Social sign-in
Members sign in with an account they already have instead of a password they have to invent. Nineteen providers are supported. Each one you want has to be registered at that provider first, and the credentials it gives you are stored on your own WordPress site.
Before you start
Section titled “Before you start”| Plugin | None. Social sign-in is part of the Memberside plugin |
| Endpoint group | Social Login |
| Plan | Every plan |
Set one up
Section titled “Set one up”- Google Signs in inside the app. Three OAuth clients. Read the Google setup guide
- Apple Signs in inside the app. Required by guideline 4.8. Read the Apple setup guide
- Facebook Needs a Meta app with Facebook Login added. Read the Facebook setup guide
- X Returns an email only with elevated access. Read the X setup guide
- LinkedIn The OpenID Connect product, not the older OAuth one. Read the LinkedIn setup guide
- Microsoft Unverified email. Single-tenant apps need a tenant ID. Read the Microsoft setup guide
- GitHub An OAuth app under your developer settings. Read the GitHub setup guide
- GitLab Unverified email. Needs the read_user scope. Read the GitLab setup guide
- Discord An application with an OAuth2 redirect. Read the Discord setup guide
- Slack Unverified email. Scopes go under User Token Scopes. Read the Slack setup guide
- Twitch An application in the Twitch developer console. Read the Twitch setup guide
- Reddit No email at all. Linking only, never sign-up. Read the Reddit setup guide
- Amazon Unverified email. Login with Amazon, not AWS. Read the Amazon setup guide
- Yahoo An OpenID Connect app in the Yahoo developer console. Read the Yahoo setup guide
- Spotify Unverified email. Redirect URIs are allow-listed. Read the Spotify setup guide
- Dropbox A scoped app in the Dropbox app console. Read the Dropbox setup guide
- Pinterest No email at all. Linking only, never sign-up. Read the Pinterest setup guide
- Patreon A client registered in the Patreon portal. Read the Patreon setup guide
- WordPress.com WordPress.com accounts, not your own WordPress site. Read the WordPress.com setup guide
What every provider has in common
Section titled “What every provider has in common”Sixteen of the nineteen ask for exactly two things: a Client ID and a Client secret. Microsoft adds an optional tenant ID, Google adds two optional client IDs, and Apple is the one genuine exception — it has no client secret at all, because the secret is a token signed at the moment of sign-in from a key you supply.
Every provider needs the same redirect URL registered against it. There is one shape and it is per-provider only in its last segment — see Redirect URLs.
Credentials go in WordPress under Memberside → API Keys → Social Login, which holds one collapsed section per provider. They are never sent to Memberside; see Connection and API keys.
Two providers sign in inside the app
Section titled “Two providers sign in inside the app”Google and Apple have native sign-in: the sheet belongs to the operating system, and the member never leaves your app. The other seventeen open the system browser, sign in there, and return.
This matters for what you promise your members, and it matters for Google specifically:
The email rule decides what a provider can do
Section titled “The email rule decides what a provider can do”A provider is only allowed to attach itself to an existing account when it returns an email address and asserts that the address is verified. Otherwise anyone who could claim an unverified address at that provider could take over the matching account on your site.
That splits the nineteen into three groups.
| Providers | What they can do | |
|---|---|---|
| Verified email | Google, Apple, Facebook, X, LinkedIn, GitHub, Discord, Twitch, Yahoo, Dropbox, Patreon, WordPress.com | Create an account, or sign in to an existing one matched by email |
| Unverified email | Microsoft, GitLab, Slack, Amazon, Spotify | Create an account. Cannot match an existing one by email |
| No email at all | Reddit, Pinterest | Neither. Can only be linked by a member who is already signed in |
Reddit and Pinterest are still worth offering to a community built around them — a member signs in once by another means, links the account from Social Connects, and uses it from then on.
Apple’s rule about offering Apple
Section titled “Apple’s rule about offering Apple”Apple’s App Store guideline 4.8 requires Sign in with Apple wherever an app offers another third-party sign-in. Offer Google without Apple and the build is rejected. The readiness audit checks this before you submit — see Store readiness.
Google is the common trigger, but the rule is about any of the nineteen.
Instagram is not on the list
Section titled “Instagram is not on the list”Instagram sign-in spoke Instagram Basic Display, which Meta shut down in December 2024. The replacement is a different API that still returns no email address, so it could never have done more than Reddit and Pinterest do. The button was removed rather than left drawing something that could not work.
When it does not work
Section titled “When it does not work”| Symptom | Cause | Fix |
|---|---|---|
| No provider buttons appear | The Social Login group is off | Enable the endpoints you need |
| A provider you set up is missing | Its credentials are incomplete on the site | Check its section under Memberside → API Keys |
| A provider is set up but not offered on a screen | It was not picked on that feature | Choosing providers |
| Sign-in works in preview, fails on the phone | The signing SHA-1 is not registered | Android signing |
| Sign-in makes a second account instead of using the existing one | The provider’s email is unverified, so matching is refused | Have the member sign in first, then link it |
| The provider returns to a browser error page | The redirect URL is not registered there | Redirect URLs |