Skip to content
Scalekit Docs
Talk to an Engineer Dashboard

Customize login flows

Learn how to handle different login, re-authentication, and signup scenarios by passing parameters to the authorization URL

When you implement login, you generate an authorization URL that redirects users to a Scalekit-hosted login page. You can customize the user’s journey by passing different parameters when creating this URL.

This guide covers common scenarios like routing users to their organization’s identity provider or prompting for re-authentication.

  1. Route users to a specific organization

    Section titled “Route users to a specific organization”

    For multi-tenant applications, you can route users directly to their organization’s authentication method using organizationId. This is useful when you already know the user’s organization.

    Express.js
    const orgId = getOrganizationFromRequest(req)
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = {
      scopes: ['openid', 'profile', 'email', 'offline_access'],
      organizationId: orgId,
    }
    const url = scalekit.getAuthorizationUrl(redirectUri, options)
    return res.redirect(url)

  2. Route users based on email domain

    Section titled “Route users based on email domain”

    If you don’t know the organization beforehand, you can use loginHint to let Scalekit determine the correct authentication method from the user’s email domain. This is common for enterprise logins where the email domain is associated with a specific SSO connection. The domain must be registered to the organization either manually from the Scalekit Dashboard or through the admin portal when onboarding an enterprise customer.

    Express.js
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = { scopes: ['openid', 'profile', 'email', 'offline_access'], loginHint: userEmail }
    const url = scalekit.getAuthorizationUrl(redirectUri, options)
    return res.redirect(url)

  3. Route users to a specific SSO connection

    Section titled “Route users to a specific SSO connection”

    When you know the exact enterprise connection a user should use, you can pass its connectionId for the highest routing precision. This bypasses any other routing logic.

    Express.js
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = { scopes: ['openid', 'profile', 'email', 'offline_access'], connectionId: 'conn_123...' }
    const url = scalekit.getAuthorizationUrl(redirectUri, options)
    return res.redirect(url)

  4. Force users to re-authenticate

    Section titled “Force users to re-authenticate”

    You can require users to authenticate again, even if they have an active session, by setting prompt: 'login'. This is useful for high-security actions that require recent authentication.

    Express.js
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = { scopes: ['openid', 'profile', 'email', 'offline_access'], prompt: 'login' }
    return res.redirect(scalekit.getAuthorizationUrl(redirectUri, options))

  5. Let users choose an account or organization

    Section titled “Let users choose an account or organization”

    To show the organization or account chooser, set prompt: 'select_account'. This is helpful when a user is part of multiple organizations and needs to select which one to sign into.

    Express.js
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = { scopes: ['openid', 'profile', 'email', 'offline_access'], prompt: 'select_account' }
    return res.redirect(scalekit.getAuthorizationUrl(redirectUri, options))

  6. Send users directly to signup

    Section titled “Send users directly to signup”

    To send users directly to the signup form instead of the login page, use prompt: 'create'.

    Express.js
    const redirectUri = 'https://your-app.com/auth/callback'
    const options = { scopes: ['openid', 'profile', 'email', 'offline_access'], prompt: 'create' }
    return res.redirect(scalekit.getAuthorizationUrl(redirectUri, options))