Skip to main content

Documentation Index

Fetch the complete documentation index at: https://auth0.com/llms.txt

Use this file to discover all available pages before exploring further.

When you design the login experience for your application, you’ll need to decide if you want it to be hosted (Universal Login) or embedded.

​
Hosted login

In a hosted login flow, the application redirects the user to the to perform authentication, and then the authorization server returns the user to the application.

​
Universal Login flow

In the typical user authentication experience with :
  1. Your application triggers an authentication request by invoking an Auth0 SDK’s login method or by calling the Auth0 Authentication API Login endpoint directly.
  2. Your application redirects the user to the Auth0 authorization server (your Auth0 tenant).
  3. Auth0 checks for a session cookie on the Auth0 Session Layer.
    • If a session cookie is not found, Auth0 redirects the user to Universal Login to authenticate and creates an associated session cookie.
    • If a session cookie is found, Auth0 uses it to authenticate the user.
  4. Auth0 returns the user to your application with an ID token and an access token.

​
Embedded login

In an embedded login flow, the user authenticates directly within your application. The application serves the login form, collects the user’s credentials, sends that data to the authentication provider, and then receives a response with the user’s and . For web applications, embedded login uses cross-origin authentication unless you configure a custom domain for your Auth0 tenant. Cross-origin authentication uses third-party cookies to allow for secure authentication transactions across different origins.

​
Feature comparison

FeatureHostedEmbedded
Single Sign-onBuilt-in cross-application SSO through session cookies on the Auth0 Authorization Server (your Auth0 tenant), including support for third-party applications and multi-domain architectures.Supported with shared domain architecture. Web applications using the Lock or Auth0.js libraries can share sessions when configured under the same custom domain. Native applications can share sessions with web applications through Native to Web SSO.
CustomizationCustomize many parts of the experience through theming, page templates, text elements, and prompts, or use Advanced Customizations for Universal Login for full UI customization.Full control over the UI because the login form is rendered by your application.
Feature managementFeatures are managed centrally in the Auth0 Dashboard or through the Auth0 Management API and apply to all applications using Universal Login.

For example, when you enable MFA in the Dashboard, it is immediately reflected in subsequent logins.		Features are configured per application, giving you control over the release cadence in each app.

Server-side capabilities such as API-driven MFA can be enabled without client updates. UI-affecting changes (for example, a new login screen) are released on your application’s own schedule.
User experienceUsers are redirected between your application and the Auth0 Authorization Server during authentication.

For native applications, this requires implementation of universal/deep links.		Users remain inside your application during authentication, which can be useful for tightly branded or in-app sign-in experiences.
Security and maintenanceAuth0 delivers security updates to the login experience transparently.Auth0 provides the security building blocks (like custom domains, Cross-Origin Authentication, API-driven MFA, Native Passkey APIs and DPoP) and you choose when to roll updates out to your users.

​
Choosing between hosted and embedded login

Hosted and embedded login are not mutually exclusive. The same application can use Universal Login for some flows and embedded flows for others, picking the approach that best fits each part of the user journey.
  • Universal Login: Auth0 manages the login surface and is the default for primary sign-in, sign-up, and password reset. Auth0’s hosted solution also provides automatic security updates and coordinates SSO across third-party or multi-domain applications.
  • Embedded Login: Allows full control over the UI and keeps users inside your application. You can use Embedded Login for factor enrollment, step-up authentication, passkey registration with Passkey APIs, link connected accounts, or sign-in using Native Social Login.
Common hybrid patterns include:
  • A web application that uses Universal Login for sign-in and sign-up, then exposes embedded MFA enrollment and passkey management in account settings.
  • A native application that uses a browser-based redirect for primary authentication and embedded Passkey APIs for passwordless re-authentication.
  • A SaaS product that uses Universal Login for first-party employees and embedded flows inside a customer-facing app where in-app branding is critical.
For native applications, RFC 8252: OAuth 2.0 for Native Apps recommends external user-agents for browser-mediated flows. Modern embedded paths—such as Passkey APIs and Native Social Login—use protocol-compliant token exchanges that meet the same security goals while keeping the user inside the application, and they coexist with Universal Login in the same app.