# Signin Widget login/signup using Browser/SPA (client side only) with no MFA

**URL:** <https://devforum.okta.com/t/signin-widget-login-signup-using-browser-spa-client-side-only-with-no-mfa/31350>\
**Category:** OAuth/OIDC\
**Tags:** widget\
**Created:** [November 30, 2024, 8:13pm UTC](https://devforum.okta.com/t/signin-widget-login-signup-using-browser-spa-client-side-only-with-no-mfa/31350 "2024-11-30T20:13:04Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![640KB](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/640kb/32/5736_2.png) [@640KB](https://devforum.okta.com/u/640KB)\
**Post date:** [November 30, 2024, 8:13pm UTC](https://devforum.okta.com/t/signin-widget-login-signup-using-browser-spa-client-side-only-with-no-mfa/31350/1 "2024-11-30T20:13:05Z")

</div>

I’m trying to use the [Signin Widget](https://github.com/okta/okta-signin-widget) (all client side) for a login and signup UI, and have two questions.

1. Using the signup flow, after selecting a email and password it takes you to the optional MFA setup, which we aren’t using for this particular application. How can we bypass this step so that the flow is completed after successful email/password created, and completing the `showSignIn` promise? With the optional MFA set up form step, the promise does not complete until clicking the continue button.

2. If the user starts out on say the `login` form but clicks the “Don’t have an account? Sign up” to take them to the `signup` form, how can you determine which flow/form was completed on the `showSignIn` promise? Either way, the promise returns the token object with a `status: "SUCCESS"`.

Thanks.

---

<div class="post-metadata">

**Author:** ![640KB](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/640kb/32/5736_2.png) [@640KB](https://devforum.okta.com/u/640KB)\
**Post date:** [December 2, 2024, 3:47pm UTC](https://devforum.okta.com/t/signin-widget-login-signup-using-browser-spa-client-side-only-with-no-mfa/31350/2 "2024-12-02T15:47:59Z")

</div>

Adding to question 1, we’ve checked the Org’s Authentication Policies relating to this particular Application and the only Rule is the following:

```auto
IF Any request THEN Access: Allowed with password

Your org's authenticators that satisfy this requirement:
Password

Authentication methods:
Allow any method that can be used to meet the requirement

Re-authentication frequency is: Every 30 days

```

And under the Password Authenticator the only rule is:

```auto
IF User's IP is Anywhere

THEN Users can perform self-service
   [x] Password change (from account settings)
   [x] Password reset
   [] Unlock account

Recovery Authenticators

AND Users can initiate recovery with
   [] Phone (SMS / Voice Call)
   [x] Email
   [] Google Authenticator

AND Additional verification is
   [x] Not required

```

Regardless it always shows the MFA enroll form with “Email”, “Google Authenticator” and “Okta”, requiring the “Continue” button to be clicked before completing signup flow.

It sounds as if `features.multiOptionalFactorEnroll: false` would have done this but that has been [deprecated](https://developer.okta.com/docs/guides/oie-upgrade-sign-in-widget/main/). What’s the equivalent method in the upgraded/current Widget?

Note: we are currently testing against the CDN hosted 7.25.1 (have tried oie and standard).

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 1, 2025, 3:48pm UTC](https://devforum.okta.com/t/signin-widget-login-signup-using-browser-spa-client-side-only-with-no-mfa/31350/3 "2025-01-01T15:48:21Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.