# Universal Login choices

## New Universal Login (default)

Hosted by Auth0, rendered from your tenant. Customize branding (logo, colors, fonts) in Dashboard > Branding > Universal Login, no code. This is the right default: Auth0 handles bot detection, breached-password warnings, MFA enrollment UI, and security patches.

Identifier-first, organization picker, and passkey options are configured here.

## Classic Universal Login (legacy)

The old Lock.js-based hosted page. Only relevant if you have legacy customizations that the new experience cannot reproduce. New work should not target it.

## Embedded login (Lock.js / auth0.js in your app)

Your page hosts the login form and calls the API directly. Downsides agents underestimate:

- Cross-origin authentication: the login call is cross-origin, which needs Allowed Web Origins and breaks under ITP/cookie blocking in Safari.
- You own the security surface: phishing resistance, bot detection hooks, and password-breach checks that the hosted page gives you for free.
- SSO across your apps does not come for free; the hosted page sets the SSO cookie, your embedded form does not.

Choose embedded only when the product truly needs the form inline and you accept the tradeoffs.

## Customizing without breaking

- Branding > Universal Login: safe, upgrade-proof.
- Custom HTML on the new experience is limited by design; heavy custom login UI belongs in Actions (forms) or a fully custom page only after reading the tradeoffs above.
- Test every branding change in an incognito window; cached sessions hide breakage.

## Checklist

- Default to new Universal Login.
- Embedded only with eyes open about cross-origin auth and ITP.