# Embedded Login versus redirect-based OAuth

*Platform Identity and Access Management Architect Study Guide · Community (Partner and Customer) · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/identity-and-access-management-architect/community-partner-and-customer/embedded-login-versus-redirect-based-oauth*

When Embedded Login still fits (a login form on an external page that can't do SSO, or login before purchase), why Salesforce disabled it by default in Summer '24 and recommends redirect-based OAuth instead, and how to set it up and troubleshoot it: Allow embedded login, CORS, the external client app, meta tags and a server-side callback.

- Certification: Salesforce Platform Identity and Access Management Architect
- Exam section: Community (Partner and Customer)
- Study guide: https://www.certifyforce.com/study-guide/identity-and-access-management-architect

**Official exam objective:**

> Given a scenario, determine when to use embedded login.

## What the exam expects

- Recognize Embedded Login's two use cases and its current limits: disabled by default since Summer '24, third-party cookies, Chrome only.
- Recommend a redirect-based OAuth 2.0 flow with the site as OpenID provider for new work, and know which flow Salesforce now prefers.
- List the admin setup: Allow embedded login, CORS allowlist, Embedded Login external client app (callback URL, openid scope, permitted users and profiles), Apply Login Page Type to Embedded Login.
- Troubleshoot with the meta tags and choose a server-side callback when the token must stay off the client.

Key terms: **Embedded Login** (a Salesforce login form placed on your own external website); **CORS allowlist** (origins allowed to make cross-domain requests to Salesforce); **callback** (the page or server endpoint that receives the token after login); **redirect-based OAuth** (the browser goes to the site's login page and returns with a code or token).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Default state | Disabled by default since Summer '24 | [Enable Embedded Login](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enable_embedded_login.htm&language=en_US&release=250&type=5) |
| Browser support | Third-party cookies; Chrome only while they're allowed | [Embedded Login](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_embedded_login_use_cases.htm&language=en_US&type=5) |
| Use cases | External site without SSO; login before purchase | [Embedded Login](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_embedded_login_use_cases.htm&language=en_US&type=5) |
| Preferred flow | Web server flow with PKCE; user-agent and hybrid user-agent flows retire February 20, 2027 | [Block Authorization Flows](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5), [User-Agent Flows Retirement](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_retirement.htm&language=en_US&release=262&type=5) |
| CORS | Required; missing entry gives a null Access-Control-Allow-Origin | [Step 1: CORS](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_1.htm&language=en_US&type=5) |
| External client app | OAuth on, callback URL, openid scope; consumer key = salesforce-client-id | [Step 2: External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_2.htm&language=en_US&type=5) |
| Login page type | Username and password unless Apply Login Page Type to Embedded Login | [Prerequisites](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_prereqs.htm&language=en_US&type=5) |
| Mask redirects | Set false for Login Discovery, MFA or self-authorize | [Meta Tag Reference](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_reference.htm&language=en_US&type=5) |
| Server-side callback | One-time code exchanged with the web server flow | [Step 5: Callback](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_5.htm&language=en_US&type=5) |

## Check yourself

- Why did Salesforce disable Embedded Login by default?
- When is Embedded Login a documented fit?
- Which error tells you CORS isn't configured for Embedded Login?
- Which OAuth flow do the OAuth pages recommend instead of the user-agent flow for external web apps?

## Sources

- [Embedded Login](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_embedded_login_use_cases.htm&language=en_US&type=5)
- [Enable Embedded Login](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_enable_embedded_login.htm&language=en_US&release=250&type=5)
- [Embedded Login Considerations](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_considerations.htm&language=en_US&type=5)
- [Prerequisites: Configure Your Experience Cloud Site and Website](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_prereqs.htm&language=en_US&type=5)
- [Step 1: Enable Resource Sharing Across Domains](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_1.htm&language=en_US&type=5)
- [Step 2: Create the Embedded Login External Client App](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_2.htm&language=en_US&type=5)
- [Step 5: Handle the Embedded Login Callback](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_5.htm&language=en_US&type=5)
- [Embedded Login Meta Tag Reference](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_reference.htm&language=en_US&type=5)
- [Embedded Login in Action](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_in_action.htm&language=en_US&type=5)
- [Block Authorization Flows to Improve Security](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_disable_username_password_flow.htm&language=en_US&type=5)
- [OAuth 2.0 Web Server Flow for Web App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&language=en_US&type=5)
- [OAuth User-Agent and Hybrid User-Agent Flows Retirement (Release Update)](https://help.salesforce.com/s/articleView?id=release-notes.rn_security_user_agent_retirement.htm&language=en_US&release=262&type=5)
- [OAuth 2.0 User-Agent Flow for Desktop or Mobile App Integration](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&language=en_US&type=5)
- [Configure Your Experience Cloud Site as an Identity Provider or OpenID Provider](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_sso_idp.htm&language=en_US&type=5)
- [Headless Identity for Customers and Partners](https://help.salesforce.com/s/articleView?id=xcloud.headless_identity_customers_overview.htm&language=en_US&type=5)
- [Manage OAuth Access Policies for a Connected App](https://help.salesforce.com/s/articleView?id=xcloud.connected_app_manage_oauth.htm&language=en_US&type=5)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Identity and Access Management Architect pack (USD $19): https://www.certifyforce.com/practice-exams