---
title: "Update default sign-in experience settings"
method: PATCH
path: "/api/sign-in-exp"
tags: ["Sign-in experience"]
---

# Update default sign-in experience settings

`PATCH /api/sign-in-exp`

Update the default sign-in experience settings with the provided data.

## Query parameters

- `removeUnusedDemoSocialConnector` string

## Request body

- object
  - `tenantId` string
  - `color` object — Specify the primary branding color for the sign-in page (both light/dark mode).
    - `primaryColor` string, regex, required
    - `isDarkModeEnabled` boolean, required
    - `darkPrimaryColor` string, regex, required
  - `branding` object
    - `logoUrl` string, url
    - `darkLogoUrl` string, url
    - `favicon` string, url
    - `darkFavicon` string, url
  - `hideLogtoBranding` boolean — Cloud only. Whether to hide the Logto branding on hosted sign-in pages.
  - `languageInfo` object — Control the language detection policy for the sign-in page.
    - `autoDetect` boolean, required
    - `fallbackLanguage` 'af-ZA' | 'am-ET' | 'ar' | 'ar-AR' | 'as-IN' | 'az-AZ' | 'be-BY' | 'bg-BG' | 'bn-IN' | 'br-FR' | 'bs-BA' | 'ca-ES' | 'cb-IQ' | 'co-FR' | 'cs' | 'cs-CZ' | 'cx-PH' | 'cy-GB' | 'da-DK' | 'de' | 'de-DE' | 'el-GR' | 'en' | 'en-GB' | 'en-US' | 'eo-EO' | 'es' | 'es-ES' | 'es-419' | 'et-EE' | 'eu-ES' | 'fa-IR' | 'ff-NG' | 'fi' | 'fi-FI' | 'fo-FO' | 'fr' | 'fr-CA' | 'fr-FR' | 'fy-NL' | 'ga-IE' | 'gl-ES' | 'gn-PY' | 'gu-IN' | 'ha-NG' | 'he-IL' | 'hi-IN' | 'hr-HR' | 'ht-HT' | 'hu-HU' | 'hy-AM' | 'id-ID' | 'ik-US' | 'is-IS' | 'it' | 'it-IT' | 'iu-CA' | 'ja' | 'ja-JP' | 'ja-KS' | 'jv-ID' | 'ka-GE' | 'kk-KZ' | 'km-KH' | 'kn-IN' | 'ko' | 'ko-KR' | 'ku-TR' | 'ky-KG' | 'lo-LA' | 'lt-LT' | 'lv-LV' | 'mg-MG' | 'mk-MK' | 'ml-IN' | 'mn-MN' | 'mr-IN' | 'ms-MY' | 'mt-MT' | 'my-MM' | 'nb-NO' | 'ne-NP' | 'nl' | 'nl-BE' | 'nl-NL' | 'nn-NO' | 'or-IN' | 'pa-IN' | 'pl-PL' | 'ps-AF' | 'pt' | 'pt-BR' | 'pt-PT' | 'ro-RO' | 'ru' | 'ru-RU' | 'rw-RW' | 'sc-IT' | 'si-LK' | 'sk-SK' | 'sl-SI' | 'sn-ZW' | 'sq-AL' | 'sr-RS' | 'sv' | 'sv-SE' | 'sw-KE' | 'sy-SY' | 'sz-PL' | 'ta-IN' | 'te-IN' | 'tg-TJ' | 'th' | 'th-TH' | 'tl-PH' | 'tr' | 'tr-TR' | 'tt-RU' | 'tz-MA' | 'uk-UA' | 'ur-PK' | 'uz-UZ' | 'vi-VN' | 'zh' | 'zh-CN' | 'zh-HK' | 'zh-MO' | 'zh-TW' | 'zz-TR', required
  - `agreeToTermsPolicy` 'Automatic' | 'ManualRegistrationOnly' | 'Manual'
  - `signIn` object — Sign-in method settings
    - `methods` object[], required
      - `identifier` 'username' | 'email' | 'phone', required
      - `password` boolean, required
      - `verificationCode` boolean, required
      - `isPasswordPrimary` boolean, required
  - `signUp` object — Sign-up method settings
    - `identifiers` string[], required — Specify allowed identifiers when signing-up.
    - `password` boolean, required — Whether the user is required to set a password when signing-up.
    - `verify` boolean, required — Whether the user is required to verify their email/phone when signing-up.
    - `secondaryIdentifiers` object[]
      - `identifier` union, required
        - 'username' | 'email' | 'phone'
        - 'emailOrPhone'
      - `verify` boolean
  - `socialSignIn` object
    - `automaticAccountLinking` boolean
    - `skipRequiredIdentifiers` boolean
  - `socialSignInConnectorTargets` string[] — Specify the social sign-in connectors to display on the sign-in page.
  - `signInMode` 'SignIn' | 'Register' | 'SignInAndRegister'
  - `customCss` string, nullable
  - `customContent` object — Custom content to display on experience flow pages. the page pathname will be the config key, the content will be the config value.
  - `customUiAssets` object, nullable
    - `id` string, required
    - `createdAt` number, required
  - `customUiCsp` object — Cloud only. Configure additional Content Security Policy source expressions for Custom UI assets. These values are applied to the hosted sign-in page only when Custom UI assets are configured.
    - `scriptSrc` string[] — Additional source expressions to append to the `script-src` directive for scripts loaded by Custom UI assets. Use HTTPS sources; HTTP localhost sources are allowed only outside production.
    - `connectSrc` string[] — Additional source expressions to append to the `connect-src` directive for network requests made by Custom UI assets. Use HTTPS or WSS sources; HTTP localhost sources are allowed only outside production.
  - `passwordPolicy` object — Password policies to adjust the password strength requirements.
    - `length` object
      - `min` number, required
      - `max` number, required
    - `characterTypes` object
      - `min` number, required
    - `rejects` object
      - `pwned` boolean, required
      - `repetitionAndSequence` boolean, required
      - `userInfo` boolean, required
      - `words` string[], required
  - `mfa` object — MFA settings
    - `factors` string[], required
    - `policy` 'UserControlled' | 'Mandatory' | 'PromptOnlyAtSignIn' | 'PromptAtSignInAndSignUp' | 'NoPrompt' | 'PromptAtSignInAndSignUpMandatory' | 'PromptOnlyAtSignInMandatory', required
    - `organizationRequiredMfaPolicy` 'NoPrompt' | 'Mandatory'
  - `adaptiveMfa` object — Adaptive MFA settings. Only effective when developer features are enabled.
    - `enabled` boolean
  - `singleSignOnEnabled` boolean
  - `captchaPolicy` object
    - `enabled` boolean
  - `sentinelPolicy` object — Custom sentinel policy settings. Use this field to customize the user lockout policy. The default value is 100 failed attempts within one hour. The user will be locked out for 60 minutes after exceeding the limit.
    - `maxAttempts` number
    - `lockoutDuration` number
  - `emailBlocklistPolicy` object — Define email restriction policies for registering or linking email addresses.
    - `blockDisposableAddresses` boolean — Cloud only. Whether to block disposable email addresses. Once enabled, Logto will check the email domain against a list of known disposable email domains. If the domain is found in the list, the email address will be blocked.
    - `blockSubaddressing` boolean — Whether to block sub-addresses. (E.g., example+shopping@test.com)
    - `customAllowlist` string[] — Custom allowlist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`.
    - `customBlocklist` string[] — Custom blocklist of email addresses, domains, or wildcard email address patterns. Examples: `bar@example.com`, `@example.com`, `foo*@example.com`, `@*.example.com`.
  - `forgotPasswordMethods` string[], nullable
  - `passkeySignIn` object
    - `enabled` boolean
    - `showPasskeyButton` boolean
    - `allowAutofill` boolean
  - `signUpProfileFields` object[], nullable
    - `name` string, required
  - `usernamePolicy` object — Validator function
  - `termsOfUseUrl` union
    - string, url, nullable
    - string, empty
  - `privacyPolicyUrl` union
    - string, url, nullable
    - string, empty
  - `supportEmail` union — The support email address to display on the error pages.
    - string, email, nullable
    - string, empty
  - `supportWebsiteUrl` union — The support website URL to display on the error pages.
    - string, url, nullable
    - string, empty
  - `unknownSessionRedirectUrl` union — The fallback URL to redirect users when the sign-in session does not exist or unknown. Client should initiate a new authentication flow after the redirection.
    - string, url, nullable
    - string, empty
  - `passwordExpiration` union — Password expiration policy used to force users to reset their password during sign-in. When enabled is false, the period field is ignored.
    - object
      - `enabled` boolean — Whether password expiration is enabled.
      - `validPeriodDays` unknown
    - object
      - `enabled` boolean, required — Whether password expiration is enabled.
      - `validPeriodDays` number, required — Number of days a password remains valid before it expires.
      - `enabledAt` number
  - `verificationCodePolicy` object
    - `expirationDuration` number
    - `maxRetryAttempts` number

## Response `200`

Updated default sign-in experience settings.

- object
  - `tenantId` string, required
  - `id` string, required
  - `color` object, required
    - `primaryColor` string, regex, required
    - `isDarkModeEnabled` boolean, required
    - `darkPrimaryColor` string, regex, required
  - `branding` object, required
    - `logoUrl` string, url
    - `darkLogoUrl` string, url
    - `favicon` string, url
    - `darkFavicon` string, url
  - `hideLogtoBranding` boolean, required
  - `languageInfo` object, required
    - `autoDetect` boolean, required
    - `fallbackLanguage` 'af-ZA' | 'am-ET' | 'ar' | 'ar-AR' | 'as-IN' | 'az-AZ' | 'be-BY' | 'bg-BG' | 'bn-IN' | 'br-FR' | 'bs-BA' | 'ca-ES' | 'cb-IQ' | 'co-FR' | 'cs' | 'cs-CZ' | 'cx-PH' | 'cy-GB' | 'da-DK' | 'de' | 'de-DE' | 'el-GR' | 'en' | 'en-GB' | 'en-US' | 'eo-EO' | 'es' | 'es-ES' | 'es-419' | 'et-EE' | 'eu-ES' | 'fa-IR' | 'ff-NG' | 'fi' | 'fi-FI' | 'fo-FO' | 'fr' | 'fr-CA' | 'fr-FR' | 'fy-NL' | 'ga-IE' | 'gl-ES' | 'gn-PY' | 'gu-IN' | 'ha-NG' | 'he-IL' | 'hi-IN' | 'hr-HR' | 'ht-HT' | 'hu-HU' | 'hy-AM' | 'id-ID' | 'ik-US' | 'is-IS' | 'it' | 'it-IT' | 'iu-CA' | 'ja' | 'ja-JP' | 'ja-KS' | 'jv-ID' | 'ka-GE' | 'kk-KZ' | 'km-KH' | 'kn-IN' | 'ko' | 'ko-KR' | 'ku-TR' | 'ky-KG' | 'lo-LA' | 'lt-LT' | 'lv-LV' | 'mg-MG' | 'mk-MK' | 'ml-IN' | 'mn-MN' | 'mr-IN' | 'ms-MY' | 'mt-MT' | 'my-MM' | 'nb-NO' | 'ne-NP' | 'nl' | 'nl-BE' | 'nl-NL' | 'nn-NO' | 'or-IN' | 'pa-IN' | 'pl-PL' | 'ps-AF' | 'pt' | 'pt-BR' | 'pt-PT' | 'ro-RO' | 'ru' | 'ru-RU' | 'rw-RW' | 'sc-IT' | 'si-LK' | 'sk-SK' | 'sl-SI' | 'sn-ZW' | 'sq-AL' | 'sr-RS' | 'sv' | 'sv-SE' | 'sw-KE' | 'sy-SY' | 'sz-PL' | 'ta-IN' | 'te-IN' | 'tg-TJ' | 'th' | 'th-TH' | 'tl-PH' | 'tr' | 'tr-TR' | 'tt-RU' | 'tz-MA' | 'uk-UA' | 'ur-PK' | 'uz-UZ' | 'vi-VN' | 'zh' | 'zh-CN' | 'zh-HK' | 'zh-MO' | 'zh-TW' | 'zz-TR', required
  - `termsOfUseUrl` string, nullable, required
  - `privacyPolicyUrl` string, nullable, required
  - `agreeToTermsPolicy` 'Automatic' | 'ManualRegistrationOnly' | 'Manual', required
  - `signIn` object, required
    - `methods` object[], required
      - `identifier` 'username' | 'email' | 'phone', required
      - `password` boolean, required
      - `verificationCode` boolean, required
      - `isPasswordPrimary` boolean, required
  - `signUp` object, required
    - `identifiers` string[], required
    - `password` boolean, required
    - `verify` boolean, required
    - `secondaryIdentifiers` object[]
      - `identifier` union, required
        - 'username' | 'email' | 'phone'
        - 'emailOrPhone'
      - `verify` boolean
  - `socialSignIn` object, required
    - `automaticAccountLinking` boolean
    - `skipRequiredIdentifiers` boolean
  - `socialSignInConnectorTargets` string[], required
  - `signInMode` 'SignIn' | 'Register' | 'SignInAndRegister', required
  - `customCss` string, nullable, required
  - `customContent` object, required
  - `customUiAssets` object, nullable, required
    - `id` string, required
    - `createdAt` number, required
  - `customUiCsp` object, required
    - `scriptSrc` string[]
    - `connectSrc` string[]
  - `passwordPolicy` object, required
    - `length` object
      - `min` number, required
      - `max` number, required
    - `characterTypes` object
      - `min` number, required
    - `rejects` object
      - `pwned` boolean, required
      - `repetitionAndSequence` boolean, required
      - `userInfo` boolean, required
      - `words` string[], required
  - `mfa` object, required
    - `factors` string[], required
    - `policy` 'UserControlled' | 'Mandatory' | 'PromptOnlyAtSignIn' | 'PromptAtSignInAndSignUp' | 'NoPrompt' | 'PromptAtSignInAndSignUpMandatory' | 'PromptOnlyAtSignInMandatory', required
    - `organizationRequiredMfaPolicy` 'NoPrompt' | 'Mandatory'
  - `adaptiveMfa` object, required
    - `enabled` boolean
  - `singleSignOnEnabled` boolean, required
  - `supportEmail` string, nullable, required
  - `supportWebsiteUrl` string, nullable, required
  - `unknownSessionRedirectUrl` string, nullable, required
  - `captchaPolicy` object, required
    - `enabled` boolean
  - `sentinelPolicy` object, required
    - `maxAttempts` number
    - `lockoutDuration` number
  - `emailBlocklistPolicy` object, required
    - `blockDisposableAddresses` boolean
    - `blockSubaddressing` boolean
    - `customAllowlist` string[]
    - `customBlocklist` string[]
  - `verificationCodePolicy` object, required
    - `expirationDuration` number
    - `maxRetryAttempts` number
  - `forgotPasswordMethods` string[], nullable, required
  - `passkeySignIn` object, required
    - `enabled` boolean
    - `showPasskeyButton` boolean
    - `allowAutofill` boolean
  - `signUpProfileFields` object[], nullable, required
    - `name` string, required
  - `passwordExpiration` union, required
    - object
      - `enabled` boolean
    - object
      - `enabled` boolean, required
      - `validPeriodDays` number, required
      - `enabledAt` number
  - `usernamePolicy` object, required — Validator function

## Other responses

- `400` — Bad request. Invalid data provided.
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Default sign-in experience settings not found.
- `409` — Conflict
- `422` — Unprocessable Entity. Invalid data provided.

---

[API](https://skmtc.net/logto/apis/logto-api-references.md) · [All operations](https://skmtc.net/logto/apis/logto-api-references/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/logto/logto-api-references/revisions/a163dc77d842/schema)