Social login

The Social login plugin puts Continue with Google (and Facebook, X, LinkedIn, GitHub, Discord or Apple) buttons on the log-in and sign-up pages. Visitors join in two clicks, without making up another password, and members connect the accounts they already have.

It needs the PHP extensions curl and openssl, which nearly every host has, and for most providers a site on HTTPS.

What members get

• Continue with … buttons above the log-in form and, when you allow it, above the sign-up form.
• Signing in: a member who connected that account before is signed in at once.
• Joining: a new visitor gets an account with their name, a username made from their name or e-mail, and their profile picture from the provider. The site then behaves as for any new member: the welcome e-mail goes out, and admin approval applies when you have it on. E-mail confirmation is only asked for when the provider has not confirmed the address itself.
• One more step: X and some GitHub accounts do not share an e-mail address. The visitor then types the address their account should use, once.
• Settings → Connected accounts: every provider you switched on, with Connect or Disconnect. Members who joined through a provider have no password yet; the same tab offers Set a password so they can always log in, even without that service. The last connected account cannot be disconnected until a password is set.

The site only reads the name, e-mail address and picture, and never posts anything to the member's other accounts. If a member also uses Two-factor sign-in, the code is still asked after a social sign-in.

How accounts are matched

1. The provider account is already connected to a member: that member is signed in.
2. Otherwise, the provider says the e-mail address is confirmed and a member already uses that address: with Link by e-mail on, the account is connected to that member and they are signed in. A member still waiting to confirm their e-mail counts as confirmed now.
3. Otherwise, a member already uses that address but the provider has not confirmed it: the visitor is asked to log in with their password and connect the provider under Settings → Connected accounts. Nobody can take over an account just by typing someone's address at a provider.
4. Otherwise a new member is made, when joining is open.

No new accounts are made when New members may join with a social account is off, when registration is closed, or when the site is invite-only.

Setting it up

Admin → Plugin pages → Social login.

Every provider has its own card with:

• Show "Continue with …": the switch for its button;
• Redirect address to paste in the developer console, with a copy button. It is always https://your-site/auth/<provider>/callback, for example https://your-site/auth/google/callback;
• Client ID and Client secret. The secret is stored encrypted and never shown again; leave the field empty to keep it, type a new one to replace it;
• a short guide to where the keys are and Open the console, a link to the provider's developer pages.

The card says On, Off, or Keys missing when it is switched on without complete keys; then its button stays hidden.

Sign-up rules

• New members may join with a social account: off means only existing members can connect a provider.
• Link by e-mail: see How accounts are matched.
• Show the buttons on the sign-up page too.

Numbers

Connected accounts, members with one or more, and per provider the connections, sign-ups and use in the last 30 days, with the latest connections.

Coming from WoWonder

When the WoWonder Migration plugin found social login keys on the old site, this page shows Keys from your old site with Import keys from the old site. The Google, Facebook, Twitter (as X) and LinkedIn keys are copied into empty providers. Then add the new redirect addresses in each developer console: the old WoWonder addresses do not work here.

When something goes wrong

• The sign-in took too long or was started in another browser: the visitor waited more than 15 minutes at the provider, or the session was lost. Trying again works.
• The provider shows redirect_uri mismatch or similar: the address in its console is not exactly the one on the card. Copy it again, including https://.
• A provider that refuses the sign-in writes the reason to cache/logs/social-login.log (Admin → Logs → Files). Tokens and secrets are never written there.
• The secrets are encrypted with the site's own secret key, MMB_SECRET in config.php. Keep that file when you move the site; with a new key the saved secrets cannot be read and must be typed again.