A hosted login page instead of login forms in your app
A hosted login page is a sign-in page that your identity provider serves: your application sends users to it and gets them back signed in. It beats building login forms into your app because security fixes, passkeys, multi-factor authentication and SSO all live in one place that changes without a release of yours. The Skycloak Platform is built to serve that page for each of your tenants, on its own sign-in address or on your domain.
How a hosted login page works
When a user clicks sign in, your application redirects the browser to the hosted login page with an OpenID Connect request that says which app is asking and where to send the user back. The user signs in on that page, and the browser returns to your app with an authorization code, which your backend exchanges for tokens. OAuth 2.1 requires PKCE (proof key for code exchange) on this flow, which ties the code to the request that started it so that an intercepted code cannot be used. Your application never sees the password and only has to check the tokens it receives.
Every environment of your product, such as production, staging and development, is a tenant on the Platform with its own users, settings and sign-in address on skycloakid.com. Custom domains are on the plan, so you can put the page on an address of your own and your users sign in on a name they recognise. A tenant's sign-in messages, such as password resets, go out from its own subdomain, which keeps them apart from what your other tenants send.
Why a hosted page beats login forms in your app
A login form looks small, but behind it sit password storage, limits on password guessing, account recovery, MFA enrollment and protection against credential stuffing, which is attackers trying passwords leaked from other sites. If that code lives in your app, every fix to it waits for your next release, and on mobile it also waits for users to update. With a hosted login page, a security fix to the sign-in flow reaches every user the next time they sign in, without a change on your side.
The same holds for new sign-in methods. When passkeys or a new MFA option arrive on the page, every app that redirects to it can offer them, instead of your web, mobile and desktop apps each building the feature separately. Your users also get one consistent sign-in across your products, and because the page keeps a single sign-on session, signing in to one of your apps signs them in to the others.
One place for passkeys, MFA and enterprise SSO
Passkeys, multi-factor authentication and a breached password check against the Have I Been Pwned data are on the Platform's plan for the hosted login page. If that breach service cannot be reached, sign-in still goes ahead and the password is checked against a local copy of the data, so an outage elsewhere does not lock your users out. Because all of this runs on one page, you configure a sign-in method once for a tenant rather than once in every app.
Enterprise SSO over SAML is planned too, so when one of your business customers wants its staff to sign in through its own identity provider, the hosted page sends those users there and your application code stays the same. Organizations and roles per organization keep each business customer's users and permissions apart. A demo shows the page itself and which of these methods you can use on it today.
Frequently asked questions
Can the hosted login page use my own domain?
Custom domains are on the Platform's plan. Each tenant starts with a sign-in address on skycloakid.com, and you can add a domain of your own on top of it so users sign in on an address they recognise.
Does my application ever see the user's password?
No. The user types the password, or uses a passkey, on the hosted login page, and your application receives only an authorization code that it exchanges for tokens.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.