# Use Experience Cloud login as single sign-on for your store customers (SSO) Source: https://support.storeconnect.com/articles/experience-cloud-login · Last modified 21 August 2026 Use this process to let customers sign in to your StoreConnect store with their Salesforce Experience Cloud credentials. Experience Cloud sites, such as partner portals and support forums, act as the SAML identity provider, and StoreConnect acts as the service provider. ## Before you begin - You need an Experience Cloud site already set up in your Salesforce org. - You need Salesforce administrator permissions to create certificates, enable the identity provider, and create external client apps. - Have your store's domain ready. If your store is served on a path (for example `/au` or `/b2b`), have that path too. It changes the URLs you enter. - **Account** and **Contact** records must exist and have synced to the store before a customer tries to log in. See the section below. :::warning Experience Cloud self-registration is not supported. It relates all new **Contact** records to a single **Account**, which is incompatible with how StoreConnect uses the Account to Contact relationship. Create the records another way. ::: ## Account and contact creation **Account** and **Contact** records have to exist before the customer attempts to log in, with enough time allowed for them to sync to the store. They can be records created by StoreConnect's checkout process, or records created in Salesforce, provided they are compatible with the records StoreConnect creates. For example, you could email customers who have completed a purchase inviting them to set a username and password for Experience Cloud login. That flow is not part of the StoreConnect package, so you need to build it to suit your organization and use case. ## Step 1: Create a certificate and enable the identity provider Do this first. The certificate you create here is selected again in step 2. 1. Go to **Setup** > **Certificate and Key Management**. 2. Select **Create a Self-Signed Certificate**. ![Salesforce Certificate and Key Management page with the Create a Self-Signed Certificate button](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677713/documentation-media/log-in-as-contact/certificate.png) 3. Give the certificate a **Label** and **Unique Name**. 4. Set **Key Size** to `2048`. 5. Select **Save**. 6. Go to **Setup** > **Identity Provider**. ![Salesforce Identity Provider setup page with the Enable Identity Provider button](https://res.cloudinary.com/hzkr6fi81/image/upload/v1781677714/documentation-media/log-in-as-contact/identity-provider-setup.png) 7. Select **Enable Identity Provider**. 8. Select the certificate you just created. 9. Select **Save**. ## Step 2: Create an external client app :::note Salesforce no longer allows creating new connected apps. External client apps are the replacement and provide the same SAML functionality for this configuration. ::: :::warning Do not use **Migrate to External Client App** on an existing Connected App. Best practice is to create a new External Client App from scratch using the steps below. ::: 1. Go to **Setup** > **External Client App Manager**. 2. Select **New External Client App**. 3. Configure the basic information: - **External Client App Name:** `StoreConnect Customer Single Sign-On` - **API Name:** `StoreConnect_Customer_Single_SignOn` - **Contact Email:** Enter the contact email for Salesforce to use in case they want to contact you or your support team - **Distribution State:** Leave as Default - **Contact Phone:** Enter the contact phone for Salesforce to use in case they want to contact you or your support team - **Info URL:** `https://support.storeconnect.com/article/experience-cloud-login` - **Logo Image URL:** `https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png` - **Icon URL:** `https://res.cloudinary.com/hzkr6fi81/image/upload/v1779181620/media/StoreConnect_Icon_Logo-100x100.png` - **Description:** `Allows users to log in to store accounts with an Experience Cloud account` 4. Skip the API (Enable OAuth Settings) section. 5. In the **Web App (Enable SAML Settings)** section, configure the following: - **Enable SAML:** True - **Entity Id:** `https://{your-stores-domain.com}/logins/auth/experience_cloud/metadata` - **ACS URL:** `https://{your-stores-domain.com}/logins/auth/experience_cloud/auth` - **Issuer:** `https://{your-stores-domain.com}/logins/auth/experience_cloud/metadata` - **Name ID Format:** `urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress` - **Signing Algorithm for SAML Messages:** SHA1 - **IdP Certificate:** Choose the self-signed certificate you created in the first step. :::note If your store uses a URL path for region or scope (for example `/au`, `/us`, `/b2b`, `/b2c`; a path can be any segment after your store domain), include the full path before the SAML route segment in the **Entity Id**, **ACS URL**, and **Issuer** fields: - **Entity Id:** `https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/metadata` - **ACS URL:** `https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/auth` - **Issuer:** `https://{your-store-domain}/{your-path}/logins/auth/experience_cloud/metadata` Without the path, the AuthnRequest Issuer the store sends will not match the External Client App's Entity Id and Salesforce returns **idpError=1605 Unable to resolve request into a service provider**. Each store with a different path needs its own External Client App. ::: 6. Save the changes. ## Step 3: Set the app policies This step produces the **Metadata Discovery Endpoint** that step 4 needs, so complete it before creating the authentication provider. 1. Edit the app you created in step 2. 2. Add a **Custom start page**. 3. Enter the **Custom Start URL**: `https://{your-stores-domain.com}/` 4. Under **Profiles** and **Permission Sets**, add the profiles or permission sets for the Experience Cloud users who should be able to log in to the store. 5. Save. 6. Go to the **SAML Policies** section, open **SAML Login Info**, and copy the **Metadata Discovery Endpoint**. You need it in the next step. ## Step 4: Create the authentication provider 1. On the **Store** record, go to the **Authentication Providers** related list. 2. Select **New**. 3. Enter the following values: | StoreConnect field | Value | |--------------------|--------------------------------------------------| | Provider | Experience Cloud | | Authorised Domains | Optional | | Client Id | | | Client Secret | (leave blank) | | Provider URL | Metadata Discovery Endpoint from the previous step | | Reset Password URL | Optional | 4. If you have a custom domain for your Experience Cloud site, enter it in the **Authorised domains** field. The Provider URL is automatically authorized, so you only need to add additional domains here. This field supports multiple domains separated by a semi-colon (;). 5. Leave the **Client Secret** blank. When Client Secret is empty and a Provider URL is set, StoreConnect fetches the current IdP certificate directly from the SAML metadata URL. This keeps the certificate automatically up to date and eliminates the need to manually generate or maintain a certificate fingerprint. 6. Save the record. ## Step 5: Verify the login works 1. Open your store in a private browser window. 2. Confirm the Experience Cloud login option appears on the store's login page. 3. Sign in as an Experience Cloud user whose profile or permission set you added in step 3, and confirm you reach the store signed in as the matching customer. 4. If sign-in fails, see [troubleshooting](#troubleshooting) below. ### Reset password URL StoreConnect cannot initiate a password reset for an Experience Cloud account, for security reasons. There is no way to change this. To give customers a working reset path, set the **Reset Password URL** field to the identity provider's own password reset page. The store's reset password flow then redirects the customer there. If you leave it blank, an Experience Cloud customer who attempts a reset sees "Password reset is not supported for this account. Please contact support for assistance." See [password reset and password changes for SSO accounts](authentication-providers) for the full detail. ## Customers without an Experience Cloud license To let some customers sign in with Experience Cloud and others sign in another way, whether with a username and password or a different provider, create an additional **Authentication Provider** record for each method. See [authentication providers and single sign-on (SSO)](authentication-providers). ## Troubleshooting ### Diagnosing SAML errors with the Identity Provider Event Log If login fails with a SAML error such as `idpError=1605 Unable to resolve request into a service provider` or `Authentication Failed`, go to **Setup** > **Identity Provider Event Log**. It records each inbound SAML AuthnRequest with the resolved service provider, the issuer, the requesting user, and whether it succeeded. Entries showing the service provider as `unknown` mean the external client app is not resolving SAML requests. Check that the **Entity Id**, **ACS URL**, and **Issuer** match the URLs your store sends, including the store path if it has one. If the configuration looks correct but the error persists, the app is likely in a broken state; recreate it from scratch. --- ## Follow StoreConnect - [Email Newsletter](https://getstoreconnect.com/c/lp-newsletter) - [LinkedIn Newsletter](https://www.linkedin.com/build-relation/newsletter-follow?entityUrn=7444956928444862464) - [YouTube](https://www.youtube.com/channel/UCngKdP2x8l1wcbAKW3tvU8g) - [LinkedIn](https://www.linkedin.com/company/storeconnect) - [X / Twitter](https://x.com/storeconnecthq) ## Popular Links - [Partners](https://getstoreconnect.com/partners) - [News](https://getstoreconnect.com/articles/news) - [Events](https://getstoreconnect.com/articles/events) - [Feature Comparison](https://getstoreconnect.com/how-we-compare) - [Download a free trial](https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FMkeKUAT) - [Book a Demo](https://getstoreconnect.com/contact) ## Documentation - [Help documentation](https://support.storeconnect.com/help-documentation) - [AI agents](https://support.storeconnect.com/ai) - [Videos & tutorials](https://support.storeconnect.com/videos-tutorials) - [Developer reference](https://support.storeconnect.com/developer-reference) - [Release notes](https://support.storeconnect.com/release-notes) - [Troubleshooting](https://support.storeconnect.com/troubleshooting) - [Trust Center](https://trust.getstoreconnect.com/) - [Status Page](https://status.storeconnect.com/) ## Contact - info@getstoreconnect.com - US +1 415 745 3230 - AUS +61 2 8365 2308 100 S Ashley Dr, Suite 600-2461 Tampa FL 33602-600 USA Level 22, Sydney Place 180 George Street Sydney, NSW, 2000, AUS --- StoreConnect Support — https://support.storeconnect.com/articles/experience-cloud-login