Social Login

One-click sign-in for the customer account — no password to invent, no theme files to edit.

• Google, Facebook and Apple out of the box, each switched on independently.
• OAuth 2.0 / OpenID Connect done properly: single-use state, PKCE (S256) for Google, id_token signatures verified against the provider JWKS (RS256 and ES256) with iss, aud and exp checks.
• Facebook tokens are validated with debug_token, so a token issued for a different app is rejected; profile calls are signed with appsecret_proof.
• Apple client_secret is generated on the fly as an ES256 JWT from your .p8 key — nothing to rotate by hand for six months.
• Accounts are matched by a verified e-mail only; auto-registration can be switched off, so only existing customers get in.
• Buttons appear automatically on the sign-in and sign-up pages, or place them anywhere with the social_login_buttons tag; a theme can override the markup.
• Account tab "Social accounts" lets customers connect and disconnect providers themselves.
• Sign-in log in the admin panel: provider, result, e-mail and a hashed IP — enough to explain any failed login.
• Access tokens are never stored, secrets stay in the options table and never reach the page.
• Interface in English, Russian and Ukrainian.