---
schema_version: "1"
id: 382ded1d907f7141e3bffbe9666b938e6cdf85fb38413638b31f458bf1420065
title: Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/branded_apps_best_practices_auth.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.branded_apps_best_practices_auth.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4695502973841e8dbbe7aa8d69885a2473165af3aa9f857860aec6bcca57641c
description: This information helps you troubleshoot authentication issues when using Mobile Publisher.
products:
  - Mobile App
  - Cross Cloud
release: "264"
---
# Authentication

This information helps you troubleshoot authentication issues when using Mobile Publisher.

- If you use SAML authentication, configure it to use HTTP POST to avoid RelayState cut off.
- Use the default login page if you have only one auth provider.
- Don’t enforce IP restrictions unless you’re required to not allow access to the Experience Cloud site from outside networks or LTE.
- For mobile apps, the ideal setting for refresh token policy is to never expire. This setting provides the best experience for your users.
- Use the “SsoUrl” defined in “.well-known/auth-configuration” to trigger a login request in Experience Cloud sites.
- If there are missing or incomplete CA (Certificate Authority) intermediate certificates, Android users could experience messages stating the Experience Cloud site is unable to load. Some Android devices don’t have trusted intermediate certificates. To resolve this issue, the certificates must be installed and trusted or the certificate chain must be uploaded to Salesforce and associated with the custom domain.
    - Qualys SSL Labs offers a web-based free service ([https://www.ssllabs.com/ssltest/analyze.html](https://www.ssllabs.com/ssltest/analyze.html)) that can quickly analyze custom domain URLs and check for incomplete certificate chains.
    - For more information about certificate chains, see [Merge a complete certificate chain for custom HTTPS domains](https://help.salesforce.com/articleView?id=000333504&language=en_US&type=1&mode=1).
- If you use reCAPTCHA for your login flow you must specify the login page to open in an in-app browser. Also make sure to use a [supported mobile browser (Google)](https://support.google.com/recaptcha/answer/6223828?hl=en). For more information on setting up reCAPTCHA, see [Set Up ReCaptcha](https://help.salesforce.com/s/articleView?id=service.workdotcom_quemgmt_set_up_captcha.htm&type=5&language=en_US).