Browser-based login
Native embedded login
If you prefer to embed your own login pages within your native/mobile app, you can implement our login widget, Lock, directly into your app with: Examples of native apps with embedded login:Passwordless
Embedded Passwordless Login in Native ApplicationsConsiderations
- Phishing/security concerns: an unauthorized party could decompile or intercept traffic to/from your application to get the and authentication URL. With this information the unauthorized party could create a rogue application, upload it to an application store, and use it to phish for usernames, passwords, and .
-
: users have to enter their credentials for each application.
- Can implement SSO with native apps by storing refresh tokens on a shared keychain, but this is not compliant with the OAuth 2.0 specifications.
- Takes more time to implement
- No automatic improvements when Auth0 adds new features, have to update app code to take advantage of new features vs UL
-
Not compliant with best practices
- RFC 8252 OAuth 2.0 for Native Apps: authorization requests from native apps should only be made through external user-agents, primarily the user’s browser
Native social login
You can add functionality to your native app letting users authenticate with social natively, within the application: Facebook Login: Sign In with Apple:Rate limits
Limits are only applied to requests related to the Native Social Login flows, which are identified based on the body of the requests with the following initial criteria:| Request Type | Body |
|---|---|
grant_type | urn:ietf:params:oauth:grant-type:token-exchange |
subject_token_type | http://auth0.com/oauth/token-type/apple-authz-code |
Limits for production tenants of paying customers
| Endpoint | Path | Limited By | Rate Limit |
|---|---|---|---|
| Get Token | /oauth/token | Any native social login request | 50 per minute with bursts up to 500 requests |
Limits for non-production tenants of paying customers and all tenants of free customers
| Endpoint | Path | Limited By | Rate Limit |
|---|---|---|---|
| Get Token | /oauth/token | Native social login requests and IP | 30 per minute |