• Cert++
  • Practice
  • Certle
  • Review
  • Tracks
  • Checklist
  • Guides
  • Upgrade
Cert++
  1. Home
  3. Experience Cloud Consultant

Experience Cloud Consultant

Checklist progress

0/225Learned

Experience Cloud Consultant

Study Checklist

  • Platform Administrator
  • Platform App Builder
  • Platform Foundations
  • Platform Developer
  • Platform Administrator II
  • Agentforce Sales Consultant
  • Agentforce Service Consultant
  • Platform Data Architect
  • Platform Development Lifecycle and Deployment Architect
  • Platform Identity and Access Management Architect
  • Platform Integration Architect
  • Platform Sharing and Visibility Architect
  • Heroku Architect
  • B2C Solution Architect
  • Experience Cloud Consultant
  • Agentforce Field Service and Operations Consultant
  • Agentforce Nonprofit Consultant
  • Data 360 Consultant
  • Omnistudio Consultant
  • CRM Analytics and Einstein Discovery Consultant
  • Platform User Experience Designer
  • Platform Strategy Designer
  • B2C Commerce Developer
  • JavaScript Developer
  • Omnistudio Developer
  • Platform Developer II
  • Marketing Cloud Engagement Administrator
  • Marketing Cloud Engagement Specialist
  • Marketing Cloud Engagement Consultant
  • Agentforce Sales Foundations
  • Business Analyst
  • Marketing Cloud Engagement Developer
  • Marketing Cloud Engagement Foundations
  • Agentforce Specialist
  • Agentforce Life Sciences Consultant
  • B2B Commerce Administrator AP
  • B2B Commerce Developer AP
  • Agentforce Consumer Goods AP
  • Agentforce Financial Services AP
  • Agentforce Health AP
  • Agentforce Manufacturing AP
  • MuleSoft Integration Foundations
  • MuleSoft Developer
  • MuleSoft Developer II
  • MuleSoft Platform Integration Architect
  • MuleSoft Platform Architect
  • Tableau Desktop Foundations
  • Tableau Data Analyst
  • Tableau Consultant
  • Tableau Server Administrator
  • Tableau Architect

Checklist progress

0/225Learned

  • When should a company choose Experience Cloud over a standalone website for delivering customer-facing content?
  • A company wants to provide its customers with a branded self-service portal where they can submit cases, view their order history, and access knowledge articles. Which Experience Cloud use case does this best represent?
  • A manufacturing company needs a digital space for its resellers to register deals, view shared price books, and collaborate on opportunities. Which primary use case for Experience Cloud applies?
  • What are the primary business drivers for building an employee community rather than using an internal intranet tool outside of Salesforce?
  • A company is evaluating whether to use Salesforce Sites or Experience Cloud for a public-facing web presence. What are the key differences that would lead a consultant to recommend Experience Cloud?
  • What distinguishes an external user persona from an internal Salesforce user in the context of Experience Cloud?
  • Which user personas are most commonly associated with a Partner Community Experience?
  • A financial services company is building an Experience Cloud site. Which personas would most commonly require a Customer Community license versus an internal Salesforce license?
  • When an external user logs into an Experience, their access to records is controlled through their relationship to which Salesforce object?
  • How does a Person Account differ from a Business Account when used in an Experience Cloud context?
  • A company sells B2C and wants each individual customer to have their own portal login tied directly to their contact record. Which account type should be used and why?
  • What is the purpose of the Administration workspace within Experience Builder?
  • What distinguishes the Builder workspace from the Administration workspace in Experience Cloud setup?
  • What tasks can be completed in the Administration workspace within Experience Builder?
  • A consultant is setting up a new Experience Cloud site. Which workspace allows them to configure the site's login experience, self-registration, and password policies?
  • What is the difference between the 'Preview' status and the 'Active' (published) status of an Experience Cloud site?
  • Who can access an Experience Cloud site in Preview status versus Active (published) status?
  • A community manager wants to publish new content, manage featured topics, and view content reports without accessing Setup. Which workspace should they use?
  • Which Experience Cloud workspace provides access to moderation rules, flagging, and member reporting?
  • What are the available Experience Cloud user visibility settings?
  • What is the default behavior for Experience Cloud user visibility when no visibility override is applied?
  • What does enabling 'Allow members to see each other' do in Experience Cloud?
  • What types of portals should explicitly have 'Allow members to see each other' disabled?
  • A company wants portal users to only see other members who belong to the same account. Which user visibility setting should the consultant configure?
  • An Experience Cloud site is set up for a healthcare network. Patients should never see each other's profiles. Which user visibility option prevents this while still allowing community managers to see all members?
  • How does the org-wide default (OWD) for an object interact with Experience Cloud sharing when the OWD is set to Private?
  • A consultant needs portal users to view Cases associated with their Account but not Cases belonging to other Accounts. Which sharing mechanism enforces this?
  • A retail company wants all authenticated portal users to see a shared catalog of Products, regardless of their account. Which sharing approach allows this without opening up all records?
  • An external user with a Customer Community license is unable to see a custom object record that an internal user shared with them. What is the most likely cause?
  • What sharing mechanisms are available declaratively for Experience Cloud sites?
  • When would each declarative sharing mechanism be appropriate for an Experience Cloud site?
  • What is the purpose of a Share Group in Experience Cloud?
  • Which Experience Cloud license types support Share Groups?
  • When should a consultant use a Sharing Set versus a Share Group for Experience Cloud object access?
  • How do guest user sharing rules differ from standard sharing rules in Experience Cloud?
  • What object access can guest user sharing rules grant to unauthenticated visitors?
  • A company needs partner users to see Opportunities owned by members of their partner account but not Opportunities belonging to other partner accounts. Which declarative sharing tool should be used?
  • A consultant wants to allow Customer Community Plus users to share specific records with other external users using manual sharing. Which configuration prerequisite is required?
  • A Sharing Set has been configured to grant Customer Community users Read/Write access to Cases linked to their Contact. A user reports they cannot edit a Case. What configuration would most likely resolve this?
  • How does the Account Contact Relationship (ACR) model differ from the standard Account-Contact relationship in Experience Cloud access control?
  • A global company has distributors who work with multiple manufacturer brands within a single portal. Which feature allows a single Contact to be associated with multiple Accounts in Experience Cloud?
  • A partner user needs to view records from two different partner accounts. The company does not want to duplicate the contact record. Which Experience Cloud feature supports this requirement?
  • What is the key functional difference between the Customer Community license and the Customer Community Plus license in terms of sharing capabilities?
  • What are the limitations of the Customer Community license compared to Customer Community Plus when it comes to sharing records with external users?
  • Which Experience Cloud license type supports role-based sharing and manual sharing of records?
  • Which Experience Cloud license types allow external users to be given a role in the role hierarchy, enabling them to roll up data and share with subordinates?
  • Why does role-based and manual sharing matter in a partner portal context?
  • What are the differences between the External Apps license and the Customer Community license in terms of feature access and object support?
  • A company wants to give high-value B2C customers the ability to view cases, update their own profile, and access exclusive content. They want the most cost-effective license. Which license should be recommended?
  • A manufacturing company needs its dealers to register leads, manage their own pipeline, and access shared price books. Their portal requires role-based sharing with hierarchy. Which license type is required?
  • A company needs external users who can view and edit standard objects like Cases and custom objects, collaborate in forums, and have role-based record sharing. Which license type should be used?
  • A company expects extremely high portal traffic from millions of anonymous and low-interaction authenticated users. Which license type is optimized for high-volume, low-CRM-interaction external users?
  • A nonprofit needs volunteers to log hours, view their donation history, and interact with other volunteers in discussion forums. Which license type supports this use case at minimum cost?
  • A B2B company wants partner users at different partner firms to never see each other's opportunities, even if they are in the same Experience. Which combination of settings enforces this?
  • An Experience Cloud site requires that some users see a broader set of records than their account relationship would normally permit. The company wants to avoid code. Which sharing tool should be recommended?
  • A healthcare portal requires that patient data is never visible to other patients and that providers can only see data for patients they are assigned to. How should the consultant configure the security model?
  • What roles are available to external users in Experience Cloud?
  • How do external user roles in Experience Cloud differ from internal Salesforce roles?
  • How does the role of a Customer Community Plus user interact with the role hierarchy?
  • When a new Customer Community Plus user is created, how is their role determined?
  • How does super user access work for partner account-level users?
  • A partner user needs to share an Opportunity with a subordinate user at the same partner firm. Which license type and role configuration enables this?
  • What is the difference between modifying a page layout in Experience Builder versus modifying a component's properties?
  • A consultant needs to update the color scheme and logo of an Experience Cloud site without involving a developer. Which tool should be used?
  • How does page variation work in Experience Builder?
  • When should a consultant use page variation instead of creating a new page in Experience Builder?
  • What types of items can be added to a Navigation Menu in Experience Builder?
  • Which Navigation Menu item types in Experience Builder support external URLs?
  • A company wants different content displayed to authenticated users versus guest users on the same page. Which Experience Builder feature supports this without custom code?
  • What criteria can be used to define an Audience in Experience Builder for content personalization?
  • What objects or fields can be referenced when defining an Audience in Experience Builder?
  • A company wants to apply audience-based personalization so that VIP customers see a different homepage banner than standard customers. Which Experience Builder feature enables this?
  • A company wants to show different navigation menu items to partner users versus customer users on the same Experience Cloud site. What is the recommended approach?
  • What objects and content types are searchable within an Experience Cloud site by default?
  • What controls the scope of search results within an Experience Cloud site?
  • What is the Global Search for Peer-to-Peer Communities component?
  • How does the Global Search for Peer-to-Peer Communities component differ from the standard Search Bar component in Experience Builder?
  • A company wants to ensure that guest users can search for publicly available knowledge articles but cannot search for account or contact records. How should search be configured?
  • A portal user reports that they can find knowledge articles via Google but not via the Experience search bar. What is the most likely cause?
  • How does federated search differ from standard Experience Cloud search?
  • When would a consultant recommend federated search for an Experience Cloud site?
  • What is a CMS channel in Salesforce CMS?
  • What types of content can be created and managed in Salesforce CMS for use in Experience Cloud?
  • Why must a CMS channel be configured before CMS content appears in an Experience Cloud site?
  • What is a CMS Collection in Salesforce CMS?
  • How can a CMS Collection be used to display a curated list of content items on an Experience Cloud page?
  • A marketing team wants to manage promotional banners in Salesforce CMS and have them appear dynamically in the Experience Cloud portal. What must be configured to make this possible?
  • A company wants to surface dynamic product content from Salesforce CMS on their Experience Cloud storefront without hardcoding individual items. Which CMS feature should be configured?
  • A company uses Salesforce CMS to manage content shared across multiple Experience Cloud sites. What is the benefit of using a shared CMS workspace in this multi-site scenario?
  • What must be enabled at the org level before Knowledge articles can be surfaced in any Experience Cloud site?
  • What must be done to make Salesforce Knowledge articles visible to guest (unauthenticated) users in an Experience Cloud site?
  • What profile permission is required for external users to read Knowledge articles in an Experience Cloud site?
  • How does Knowledge article data category visibility interact with Experience Cloud user profiles to control who can read specific articles?
  • A support portal displays knowledge articles, but certain premium articles should only be visible to users with a specific profile. How should this be configured?
  • A consultant is asked why authenticated portal users can see knowledge article titles in search results but receive an error when clicking through to read them. What is the most likely cause?
  • What is the difference between a theme and a template in Experience Cloud?
  • How do themes and templates interact in Experience Cloud?
  • Which settings can be customized within the Theme panel of Experience Builder?
  • A company wants to match its corporate brand — specific fonts, color palette, and button styles — across all pages in their Experience Cloud site without custom code. What is the recommended approach?
  • Which Experience Builder customizations require a custom component or CSS rather than the Theme panel?
  • What is an LWR (Lightning Web Runtime) template in Experience Cloud?
  • What are the primary advantages of LWR templates over Aura-based templates in Experience Cloud?
  • What is the primary functional difference between the Customer Service (Napili) template and the Build Your Own (Aura) template?
  • What is the Salesforce Tabs + Visualforce template in Experience Cloud?
  • A company needs a self-service portal for customers to submit and track cases. They want a responsive, modern UI. Which Experience Cloud template is most appropriate?
  • A company needs a partner portal with deal registration, lead sharing, and co-branded marketing content. Which template best suits this use case?
  • A company's developer team wants full control over layout and custom LWC component placement. Which template type allows the most flexibility?
  • A company needs a simple, public-facing help center with structured FAQ articles and case submission. Which out-of-the-box Experience Cloud template provides this pattern with the least configuration effort?
  • Which Experience Cloud template would be most appropriate for a microsite with minimal Salesforce data integration but high design customization needs?
  • In what situation would a consultant still recommend the Salesforce Tabs + Visualforce template?
  • A company built their portal on an Aura template two years ago and is considering migrating to LWR. Which considerations should the consultant raise before recommending migration?
  • What is the process for exporting a customized Experience Cloud template so it can be reused in another org?
  • A company has invested heavily in customizing a portal template and wants to deploy that template to a new sandbox. What is the recommended approach?
  • What are the limitations of exporting an Experience Cloud template — what is and is not included in an exported template package?
  • What is a Lightning Bolt in Experience Cloud?
  • How does a Lightning Bolt differ from exporting just a template in Experience Cloud?
  • Which components are included in a Lightning Bolt solution package that would not be included in a simple template export?
  • A partner wants to package their entire Experience Cloud solution — including flows, custom objects, and the template — to distribute to clients. Which packaging mechanism should they use?

Describe the different ways users can be created, such as manual, Data Loader, Self-Registration, and Just-in-Time (JIT) provisioning.

0/9

  • What are the available methods for creating external users in Experience Cloud, and what are the typical use cases for each?
  • What happens by default when a new user self-registers on an Experience Cloud site?
  • What are the requirements for enabling self-registration on an Experience Cloud site?
  • A company wants to use a custom registration flow built with Salesforce Flow instead of Apex for self-registration. What must be configured to wire the flow to the Experience Cloud site's registration?
  • Which Apex class must be implemented to customize the account and contact created during self-registration on an Experience Cloud site?
  • What is Just-in-Time (JIT) provisioning in Experience Cloud?
  • How does Just-in-Time (JIT) provisioning differ from self-registration in Experience Cloud?
  • A company uses an external identity provider and wants portal user records created automatically on first login without pre-creating them in Salesforce. Which method supports this?
  • A company expects thousands of new portal users per day through a consumer app. Manual creation is not feasible. Which user creation method should be recommended?

Given a scenario, determine how to properly set up a user for an Experience.

0/5

  • A company needs to give a supplier contact access to their Experience Cloud portal. The contact record already exists in Salesforce. What steps must be taken to enable this user?
  • A B2C company wants each customer to have access only to their own portal site, not a partner portal. Which profile should be assigned to these users?
  • What is the purpose of a login flow in Experience Cloud?
  • What use cases does a login flow address that cannot be handled by standard authentication alone?
  • An external user account was created but the user cannot log in. The consultant verifies the user is active and has a password. What else should be checked?

Describe options for Single Sign-On.

0/8

What is the difference between SAML-based SSO and OAuth-based SSO in the context of Experience Cloud authentication?

Learn this concept
Unseen

What is the relationship between a Connected App and SAML SSO in Experience Cloud?

Learn this concept
Unseen

Which Connected App settings are required to enable inbound SAML SSO for portal users?

Learn this concept
Unseen

What is Social Sign-On in Experience Cloud?

Learn this concept
Unseen

What are the requirements to enable Social Sign-On in Experience Cloud?

Learn this concept
Unseen

A company wants to allow portal users to sign in with their Google or Facebook accounts. What must be configured in Salesforce to enable social sign-on through an external authentication provider?

Learn this concept
Unseen

A company wants portal users to authenticate using their corporate Active Directory credentials without creating a Salesforce password. Which SSO approach should be implemented?

Learn this concept
Unseen

A company already uses Salesforce internally and wants portal users to log in using the same corporate Salesforce org via SSO. Which configuration should be recommended?

Learn this concept
Unseen

Apply the steps for enabling partner and customer users for Experiences.

0/3

  • What is the difference between enabling a user as a 'Customer User' versus a 'Partner User' in Experience Cloud from a licensing and capability standpoint?
  • What must be done at the Account level before a Contact can be enabled as a partner user in Experience Cloud?
  • A consultant is enabling a contact as an Experience Cloud customer user. What is the correct sequence of steps?

Identify how to grant users access to an Experience.

0/5

  • Which methods can be used to grant an external user access to a specific Experience Cloud site?
  • How does granting access via a Permission Set differ from granting access via a Profile in Experience Cloud?
  • When is Permission Set preferred over Profile for granting Experience Cloud access, and vice versa?
  • A company has multiple Experience Cloud sites. They want certain partner users to access only one specific site. How is this controlled?
  • A portal user was enabled and their profile is associated with the Experience. They still cannot access the site. What is the most likely missing configuration?
  • What is Experience Cloud Insights?
  • What types of metrics does Experience Cloud Insights provide out of the box?
  • What must be enabled or configured before Experience dashboards are available to community managers?
  • A community manager wants to track page views, logins, and top content in the Experience Cloud portal. Which feature provides this capability natively?
  • A company wants to embed a custom Salesforce report or dashboard in their Experience Cloud site for partner users to track their own performance. What is required?
  • What are the available moderation tools in Experience Cloud?
  • What types of community behavior can Experience Cloud moderation tools address?
  • What is the difference between a moderation rule that flags content and one that blocks content in Experience Cloud?
  • A company's portal allows user-generated content and they need to automatically flag posts containing competitor brand names. Which moderation feature supports this?
  • A community manager wants to give trusted members the ability to moderate posts from other members without giving them admin access. Which feature enables this?
  • How does the Reputation system work in Experience Cloud?
  • What configuration is required to award Reputation points and assign levels to community members in Experience Cloud?
  • What are Recognition Badges in Experience Cloud?
  • How do Recognition Badges differ from Reputation points as engagement tools in Experience Cloud?
  • Which Experience Cloud features are most effective for driving ongoing user engagement after initial launch?
  • A nonprofit wants to recognize top-contributing volunteers in their portal community. Which Experience Cloud feature supports this gamification goal?
  • A company launched an Experience Cloud portal 3 months ago but sees very low user return rates. Which adoption strategies should be recommended?
  • What is Partner Relationship Management (PRM) in Experience Cloud?
  • What core objects does PRM leverage?
  • How does Lead Distribution work in PRM?
  • What must be configured before a vendor can push leads to partner users in PRM?
  • What is Market Development Funds (MDF) in PRM?
  • How do partner users interact with MDF requests in the partner portal?
  • What is Channel Account Manager access in PRM?
  • How does Channel Account Manager access allow internal users to collaborate with partner users in a PRM site?
  • A company wants to allow authorized resellers to register new deals and have those deals auto-converted to opportunities assigned to the vendor's internal team. Which PRM feature supports this?
  • A company using PRM wants to give different partner tiers different visibility into product pricing and promotional materials. Which feature enables this tiered content delivery?
  • What deployment options are available for an Experience Cloud site?
  • When would a consultant recommend each deployment option for an Experience Cloud site?
  • A company wants to migrate their Experience Cloud site from a sandbox to production. Which tools or processes should be used?
  • A company has built a complex Experience Cloud site with custom themes, pages, and components. What metadata types should be included in the deployment package?
  • What are the limitations of deploying Experience Cloud metadata via Change Sets?
  • When would a Salesforce DX (source-driven) approach be preferred over Change Sets for Experience Cloud deployment?
  • What is the difference between publishing and activating an Experience Cloud site?
  • What steps must be completed before an Experience Cloud site can be activated and made available to external users?
  • An Experience Cloud site is visible in the org but external users receive an error when navigating to the URL. What should the consultant check first?
  • A consultant publishes changes to the Experience Cloud site but users report they still see the old version. What is the most likely cause?
  • What is Delegated External User Administration?
  • Which license types support Delegated External User Administration?
  • What permissions must be granted to a partner user for them to act as a Delegated External User Administrator for their account?
  • A large retailer has account managers who need to onboard new portal users for their assigned accounts without involving the Salesforce admin team. Which feature should be implemented?
  • A company wants partner account managers to be able to reset passwords and deactivate portal users, but only for users within their own account. Which configuration enables this with the least privilege?
  • What is the Guest User profile in Experience Cloud?
  • What configuration is required to allow unauthenticated (guest) users to access an Experience Cloud site?
  • What are the limitations of the Guest User profile in terms of object access and sharing?
  • What security controls should a consultant review when configuring a public Experience Cloud site to prevent unauthorized data exposure through the Guest User profile?
  • A company wants to build a public-facing help center where anyone can read knowledge articles without logging in. What must be configured to enable this?
  • A company wants guest users to be able to submit cases without logging in. What is required to enable case creation by unauthenticated users in Experience Cloud?
  • A consultant enables guest access on an Experience Cloud site. Users report that some page components are showing errors for unauthenticated visitors. What is the most likely cause?
  • What are Topics in Experience Cloud?
  • What is the difference between navigational topics and featured topics in Experience Cloud?
  • When should a consultant use navigational topics versus featured topics in Experience Cloud?
  • How do Topics in Experience Cloud differ from data categories used in Knowledge?
  • A company wants to automatically organize posts and articles around their product lines in the Experience Cloud portal. Which feature should be configured?
  • How can a consultant control which topics appear in the portal's navigation versus which are used for content tagging only?
  • How can an Experience Cloud portal be configured to allow customers to submit cases directly from the portal?
  • What is Embedded Service in Experience Cloud?
  • How does Embedded Service integrate live chat or chatbot capabilities into an Experience Cloud portal?
  • What is a Prechat Form in the Embedded Service deployment for Experience Cloud?
  • What data can a Prechat Form collect before connecting a customer to chat in Embedded Service?
  • A company wants to deflect support cases by surfacing knowledge articles before a customer submits a case in the portal. Which out-of-the-box Experience Cloud component supports this pattern?
  • A company wants portal users to see all open and closed cases for their account, not just ones they personally submitted. What must be configured?
  • A company wants to embed an Einstein Bot on their Experience Cloud portal to handle common customer inquiries before escalating to a live agent. What must be configured to enable this?
  • How does entitlement management interact with Experience Cloud to control which support channels or response SLAs a customer sees in the portal?
  • Which standard Salesforce features or objects are not available or have restricted functionality for external users in Experience Cloud?
  • What are the key limitations of the Customer Community license type compared to full Salesforce licenses in terms of objects and features accessible in an Experience?
  • What prerequisite org-level feature must be enabled before Knowledge articles can be surfaced or searched in any Experience Cloud site?
  • What are the limitations of using standard Salesforce reports and dashboards in an Experience Cloud site for external users?
  • What customization options are available for the Experience Cloud login page?
  • What are the limitations around using flows in Experience Cloud for guest (unauthenticated) users versus authenticated users?
  • What are the limitations on custom domain configuration for Experience Cloud?
  • A company wants to add a custom domain (e.g., portal.company.com) to their Experience Cloud site. What Salesforce prerequisite is required before a custom domain can be applied?
  • What is the maximum number of active Experience Cloud sites that can exist in a single Salesforce org, and what happens when that limit is reached?
  • A consultant is scoping a project that involves external users creating and editing records on custom objects. Which license limitations must be communicated to the customer upfront?
  • A partner user reports that they cannot use the Salesforce mobile app to access the Experience Cloud portal. What is the correct explanation?
  • A company has a managed package that includes Aura components critical to their portal. They are evaluating moving to an LWR template. What is the primary limitation to communicate?
  • Which standard Experience Builder components are only available on specific templates and cannot be used interchangeably across Aura and LWR templates?

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Experience Cloud Consultant studiers.

Go to Discord

A company already uses Salesforce internally and wants portal users to log in using the same corporate Salesforce org via SSO. Which configuration should be recommended?

Explainer

Learn More

Practice Question

Keep going

Next conceptWhat is the difference between enabling a user as a 'Customer User' versus a 'Partner User' in Experience Cloud from a licensing and capability standpoint?

Checklist progress

0/225 (0%)

0 of 225 concepts learned

Tip: You can filter concepts by status.

Prepare for the Exam

Play Today's Certle
Back to track

Study Community

Ask questions and get the latest info from other Experience Cloud Consultant studiers.

Go to Discord

Explainer

When a company already uses Salesforce internally and wants Experience Cloud portal users to log in using the same corporate Salesforce org, SAML SSO between Salesforce orgs provides the solution. The corporate org acts as the identity provider, authenticating users once so they can access the portal as a service provider without separate credentials.

Core information
  • SAML SSO between Salesforce orgs and Experience Cloud sites uses a hub-and-spoke architecture where one org or site acts as the identity provider and others act as service providers.
More details and nuances
  • When implementing SAML SSO for Experience Cloud sites, the site URL associated with login must be used for the SSO flow, and the site URL in the SAML assertion POST must include /login.