They want the power to add arbitrary extra steps in the login flow. For example, maybe they want to force the user to change a compromised password, or hand ov

They want the power to add arbitrary extra steps in the login flow. For example, maybe they want to force the user to change a compromised password, or hand over their phone number, or complete a captcha, or accept a load of legalese. You can do this without a webview in your application, but it usually means giving the user an URL to open in their own browser.