-</Step>
-<Step>
-Navigate to **Integrations** > **Connectors** > **AWS Connector**.
+In C1, navigate to **Integrations** > **Connectors** > **AWS Connector**.
 </Step>
 <Step>
 Copy and save the **External ID** populated in the **External ID** field (we'll use this in Step 2.

conductorone-api/authenticate.mdx

@@ -3,6 +3,8 @@ title: How to authenticate requests
 description: "To use the C1 API, you must authenticate your requests. This document guides you through the process of obtaining and utilizing an API key, as well as establishing an access token."
 ---
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Step 1: Obtain an API key
 
 The first step in the process is to obtain your API key from C1:

conductorone-api/pagination.mdx

@@ -3,6 +3,8 @@ title: Pagination in the C1 API
 description: "When making `LIST` or `SEARCH` requests to the C1 API, use the `page_size` and `page_token` parameters to navigate through the list of results."
 ---
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Using page\_size
 
 Include the `page_size` parameter to tell the API how many search or list results to show on each page.

product/admin/c1-mcp.mdx

@@ -81,6 +81,8 @@ Click **Save**.
 If you configure IP restrictions, AI assistants will only work from the specified IP ranges. This is useful for restricting usage to corporate networks or VPNs.
 </Note>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Connect an AI assistant
 
 Follow these steps to connect your AI assistant to C1 via MCP.

product/admin/code-mode.mdx

@@ -96,6 +96,8 @@ export default async function main(input) {
 
 Response shapes differ from tool to tool. The `records` and `nextPageToken` keys above belong to this tool; read the real keys from `describe` output rather than carrying an envelope key over from a different tool. Optional keys should be omitted entirely — never passed as `undefined`.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Reading the results
 
 Most calls return what you'd expect: the upstream tool's normal output, minus anything a post-tool-use hook redacted or capped.

product/admin/enterprise-managed-authorization/overview.mdx

@@ -88,6 +88,8 @@ The full path, end to end:
 
 Before you start, the MCP server's authorization server must be configured to trust C1 as an issuer. That work is done by the server's owner — see [Support enterprise-managed authorization in your MCP server](/product/admin/enterprise-managed-authorization/support-in-your-app).
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Key concepts
 
 | Concept | Description |

product/admin/enterprise-managed-authorization/support-in-your-app.mdx

@@ -21,6 +21,8 @@ To support enterprise-managed authorization, your server does two things:
 
 C1 issues an ID-JAG, a short-lived JWT whose audience is your authorization server's issuer. Your authorization server verifies C1's signature, confirms the token is meant for it, and returns one of your own access tokens that the agent then uses to call your API.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Trust C1 as an issuer
 
 Configure your authorization server to recognize C1 as a token issuer and to advertise the grant C1 relies on.
@@ -87,6 +89,8 @@ C1 does not send a SAML `NameID` (`sub_id`) or a resource-server-specific user i
 
 C1 can sign ID-JAGs with ES256 (the default), RS256, or EdDSA. Pick the algorithm your authorization server verifies, and tell your C1 admin which one to use for your system. C1 uses the chosen algorithm with no silent fallback, so the algorithm your admin configures must be one your authorization server accepts.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Example
 
 The following are taken from a verified end-to-end exchange against a live C1 tenant. The protected-resource metadata document shows the fields C1 reads during discovery, and the decoded ID-JAG shows the claims your authorization server verifies.

product/admin/functions-api.mdx

@@ -8,6 +8,8 @@ sidebarTitle: "Manage via the API"
 
 Manage functions programmatically through the C1 REST API to automate deployments or work outside the web UI. For the web UI workflow, see [Create and test functions](/product/admin/functions-create).
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Authentication
 
 All API calls require a bearer token from a personal API key or service principal credential. See [C1 API and keys](/conductorone-api/api) for setup.

product/admin/mcp-server/bitbucket.mdx

@@ -54,7 +54,9 @@ In Bitbucket, go to your **Workspace settings** > **OAuth consumers** and select
 Fill in the registration form:
 
 - **Name** — a recognizable name such as `C1`.
-- **Callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`.
+- **Callback URL** — set this exactly to whichever matches your C1 tenant's domain:
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Under **Permissions**, grant only the scopes you need for the operations you plan to govern, such as read access to Account, Repositories, Pull requests, and Issues.

product/admin/mcp-server/box.mdx

@@ -48,7 +48,10 @@ In the Box Developer Console, create a new custom app that uses standard OAuth 2
 Give the app a recognizable name such as `C1`.
 </Step>
 <Step>
-In the app's configuration, set the **redirect URI** exactly to `https://accounts.conductor.one/auth/callback`.
+In the app's configuration, set the **redirect URI** exactly to whichever matches your C1 tenant's domain:
+
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Grant only the scopes you need, such as read access to the content you plan to govern. Copy the **client ID** and **client secret**.

product/admin/mcp-server/confluence.mdx

@@ -46,11 +46,10 @@ Select **Create** > **OAuth 2.0 integration**, enter a recognizable name such as
 Open the **Permissions** tab. Next to **Confluence API**, select **Add**, then **Configure**, and add the scopes from [Confluence scopes](#confluence-scopes) below — the default read scopes, plus any optional write or delete scopes you need.
 </Step>
 <Step>
-Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to:
+Open the **Authorization** tab. Next to **OAuth 2.0 (3LO)**, select **Configure** and set the **Callback URL** exactly to whichever matches your C1 tenant's domain:
 
-```
-https://accounts.conductor.one/auth/callback
-```
+- Default instance: `https://accounts.conductor.one/auth/callback`
+- EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 
 Select **Save changes**.
 </Step>

product/admin/mcp-server/gemini-enterprise.mdx

@@ -41,6 +41,8 @@ Confirm all of these before you start. The organization policy change in particu
 - Someone who holds `roles/orgpolicy.policyAdmin` at the organization level. Project **Owner** does not include it, and a project-level grant is not sufficient for the policy change below.
 - **Optional.** The [gcloud CLI](https://cloud.google.com/sdk/docs/install), authenticated with `gcloud auth login`, if you prefer the command line for the Google Cloud steps.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Collect the values you'll reuse
 
 The steps below reuse these values. Collect them once.
@@ -156,6 +158,8 @@ curl -s -X POST \
 An app created this way has no subscription attached. Add one under **Manage users** in the console before you assign licenses.
 </Accordion>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Allow custom MCP data connectors
 
 Google Cloud blocks custom MCP data connectors by default through the `constraints/discoveryengine.managed.disableCustomMcpServerConnector` organization policy. Turn it off for this project before you create the data store.
@@ -347,6 +351,8 @@ curl -s -X POST \
   }'
 ```
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Get the OAuth client ID
 
 Gemini Enterprise authenticates each user to C1 with the OAuth 2.0 authorization code flow, and it needs an OAuth client that already exists. It does not register one itself, and it does not publish a client identity you can point at.
@@ -463,6 +469,8 @@ Organization policy changes take a minute or two to take effect, in both directi
 </Note>
 </Accordion>
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Create the data store
 
 Connect the C1 MCP gateway to your Gemini Enterprise app.
@@ -723,6 +731,8 @@ The connection is working, and every tool call is attributed to the user who mad
 
 If the agent does not call a tool, returns nothing, or reports a denial, see [Troubleshoot Gemini Enterprise connection errors](#troubleshoot-gemini-enterprise-connection-errors). A denial that names a missing toolset or access profile is C1 working as configured, not a broken integration.
 
+<Callout icon="globe" color="#c937ae" iconType="regular">These examples use `conductor.one`. If your organization is on the EU data residency instance, substitute `c1eu.ai` in URLs, client IDs, and hostnames.</Callout>
+
 ## Troubleshoot Gemini Enterprise connection errors
 
 | Symptom | Cause | Fix |

product/admin/mcp-server/github.mdx

@@ -58,7 +58,9 @@ Fill in the registration form:
 
 - **Application name** — a recognizable name such as `C1`.
 - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`.
-- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps.
+- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth Apps allow only one callback URL, unlike GitHub Apps):
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Select **Register application**, then copy the **Client ID**. Select **Generate a new client secret** and copy the secret — GitHub shows it only once. Store it securely, and if it's ever exposed, generate a new one, update C1, then delete the old one ([best practices for creating an OAuth app](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/best-practices-for-creating-an-oauth-app)).
@@ -178,7 +180,9 @@ Fill in the registration form:
 
 - **Application name** — a recognizable name such as `C1`.
 - **Homepage URL** — your C1 tenant URL, or `https://www.c1.ai`.
-- **Authorization callback URL** — set this exactly to `https://accounts.conductor.one/auth/callback`. GitHub OAuth apps allow only one callback URL.
+- **Authorization callback URL** — set this exactly to whichever matches your C1 tenant's domain (GitHub OAuth apps allow only one callback URL):
+  - Default instance: `https://accounts.conductor.one/auth/callback`
+  - EU data residency instance: `https://accounts.c1eu.ai/auth/callback`
 </Step>
 <Step>
 Select **Register application**.