diff --git a/clientapi/routing/login.go b/clientapi/routing/login.go
index 068642f800..a304ed96df 100644
--- a/clientapi/routing/login.go
+++ b/clientapi/routing/login.go
@@ -47,14 +47,16 @@ func Login(
 	cfg *config.ClientAPI,
 ) util.JSONResponse {
 	if req.Method == http.MethodGet {
+		var loginFlows []flow
+		loginFlows = []flow{{Type: authtypes.LoginTypePassword}}
+		if len(cfg.Derived.ApplicationServices) == 0 {
+			loginFlows = append(loginFlows, flow{Type: authtypes.LoginTypeApplicationService})
+		}
 		// TODO: support other forms of login, depending on config options
 		return util.JSONResponse{
 			Code: http.StatusOK,
 			JSON: flows{
-				Flows: []flow{
-					{Type: authtypes.LoginTypePassword},
-					{Type: authtypes.LoginTypeApplicationService},
-				},
+				Flows: loginFlows,
 			},
 		}
 	} else if req.Method == http.MethodPost {