---
schema_version: "1"
id: 2811c279e47a4c805df30bb64334603668ef6f18d13363aa44171e800da72218
title: Passwordless Login Coding Considerations
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/external_identity_passwordless_login_considerations.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.external_identity_passwordless_login_considerations.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: bf5c3aad88fb397cad31f591fcd31fe7e798336b88d3467ef7aadedf63f580ff
description: Review these tips and suggestions before implementing passwordless login.
products:
  - Security
  - Cross Cloud
release: "264"
---
# Passwordless Login Coding Considerations

Review these tips and suggestions before implementing passwordless login.

Check whether the user is verified

Users must be registered and verified before they can log in without a password. They must have a verified phone number to log in with an SMS one-time password. Or, they must have a verified email address to log in with an email one-time password.

You can determine identity verification from the user interface or API. See [View Your Users' Identity Verification Methods](https://help.salesforce.com/s/articleView?id=xcloud.external_identity_passwordless_login_check_verified_users.htm&type=5&language=en_US).

View the verification methods that the user has registered

Determine the user’s verification methods with `TwoFactorMethodsInfo`.

Handle errors returned by `system.site.passwordlessLogin`

If the `system.site.passwordlessLogin` method returns an error because the user can’t be verified, handle the error. For example, redirect the user to an IdP, or use an alternate page to collect the password and invoke the `site.login` method.

Get more identity information after a user logs in

Set up a login flow to kick off after the user logs in, for example, to register a phone number. Use the `System.UserManagement` register and deregister methods to manage user verification registration.

Make sure a user’s email address and mobile phone number are unique

The User object stores the email address and phone number in `User.Mobilephone` and `User.Email`, respectively. But these fields aren’t unique. To ensure uniqueness, store a copy of the email and phone in a unique field, such as `User.CommunityNickname`. Or create a custom field to store the values.

Get two verification methods for each user (for recovery)

We recommend that your users have two verification methods, for example, a phone number and password, or phone number and email address. You can collect this information when users sign up. Or you can collect the information on subsequent logins using a login flow.

Make sure that the phone number is in a format that Salesforce expects

Use the `System.UserManagement.formatPhoneNumber` method to ensure that the phone number is formatted correctly.

Determine how the login controller logs in the user

When implementing passwordless login, build the login controller to locate the user based on the identifier entered on the login page. Then check which verification methods the user has registered. Set up the controller to invoke the login process by whichever mechanism is configured, for example, passwordless login, SSO, or social sign-on.

You can completely remove passwords

Assign users the Is Single Sign-On Enabled user permission. This user permission is available when your org is enabled for delegated authentication—contact Salesforce to enable it. After you enable the feature, you can assign users the permission.