Add login to an SPA
# Add login to an SPA
Single-page apps (SPAs) by design run with the source code exposed in the browser, which means that they cannot maintain any secrets. These kinds of applications are called public clients.
Based on the OAuth 2.0 best practices for browser-based apps (opens new window), Asgardeo recommends securing your SPAs using the OpenID Connect Authorization Code Flow for public clients with the PKCE (Proof Key for Code Exchange (opens new window)) extension.
See the guides given below to add login to your SPAs with Asgardeo.