--- schema_version: "1" id: 873ba560a40034d6fd40326656578f89dff7cdae0d2bcb08174805eba4587d7d title: Custom Login Flow Considerations collection: admin version: current locale: en-us portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/custom_login_flow.md canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.custom_login_flow.htm&release=264.0.0&type=5 source_site: help.salesforce.com content_type: documentation content_hash: 4d6f77a436529f5c76535f867375dedc39a0d28703aa9d7d62fe5bf0bdc2fcf8 description: A login flow directs users through a login process before they access your Mobile Publisher for Experience Cloud app. After Salesforce authenticates a user, the login flow directs the user through a process, such as enforcing strong authentication or collecting user information. When users complete the login flow successfully, they’re redirected to their Mobile Publisher for Experience Cloud site. If unsuccessful, the flow can log out users immediately. products: - Experiences - Mobile App - Cross Cloud release: "264" --- # Custom Login Flow Considerations A login flow directs users through a login process before they access your Mobile Publisher for Experience Cloud app. After Salesforce authenticates a user, the login flow directs the user through a process, such as enforcing strong authentication or collecting user information. When users complete the login flow successfully, they’re redirected to their Mobile Publisher for Experience Cloud site. If unsuccessful, the flow can log out users immediately. ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-branded_apps_exp_cloud-264-0-0-production-enus/cf85363c-215e-4784-bb6a-c5c83c4e7140/images/icon_note.png) Note This information applies to Aura and LWR sites. ![Diagram of Login Flow](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-branded_apps_exp_cloud-264-0-0-production-enus/cf85363c-215e-4784-bb6a-c5c83c4e7140/branded_apps_exp_cloud/images/login_flow.png) ![Important](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-branded_apps_exp_cloud-264-0-0-production-enus/cf85363c-215e-4784-bb6a-c5c83c4e7140/images/icon_important.png) Important Standard Login components aren’t available for LWR sites. Create a customized site login. Keep these practices in mind when creating a custom login flow for your Mobile Publisher app. User Authentication Limitations - Make sure you’re aware of the [user authentication limitations for Mobile Publisher for Experience Cloud](https://help.salesforce.com/s/articleView?id=xcloud.branded_apps_exp_best_practices_known_issues.htm&release=264.0.0&type=5 "Learn about known issues for Mobile Publisher."). Login Page - The login page must have its own unique URL. - Mobile Publisher doesn’t support login page URLs that pop up from a non-login page, such as a guest home page. - Hyperlinks that open in a new window aren’t supported on the login page. Start URL - A start URL defines the page users are directed to when they run your mobile app. If you don’t configure a start URL, users are directed to the app’s default start page after authorization completes. Make sure you pass the start URL to the login method. - Get the start URL dynamically from the PageReference object or a similar component on the LWR site. Avoid hard coding the start URL. - To make sure that the start URL is correctly encoded, encode the URL with the [EncodingUtil Apex class](https://developer.salesforce.com/docs/atlas.en-us.apexref.meta/apexref/apex_classes_restful_encodingUtil.htm). Connected apps - Connected apps are required for persistent authentication, biometric login, and push notifications on a Mobile Publisher app. These features aren’t supported for custom login workflows that bypass connected apps. Using Auth Provider or SSO as Site Authentication - On a page to link to the Auth Provider or SSO, don’t use the `href` attribute, or hard code any authentication provider URL. Instead, from **Workspace** | **Administration** | **Login & Registration** visit and configure **Single Sign-On** or **Auth. Providers** in Setup. Doing so ensures that Mobile Publisher can detect the login URL and initiate the OAuth flow in the Mobile Publisher app. - Don’t use both a custom login page and SAML single sign-on (SSO). If you use SAML SSO, select a default login page from **Workspaces** | **Administration** | **Login & Registrations** | **Login Page Setup**. Also make sure that SAML SSO authentication is configured to use HTTP POST to avoid RelayState cut off. - To trigger a login request in Experience Cloud sites, use the **SsoUrl** defined in .well-known/auth-configuration. Internal User Login via Salesforce Login Page - Internal user login via the Salesforce login page isn’t supported in Mobile Publisher for Experience Cloud. If you still want to support the internal user login in your mobile app, enable the **Allow employees to log in directly to an Experience Cloud site** option from the site’s **Workspace** | **Administration** | **Login & Registration** page. Using Apex to Customize Default Login Process - Avoid overriding the `startURL` in the login request. Because the `startURL` includes links to the consumer key, redirect URI and approval page, overriding the `startURL` breaks the OAuth flow in your Mobile Publisher app. For an example, see [Customize the Apex Login Controller](https://help.salesforce.com/s/articleView?id=experience.external_identity_customize_login_controller.htm&type=5&language=en_US). Custom Login Component - If you use a custom login component, make sure to use the default login page URL. Missing or Incomplete CA (Certificate Authority) for Android - If there are missing or incomplete CA intermediate certificates, Android app users can receive a message that the Experience Cloud site is unable to load. Some Android devices don’t have trusted intermediate CA certificates. To resolve this issue, CA certificates must be installed and trusted, or the certificate chain must be uploaded to Salesforce and associated with the custom domain. [Qualys SSL Labs](https://www.ssllabs.com/ssltest/analyze.html) and [SSLMate](https://whatsmychaincert.com/) offer a free SSL certificate test that can quickly analyze custom domain URLs and check for incomplete certificate chains. Using reCAPTCHA for Login Flow - Make sure to use a [supported Google mobile browser](https://support.google.com/recaptcha/answer/6223828?hl=en). IP Restrictions - Don’t enforce IP restrictions unless you’re required to not allow access to the Experience Cloud site from outside networks or LTE. Refresh Token Policy - For mobile apps, the ideal setting for the refresh token policy is to never expire. This setting provides the best experience for your app users. #### See Also - [_LWR Sites for Experience Cloud_: Create Components for LWR Sites](https://developer.salesforce.com/docs/atlas.en-us.exp_cloud_lwr.meta/exp_cloud_lwr/get_started_components.htm)