Embedded Login versus redirect-based OAuth
When Embedded Login still fits (a login form on an external page that can't do SSO, or login before purchase), why Salesforce disabled it by default in Summer '24 and recommends redirect-based OAuth instead, and how to set it up and troubleshoot it: Allow embedded login, CORS, the external client app, meta tags and a server-side callback.
Given a scenario, determine when to use embedded login.
~7 min read · 10 practice questions ·
What the exam expects
- Recognize Embedded Login's two use cases and its current limits: disabled by default since Summer '24, third-party cookies, Chrome only.
- Recommend a redirect-based OAuth 2.0 flow with the site as OpenID provider for new work, and know which flow Salesforce now prefers.
- List the admin setup: Allow embedded login, CORS allowlist, Embedded Login external client app (callback URL, openid scope, permitted users and profiles), Apply Login Page Type to Embedded Login.
- Troubleshoot with the meta tags and choose a server-side callback when the token must stay off the client.
Key terms: Embedded Login (a Salesforce login form placed on your own external website); CORS allowlist (origins allowed to make cross-domain requests to Salesforce); callback (the page or server endpoint that receives the token after login); redirect-based OAuth (the browser goes to the site's login page and returns with a code or token).
Key facts
- Detail
- Disabled by default since Summer '24
- Detail
- Third-party cookies; Chrome only while they're allowed
- Detail
- External site without SSO; login before purchase
- Detail
- Web server flow with PKCE; user-agent and hybrid user-agent flows retire February 20, 2027
- Detail
- Required; missing entry gives a null Access-Control-Allow-Origin
- Detail
- OAuth on, callback URL, openid scope; consumer key = salesforce-client-id
- Detail
- Username and password unless Apply Login Page Type to Embedded Login
- Detail
- Set false for Login Discovery, MFA or self-authorize
- Detail
- One-time code exchanged with the web server flow
Sources for this section (9)
- Enable Embedded Loginhelp.salesforce.com (opens in a new tab)
- Embedded Loginhelp.salesforce.com (opens in a new tab)
- Block Authorization Flowshelp.salesforce.com (opens in a new tab)
- User-Agent Flows Retirementhelp.salesforce.com (opens in a new tab)
- Step 1: CORShelp.salesforce.com (opens in a new tab)
- Step 2: External Client Apphelp.salesforce.com (opens in a new tab)
- Prerequisiteshelp.salesforce.com (opens in a new tab)
- Meta Tag Referencehelp.salesforce.com (opens in a new tab)
- Step 5: Callbackhelp.salesforce.com (opens in a new tab)
- Why did Salesforce disable Embedded Login by default?
- When is Embedded Login a documented fit?
- Which error tells you CORS isn't configured for Embedded Login?
- Which OAuth flow do the OAuth pages recommend instead of the user-agent flow for external web apps?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Identity and Access Management Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 25 lessons of the Platform Identity and Access Management Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams