---
schema_version: "1"
id: 569cf2e6653a519f4192a0743bf41ae1a78e31728361869d6f815bc30073c173
title: "Step 5: Handle the Embedded Login Callback"
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_identity_login_step_5.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_step_5.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 2c22315c736fe7033a69477fce67adfd72a6824ad1b27d8cef3ead51ae1e632b
description: When a user logs in to a website, the Embedded Login callback URL receives the access token and uses it to retrieve user information. Both the access token and user information can be stored to local storage. Depending on your implementation, you can create a callback to handle the response on either the website (client) or the server.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Step 5: Handle the Embedded Login Callback

When a user logs in to a website, the Embedded Login callback URL receives the access token and uses it to retrieve user information. Both the access token and user information can be stored to local storage. Depending on your implementation, you can create a callback to handle the response on either the website (client) or the server.

![Warning](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_warning.png)

Warning In Summer ’24, Salesforce made Embedded Login disabled by default. We recommend that you use the [web server flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_web_server_flow.htm&type=5&language=en_US), the [user-agent flow](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_user_agent_flow.htm&type=5&language=en_US), or another redirect-based OAuth 2.0 flow instead of Embedded Login.

Embedded Login relies on third-party cookies, which are blocked or restricted in most browsers. And Embedded Login works only on Google Chrome and only as long as third-party cookies are allowed there by default.

Way back in Step 2, when you created a connected app, you supplied the URL to this callback. The callback is mainly for security, and it’s used to receive the access token. It then uses the token to fetch user information from Salesforce and write the information to the local storage, which is on the site domain. After writing user information to local storage—which is equivalent to a successful login—the callback redirects the user back to the index page.

The main difference between a client-side and server-side callback is how the access token is received. For a normal client-side callback that’s a web page, the callback receives the access token. For a server-side callback, the server gives the callback a one-time code. Then the callback exchanges the code for an access token.

For server-side callbacks, after using the access token to get the user information, the server writes the information out to the served file, such as an HTML file. After the user information is read on the client, it’s written to local storage, which is on the site domain.

For more information about the login authorization process and relationship between the callback and connected app, see [Embedded Login Advanced Features](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_advanced_topics.htm&release=264.0.0&type=5 "Embedded Login takes care of authenticating users so that you can add login capabilities to a web page without worrying about the details. You can also take advantage of the advanced features that Salesforce offers.").

- **[Create an Embedded Login Client-Side Callback](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_client_callback.htm&release=264.0.0&type=5)**  
    To create a client-side callback, you add a web page to your website and specify a few Embedded Login meta tags inside the `<head>` HTML element.
- **[Create an Embedded Login Server-Side Callback](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_login_server_callback.htm&release=264.0.0&type=5)**  
    Use the server-side callback instead of a client-side callback web page to avoid exposing the access token on the client. To create a server-side callback, use the OAuth 2.0 web server flow.