1. Setting up default authentication for portals

Zoho Creator offers two default authentication methods for portal users to sign in:

1. Creator-managed authentication: Portal users sign in using credentials managed directly in Zoho Creator. You can set the authentication type to email address, mobile number, or either. By default, it is set to email address.
   
2. Federated login: Portal users sign in using their existing third-party accounts, eliminating the need for separate portal credentials. The supported third party logins include Google, Facebook, Apple, and LinkedIn.
   

2. Steps to configure default authentication with Creator managed credentials

Creator supports three authentication credential options: email address, mobile number, or either. When Mobile Number/Email Address option is selected, the credential type can be selected by the admin during portal user addition or chosen by portal users during their sign-up. By default, the authentication type is set to email address, which can be changed based on requirement.

During sign-up, portal users enter their email address or mobile number along with a password, which will be required to access the portal going forward.

Once a portal user sets up their password using ‘Reset Password’, they will no longer be able to use OTP to sign in to the portal. Moving further, they can only sign in using their mobile number and password.

Note: Mobile-based authentication options (Mobile Number / Email Address, and Mobile Number) are currently available only in the IN and US data centers for Indian mobile numbers (+91), and can be configured only after Zoho Creator SMS is configured and SMS templates are assigned to the portal.

To set the default authentication type of a portal:

1. Click Portal under DEPLOY in the left pane of the Zoho Creator admin dashboard and select the required portal. If no portals exist, create a new portal before proceeding.
   
   
2. Navigate to the Authentication tab in the top bar and click Edit in Default Authentication to change the authentication type.
   
3. Select the required authentication type from the following:

1. Email Address: Portal users sign in using their email address.
   
2. Mobile Number: Portal users sign in using their mobile number.
   
3. Email Address or Mobile Number: Admin or portal users can choose which credential the portal user uses to sign in during portal user addition or sign up respectively based on the portal type.
   
   

4. Select Save.
   

Note: Portal users can only sign in using the method they originally used to create their account. If you restrict authentication to a single credential type, any user who signed up with a different method will be unable to access the portal. For example, switching to mobile number means portal users who signed up with an email address can no longer sign in, and will need to be added or signed up again with a mobile number.To avoid this, use the Mobile Number/Email Address type so all users can continue to sign in.

3. Steps to configure federated login providers

Federated login lets portal users sign in using an existing third-party account instead of creating separate credentials for the portal. Supported providers are Google, Facebook, Apple, and LinkedIn.

When enabled, it appears as an option on the portal’s sign-in page alongside the standard credential login. The federated login provider handles identity verification, and the user’s password is never seen or stored by Creator.

Set up federated login with:

1. Google
   
2. Facebook
   
3. Apple
   
4. LinkedIn
   

Copy Redirect URL in Zoho Creator

The Redirect URI is where the identity provider (e.g., Google, LinkedIn) sends the user back to the portal application they were trying to access after successfully signing in. Fetching and correctly configuring the redirect URI in the IdP is essential for ensuring security, preventing unauthorized redirects, maintaining user experience, and complying with the authentication protocols used in federated login setups.

To Copy Redirect URL in Zoho Creator:

1. Click Portals under DEPLOY in left pane of Zoho Creator admin dashboard.
2. Click the Authentication tab in the top pane, and click the required federated login service under Default Authentication.
   Alternatively, click the Settings icon to open the Federated Login pane, then click Add next to the required federated login.
   
3. Click Copy beside Redirect URL.
   

3.1 Registering a client in Google

In order to configure a federated login using a Google account, you need to register a client in the Google Developer portal.

Note: Copy the Redirect URL for Google from Zoho Creator before proceeding.

To add a new client:

1. Log in to https://console.developersgoogle.com/projectcreate with your account.
2. Enter a Project name and link with your Organization if necessary and click Create.
   
3. Click the hamburger menu in top left corner, select APIs & Service and then OAuth consent screen.
   
4. Select GO TO NEW EXPERIENCE on the OAuth consent screen page.
   
5. Click GET STARTED on the Google Auth Platform page you are redirected to.
6. Enter the Application Name and the User support email under App Information, then click Next.
   
7. Select External under Audience and click Next.
   
8. Enter your email address under Contact Information and click Next.
   
9. Tick the box to agree to Google’s API services user data policy, and click Continue. Then click Create.
10. Click CREATE OAUTH CLIENT in OAuth Overview page.
11. Click on the Configure consent screen button in the Create OAuth Client ID page you are directed to. Configuring your consent screen is a prerequisite.
12. Choose Web application in the application type drop down and enter the name of your Zoho Creator portal in the Name field.
    
13. Paste the Redirect URL copied from Zoho Creator in the Authorized redirect URIs field and click Create.
14. Copy the Client ID and Client Secret that will be displayed once a client is created.
    
    
    
15. Switch back to Zoho Creator and paste the Client ID and Client Secret copied from Step 14 and Click Save. Learn how to remove a federated login configuration.

Now, when a customer visits your portal, they will be displayed an option to sign in using their Google account. When clicked, they’ll be taken to the Google Sign In page. Once they enter the correct credentials, their account will be authenticated, and they can access their customer portal.

3.2 Registering a client in Facebook

In order to configure a federated login using a Facebook account, you need to register a client in Facebook.

Note: Copy the Redirect URL for Facebook from Zoho Creator before proceeding.

To add a new client:

1. Log in to developers.facebook.com and click Create App under My Apps.
   
2. Enter the Display Name and Contact Email and click Create App ID.
   
3. In the left pane, click Settings and then click Basic. Copy the APP ID (Client ID) and APP secret (Client secret) displayed here.
4. Click Settings under PRODUCTS in the left pane and paste the Redirect URL copied from Zoho Creator in the Valid OAuth Redirect URIs field.
   
5. Switch to Zoho Creator and configure the federated login by using the APP ID and APP Secret from Step 3.

3.3 Registering a client in Apple

In order to configure a federated login using an Apple account, you need to register a client (‘Service’ in Apple).

Note: Copy the Redirect URL for Apple from Zoho Creator before proceeding.

To add a new client, you need to :

Generate an App ID

Generating Services ID

Generating a key

Generate an App ID

1. Log in to Apple developer portal with your account.
2. Click Identifiers under the Certificates, Identifiers & Profiles section and click the Plus icon.
   

3. Choose App IDs and click Continue.
   
4. Select App and enter a description and Bundle ID for the App ID.
   
5. Scroll down through the list of capabilities, select the Sign In with Apple checkbox, and click Register. The App ID is displayed on this page.

Generating Services ID

Note: The Service ID can only contain alphanumeric characters and dots.

Next, we’ll be creating a Services ID. This Services ID will serve as your Client ID within the Federated login configuration pane in Zoho Creator.

6. Choose Identifiers from the side navigation in the Certificates, Identifiers & Profiles page and click the blue plus icon next to Identifiers. Choose Services IDs and click Continue.

7. Enter a description and identifier for the Services ID and click Register. The Service ID can only contain alphanumeric characters and dots.

8. Check the box next to Sign In with Apple and click Configure.

9. Paste the Redirect URL copied from Zoho Creator in the Web Authentication Configuration popup in the Return URLs field. Enter the domain of the Redirect URI in the Domains and Subdomains field.

Ensure your associated App ID is chosen as the Primary App ID. If this is the first App ID you’ve made that uses Sign In with Apple, then it will probably already be selected.

10. Click Next and then Continue and Register until this step is completed. The Identifier displayed here is your Services ID.

Generating a key

11. Click Keys from the side navigation in the main Certificates, Identifiers & Profiles screen. Click the blue plus icon next to Keys.

12. Enter a name for your key in the Register a New Key page. Check the Sign in with Apple option and click the Configure button adjacent to it.

13. Select your primary App ID in the Configure Key tab. Then click Save.

Apple will generate a new private key for you and let you download it only once. Please download and safely store the .p8 file. Also note that the Key ID displayed here will be required later. Click Done.

Switch back to Zoho Creator and finish configuring the federated login by using the App ID from step 5, Client ID (i.e. Services ID) from Step 10, Key ID, and Private key file from Step 13.

3.4 Registering a client in LinkedIn

In order to configure a federated login using your LinkedIn account, you need to register a client in LinkedIn.

Note: Copy the Redirect URL for LinkedIn from Zoho Creator before proceeding.

To add a new client:

1. Log in to LinkedIn Developer Portal and click the Create app button at the center or top-right corner.

2. Enter your App name. Here, the “app name” refers to the name of your LinkedIn application that you register in the LinkedIn Developer Portal. This app name is a label for your application within the LinkedIn’s API system.

3. Select your company name or your company’s LinkedIn Page URL under LinkedIn Page. If you don’t have a LinkedIn Company Page, click Create a new LinkedIn Page to create one. Learn more about LinkedIn Company pages

4. Enter the Privacy policy URL and upload a logo for your application. Accept the Legal agreement by ticking the checkbox beside “I have read and agreed to these terms” and click Create App.

5. Click the Request access button beneath Sign In with LinkedIn in Products tab you are redirected to.

6. Go to LinkedIn Developer Portal and navigate to the Auth tab and scroll down to the OAuth 2.0 settings section.

11. Click the edit icon beside Authorized redirect URLs for your app. Click + Add redirect URL and paste the Redirect URL copied from Zoho Creator in the box that appears beneath it. Click the Update button.

7. Scroll above to the Application credentials section, select and copy the Client ID and click the copy icon beside Client Secret from the Configure page.
Info: You can also generate a new Client ID and Client Secret if required by clicking the Generate a new Client Secret button.

8. Switch back to Zoho Creator and paste the Client ID and Client Secret copied from Step 7 and click Save. Learn how to remove a federated login configuration.

Now, when a customer visits your portal, they will be displayed an option to sign in using their LinkedIn account. When clicked, they’ll be taken to the LinkedIn Sign In page. Once they enter the correct credentials, their account will be authenticated, and they can access their customer portal.

Delete federated login configuration

Deleting a federated login configuration in Zoho Creator permanently removes the link tied to your portal and this action cannot be undone.

To delete a federated login configuration in Zoho Creator:

1. Click Portals under DEPLOY in left pane of Zoho Creator admin dashboard.
2. Click the Authentication tab in the top pane, and click the required federated login service under Default Authentication.
   Alternatively, click the Settings icon to open the Federated Login pane.
3. Click the bin icon in the required federated login card to delete its configuration.

4. Points to note

1. Mobile number-based authentication types are available only in the US and IN data centers, and can be configured only when SMS templates are assigned to the portal.
   
2. Switching to a single authentication type will lock out users who signed up with the other. Use the Mobile Number/Email Address type to avoid this.
   
3. Apple generates the private key only once; download and store the .p8 file securely before leaving the page.
   

5. Related topics

1. Understand Authentication
   
2. Understand SAML Authentication
   
3. Configure SAML Authentication>