Login flows after authentication
Key Takeaway
A login flow adds steps after Salesforce authenticates a user and before the user reaches the org, so it doesn't replace authentication. The flow runs for users with the profile it's associated with, and it works with every Salesforce authentication method, including username and password.
A login flow is a process that runs right after Salesforce authenticates a user and before the user reaches the org or Experience Cloud site. The flow adds steps to login, such as enforcing strong authentication, collecting user information, or asking users to accept terms of service. Login flows matter because they let an admin require extra steps at login without changing how users authenticate.
What a login flow does
A login flow doesn't replace the existing Salesforce authentication process. Salesforce authenticates the user first. Then the login flow adds new steps or asks the user for information.
If the user completes the flow, they're redirected to their org or Experience Cloud site. If they don't complete it, the flow can log them out immediately.
While a login flow runs, the user has restricted access. The user can access only the flow and can't bypass it to reach the application. They get into the org only after they authenticate and complete the flow.
If the "Render Flow in Lightning Runtime" setting is enabled, users in a login flow can use Salesforce functionality before they complete the flow. Because that unauthorized access is a security risk, Salesforce recommends not enabling this setting when you use a login flow to enforce security.
Dana's profile has a login flow that asks users to accept updated terms of service. Dana enters her username and password, and Salesforce authenticates her. The login flow then shows her the terms. She can't skip the screen to reach the org. She accepts the terms and is redirected to her org. If she had declined, the flow could have logged her out immediately.