What is Embedded Login, and when would you use it instead of the Headless Identity APIs?

Embedded Login renders the Salesforce-hosted login experience inside a page on a non-Salesforce website, through a JavaScript include and a connected app. The visitor stays on the corporate site visually, but Salesforce is still rendering and processing the login, so the credential never touches the external application.

The Headless Identity APIs go further: registration, login, passwordless login and password recovery are exposed as endpoints, so the application owns the interface completely and Salesforce owns the credentials and issues the tokens. No Salesforce-rendered page appears anywhere.

I choose Embedded Login when the requirement is “inline on our website” and the team is happy for Salesforce to render the form — it is far less to build and maintain. I choose Headless Identity when there is a native mobile application, or a design system that will not tolerate an embedded frame, or a passwordless journey the team wants full control over. What I will not accept is the third option people propose: a hand-built form on the external site that collects the password and posts it to Salesforce. That puts the credential in the external application, cannot handle verification or step-up, and is the pattern security reviews exist to catch.