In an example embodiment, a virtual private network (VPN) connection is established between a client device and an authentication service. Then a request is received from a third-party application on the client device, with the request being for a third-party service. A log-in page is requested from the third-party service, with the log-in page including one or more log-in fields usable to enter credential information. The log-in page is then modified to hide the one or more log-in fields. Credentials corresponding to a user of the client device and also corresponding to the third-party service are then obtained. The modified log-in page is sent to the client device via the VPN connection. A log-in submission is received from the third-party application. The credentials corresponding to the user and to the third-party service are sent to the third-party service to log-in the user to the third-party service.