Migrating a web app from a path-based URL (example.com/app) to a dedicated subdomain (app.example.com) sounds simple—until you touch authentication, routing, and API boundaries. The good news: with a deliberate plan and a phased rollout, it can be low-risk—even boring.

This post outlines a practical approach that worked for us, distilled into phases, traps to avoid, and a reusable checklist.

This approach is especially useful for SaaS products, dashboards, and SPAs that rely on hosted authentication providers and API-driven backends.