Buyer questions
Hosted login page or custom login UI: how to choose
The security and product trade-offs between redirecting to a hosted login page and building your own sign-in screen against an identity API.
The short answer
A hosted login page keeps passwords and MFA off your application entirely, gets security updates without your release cycle, and lets OpenID Connect handle the integration; the cost is a redirect and less control over the screen. A custom UI against an identity API gives full control of the experience, but your front end now handles credentials and you own more of the attack surface.
Sources last reviewed .
Choose hosted when
- You want the smallest credential-handling surface in your own code.
- Several applications share sign-in (SSO across your own products).
- You expect passkeys, SSO or new MFA methods to arrive without front-end rework.
Choose custom when
- Sign-in is embedded in a flow where a redirect is unacceptable.
- You need control of every pixel and are prepared to keep the security behaviour equivalent.
- Native apps, where RFC 8252 still recommends the system browser for third-party providers — custom UI makes most sense for first-party APIs.
In Authreads
How this applies to Authreads
Both paths are Available in Authreads: hosted login over OpenID Connect, with per-tenant branding, and a first-party API for products that build their own login screen.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.