Social Login

Social Login (OAuth) is an open standard for authentication that allows users to log in to one website or application using their credentials from another website or application. It is a way for users to grant third-party applications access to their online accounts without sharing their passwords. OAuth is commonly used for things like logging in to a social media account from a third-party app. It is a secure and convenient way to authenticate users and share information between applications.

Benefits#

There are several reasons why you might want to add social login to your applications:

• Improved user experience: Users can register and log in to your application using their existing social media accounts, which can be faster and more convenient than creating a new account from scratch. This makes it easier for users to access your application, improving their overall experience.

• Better user engagement: You can access additional data and insights about your users, such as their interests, demographics, and social connections. This can help you tailor your content and marketing efforts to better engage with your users and provide a more personalized experience.

• Increased security: Social login can improve the security of your application by leveraging the security measures and authentication protocols of the social media platforms that your users are logging in with. This can help protect against unauthorized access and account takeovers.

Set up a social provider with Supabase Auth#

Supabase supports a suite of social providers. Follow these guides to configure a social provider for your platform.

Google

Facebook

Apple

Azure

Twitter

GitHub

Gitlab

Bitbucket

Discord

Keycloak

LinkedIn

Notion

Slack

Spotify

Twitch

WorkOS

Zoom

Provider Tokens#

Once the OAuth flow completes, Supabase Auth will sign your user in. You will receive a copy of the provider token used in the OAuth flow in case you need to use it further. For example, you can use the Google provider token to access Google APIs on behalf of your user.

Provider tokens are intentionally not stored in your project's database, however. This is because provider tokens give access to potentially sensitive user data in third-party systems. Different applications have different needs, and one application's OAuth scopes may be significantly more permissive than another. If you do want to use the provider token outside of the browser that completed the OAuth flow, you will have to send it manually to a secure server under your control.