Social sign-in

With social sign-in, people use an account they already have. You switch a provider on once, paste in credentials from the provider’s developer console, and add a button.

Social providers page — Users & auth → Social providers: ten providers, each with Set up.

Providers Pawabase ships: Google, GitHub, Discord, Microsoft, GitLab, LinkedIn, Slack, Facebook, Twitch and Apple. For anything else, add your own OAuth server.

Set up a provider

Create an app at the provider

In the provider’s developer console (Google Cloud, GitHub Developer settings, and so on), create an OAuth application. You need its Client ID and Client secret.

Open Studio's provider page

Users & auth → Sign-in → Social providers. Search for the provider and click it.

Copy the redirect address

The sheet shows a Redirect address. Paste it into the provider’s list of allowed callback URLs. This is the address the provider sends people back to.

Enter credentials and switch it on

Fill in Client ID and Client secret, optionally Scopes, and turn on Enable sign-in. Save.

Allow your app's address

Make sure the place people land afterwards is on the redirect list.

The fields

Field	Meaning
Enable sign-in	Allow users to sign in with this provider
Client ID	From the provider
Client secret	From the provider. Store it in Secrets and reference it as `secret://NAME` so it never sits in plain text
Redirect address	Read-only. Copy it to the provider
Scopes	What to ask the provider for. Press Enter after each. Leave empty to use the provider’s defaults

Provider extras:

Apple: Team ID, Key ID (the key you made for Sign in with Apple) and Private key (store the .p8 file’s contents in Secrets and reference it).
GitLab: GitLab address. Leave empty for gitlab.com; enter your server’s address for a self-hosted one.

A provider counts as ready when it has a client ID (and, for Apple, the team ID, key ID and private key).

Add a button

const pawabase = createClient({
  url: "https://api.example.com",
  apiKey: "pb_pk_…",
  environment: "production",          // social sign-in needs the environment name
});

button.onclick = () =>
  pawabase.auth.signInWithOAuth("github", { redirectTo: "https://myapp.com/" });

url = pb.auth.oauth_url("github", redirect_to="https://myapp.com/auth/callback")
# redirect the user's browser to `url`

The browser goes to the provider, the person approves, and they come back to redirectTo. On a server, signInWithOAuthUrl(provider, { redirectTo }) returns the address without redirecting.

Finish on return

In a browser, do nothing: the client reads the session from the address when your page loads, stores it, cleans the URL, and fires SIGNED_IN on onAuthStateChange. To see the outcome yourself, for example to show an error:

const result = await pawabase.auth.getSessionFromUrl();

switch (result.status) {
  case "signed_in":    break;
  case "mfa_required": await result.verify(codeFromUser); break;
  case "linked":       console.log("Linked", result.provider); break;
  case "error":        showError(result.error); break;
  case "none":         break;                       // not a sign-in return
}

On a server or in a mobile app, the return carries a code. Trade it for a session:

const session = await pawabase.auth.exchangeCode(code);

session = pb.auth.exchange_code(code)

For a mobile deep link, call getSessionFromUrl(url) with the link you received.

What happens to the account

A first-time person gets a new user; the provider appears under user.identities.
The email the provider reports is used for the account. Whether it counts as verified depends on the provider.
If the account has two-step verification, you get mfa_required on return, like any other first step.
Sign-up restrictions (allowed and blocked email domains) apply to social sign-in too.

To attach a provider to an account that already exists, see Linked accounts.

Your own OAuth server

Under Users & auth → Sign-in → Social providers → OAuth servers, Add OAuth server to use any standard OAuth provider: give it a name and its Authorize endpoint, Token endpoint and Userinfo endpoint, plus client credentials. Its State shows whether it is enabled. People then sign in with signInWithOAuth("<name>").

Troubleshooting

Symptom	Cause
”redirect_uri mismatch” at the provider	The Redirect address from Studio isn’t in the provider’s callback list, exactly
Returns to the Site URL, not my page	`redirectTo` missing or not allowed
`ConfigError`: needs the environment	Pass `environment` to `createClient`
Button does nothing	The provider isn’t enabled, or has no client ID
Nobody can sign up with a company email	An allow-list is set

Linked accounts

Attach more providers.

Company sign-in

SAML and OIDC for customers.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

Set up a provider

The fields

Add a button

Finish on return

What happens to the account

Your own OAuth server

Troubleshooting

Linked accounts

Company sign-in

​Set up a provider

​The fields

​Add a button

​Finish on return

​What happens to the account

​Your own OAuth server

​Troubleshooting

Linked accounts

Company sign-in

Set up a provider

The fields

Add a button

Finish on return

What happens to the account

Your own OAuth server

Troubleshooting