Skip to content

Set up brand identity and login

Set a brand's core identity — its name, web address, languages — and control how traders sign in to it.

The brand editor is a single page divided into cards. This page covers the cards at the top: brand identity, languages, sign-in methods, social login, single sign-on, and login security. The rest of the editor is covered in Customize login branding, Set up custom domains and embedding, and Set trading defaults and lead routing.

Prerequisites

  • You are signed in to the Backoffice with a role that grants permission to manage brands.
  • You have opened a brand from the brands list.

Open a brand from Brands to reach the editor. Every change you make on the page is applied together when you click Save in the header.

Identity

The Settings card holds the brand's core details:

  • Name — the brand's display name.
  • DNS — the web address (host name) the brand is served on.
  • Status — Active, Disabled, or Archived.

Languages

The Supported languages card controls which languages the brand's WebTrader and Client Zone offer.

  1. Select the check box for each language the brand should support.
  2. Under Default language, choose the language new visitors see first. Only languages you have selected as supported appear in this list.

Note

If you remove the language that is currently the default, the default is cleared. Pick a new default before saving.

Sign-in methods

The Allowed login methods card controls how traders sign in.

  1. Select the check box for each sign-in method the brand should allow, such as email-and-password or a social sign-in provider. Enabling a social provider also requires connecting it in Social login below before traders can use it.
  2. (Optional) In the Registration URL field, enter an external web address where new customers sign up. Leave it empty to have the brand show its built-in sign-up form instead.

How traders identify themselves

Traders sign in with their Account ID or email and a password. To change the look of the sign-in and registration screens, or to require a one-time passcode, use the Login & Registration tab.

Warning

If you clear every sign-in method, no one can sign in to the brand. Keep at least one method selected for any brand that is live to customers.

Social login (OAuth)

If your platform offers one or more social sign-in providers (such as Google), a Social login (OAuth) card appears with one panel per provider. Traders can sign in with a provider only after you both allow it in Allowed login methods and connect it here.

For each provider you want to offer, fill in the wiring you obtained from that provider's developer console:

  • Client ID — the public application identifier the provider issued to you.
  • Issuer URL — the provider's sign-in address, for example https://accounts.google.com.
  • Redirect URI — the address the provider returns customers to after they sign in.
  • Scopes — the space-separated permissions to request. Leave this blank to request openid email.
  • Client secret — the provider's secret for your application.

The issuer URL and redirect URI must both be https addresses. A badge on each provider shows whether its client secret is currently Secret set or No secret.

Note

The client secret is write-only: it is never shown back to you after you save. Enter a new value to set or rotate the secret; leave the field blank to keep the secret you already saved.

Single sign-on

The SSO card lets a broker embed the brand's trading experience into their own site and pass an already-signed-in customer through, without a second login. A badge shows whether single sign-on is currently Configured.

  • To turn it on or rotate it, enter a shared secret in the SSO secret field and save. The secret is write-only: it is never shown back to you after you save it.
  • To turn it off, select the option to clear the secret and save.

Note

Leaving the secret field empty on save keeps the current secret unchanged. Only entering a new value, or explicitly clearing it, changes the setting.

Login security

The Security card holds the brand's brute-force protection.

  • Login rate limit — when on, the platform limits repeated login and sign-up attempts to protect against automated password guessing.

Warning

When the login rate limit is off, the editor shows a warning. Leave this protection on for any brand that is live to customers.

Click Save in the header to apply your changes.