Change How to Invoke Embedded Login on the Server

You can change the default behavior of Embedded Login on the server by modifying the <script> tag inside the <head> HTML element at the top of the web page.

Warning
Warning In Summer ’24, Salesforce made Embedded Login disabled by default. We recommend that you use the web server flow, the user-agent flow, or another redirect-based OAuth 2.0 flow instead of Embedded Login.

Embedded Login relies on third-party cookies, which are blocked or restricted in most browsers. And Embedded Login works only on Google Chrome and only as long as third-party cookies are allowed there by default.

The script loads a Java servlet that enables login capabilities. You can add these parameters to the script to change how the Embedded Login servlet behaves.

min=false
Generates a readable JavaScript version. By default, Embedded Login loads the JavaScript in a minimized, lightweight state that’s hard to read. Use min=false to generate a response that’s easier to read.
<script src="https://embeddedlogin-dev-ed.my.site.com/demo/servlet/
servlet.loginwidgetcontroller?type=javascript_widget&min=false" async defer></script>
cacheMaxAge=n
Sets the cache control maximum age header, which the browser uses to determine whether the cached content is fresh or must be refreshed from the server. By default, the cache is cleared every 24 hours. You can change the maximum age, where n is the specified number of seconds. To improve performance, increase the cache age. However, as a result, you receive JavaScript updates from Salesforce less frequently because the updates occur when the cache is cleared. Here, the cache refreshes every three days.
<script src="https://embeddedlogin-dev-ed.my.site.com/demo/servlet/
servlet.loginwidgetcontroller?type=javascript_widget&cacheMaxAge=259200" async defer></script>

Embedded Login supports localization. For example, it localizes the login form based on browser settings. All labels, errors, and actions match the browser’s language setting.