PHPackages                             yu-dev/module-social-login - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Authentication & Authorization](/categories/authentication)
4. /
5. yu-dev/module-social-login

ActiveMagento2-module[Authentication & Authorization](/categories/authentication)

yu-dev/module-social-login
==========================

Magento 2 social login: customer sign-in and registration via Google, Facebook, Apple, X (Twitter), GitHub, LinkedIn, Microsoft, Amazon and Yahoo — free, open source, powered by HybridAuth.

v1.0.1(1mo ago)05MITPHPPHP >=8.1

Since Jul 17Pushed 1mo agoCompare

[ Source](https://github.com/yuriyakishin/magento2-social-login)[ Packagist](https://packagist.org/packages/yu-dev/module-social-login)[ RSS](/packages/yu-dev-module-social-login/feed)WikiDiscussions main Synced 1w ago

READMEChangelogDependencies (10)Versions (3)Used By (0)

Magento 2 Social Login
======================

[](#magento-2-social-login)

[![Live demo](https://camo.githubusercontent.com/abeb1934d56ea63cc066079b44323fa78c75fe849c4cc2a70b2d0b8ade82a724/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f64656d6f2d79752e6e65742e75612d3265613434663f7374796c653d666f722d7468652d6261646765)](https://yu.net.ua/customer/account/login/)

**🔗 Demo: [yu.net.ua](https://yu.net.ua/customer/account/login/)**

Free, open-source Magento 2 extension: customers sign in and register with Google, Facebook, Apple, X (Twitter), GitHub, LinkedIn, Microsoft, Amazon or Yahoo. Built on top of [HybridAuth](https://hybridauth.github.io/), which handles the OAuth protocol work (redirects, token exchange, CSRF `state`validation), so the module stays small and focused on Magento integration.

[![Social login buttons on the customer login page](docs/images/login-buttons.png)](docs/images/login-buttons.png)

Supported providers
-------------------

[](#supported-providers)

ProviderCredentialsNotesGoogleClient ID / Client SecretEmail is always provided · [Get credentials](https://console.cloud.google.com/apis/credentials)FacebookApp ID / App SecretApp must pass Facebook review for public use; accounts registered by phone may come without email · [Get credentials](https://developers.facebook.com/apps/)X (Twitter)Client ID / Client SecretEnable "Request email from users" in the app settings, otherwise users are asked for their email · [Get credentials](https://developer.x.com/en/portal/dashboard)GitHubClient ID / Client SecretPrivate emails are fetched via a separate API endpoint · [Get credentials](https://github.com/settings/developers)AmazonClient ID / Client Secret[Get credentials](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)YahooClient ID / Client SecretNeeds OpenID Connect / Profile / Email permissions · [Get credentials](https://developer.yahoo.com/apps/)LinkedInClient ID / Client SecretUses "Sign In with LinkedIn using OpenID Connect" (the modern product) · [Get credentials](https://www.linkedin.com/developers/apps)AppleServices ID / Team ID / Key ID / Private Key (.p8)Requires a paid Apple Developer account; the private key is stored encrypted · [Get credentials](https://developer.apple.com/account/)MicrosoftApplication (client) ID / Client SecretRegister the app in Microsoft Entra ID → App registrations, for "any organizational directory and personal Microsoft accounts" · [Get credentials](https://portal.azure.com/)Every provider is independent: enable only the ones you need. The "Get credentials" link in each row opens the developer console where you register the app.

**Not supported:** Instagram (Meta shut down the Basic Display API in December 2024 — consumer "Login with Instagram" no longer exists), VK (no HybridAuth 3.x adapter), Telegram (uses a Login Widget instead of OAuth — planned as a separate feature).

Requirements
------------

[](#requirements)

- PHP >= 8.1
- Magento 2.4.x (declarative schema is used, so 2.4+ only)
- `hybridauth/hybridauth` ^3.0

Installation
------------

[](#installation)

```
composer require yu-dev/module-social-login
bin/magento module:enable Yu_SocialLogin
bin/magento setup:upgrade
bin/magento setup:di:compile
bin/magento cache:flush
```

The `hybridauth/hybridauth` library is a composer dependency of the module and is installed automatically.

Manual installation (without composer)Copy the module to `app/code/Yu/SocialLogin` and install the OAuth library yourself — with a manual copy, composer does not know about the module's dependencies:

```
composer require hybridauth/hybridauth:^3.0
```

Then run the same `bin/magento` commands as above.

The module ships disabled by default — nothing appears on the storefront until you enable it in the admin, so it is safe to deploy first and configure later.

Configuration
-------------

[](#configuration)

**Stores → Configuration → Customers → Social Media Login**

[![Provider settings in the admin: credentials, sort order and the copyable Redirect URI](docs/images/admin-config.png)](docs/images/admin-config.png)

- **General → Enabled** — master switch on top of the per-provider switches.
- Per provider:
    - **Enabled** — the button appears only when the provider is enabled *and*its credentials are filled in.
    - **Credentials** — see the table above; secrets are stored encrypted with Magento's standard config encryption.
    - **Sort Order** — buttons with lower values appear first on the login and registration pages.
    - **Redirect URI** — read-only field with a Copy button. Paste this exact value into the provider's developer console (authorized redirect / callback URL). It is generated from your store's base URL, so it is always correct for the scope you are editing.

Console links for every provider are in the [Supported providers](#supported-providers) table above.

How it works
------------

[](#how-it-works)

1. The customer clicks a "Sign in with …" button on the login or registration page and goes through OAuth on the provider's side.
2. On callback the module resolves the profile:

    - the social account is already linked → the customer is logged in;
    - a customer with the same (provider-verified) email exists → the social account is linked to it and the customer is logged in;
    - no match → a new customer account is created (random password, standard welcome email), linked, and logged in;
    - the provider returned no email (phone-registered Facebook accounts, X apps without the email permission, Apple "Hide My Email" edge cases) → the customer is asked to enter an email on a dedicated form. If that email already belongs to an existing account, linking is **refused** — a manually typed email is unverified, and accepting it would let anyone hijack an account by claiming its email. The customer is asked to log in with their password and link the social account from their account area instead.
3. **My Account → Social Accounts** lists all providers with link/unlink actions.

    [![Social Accounts page in the customer account](docs/images/account-page.png)](docs/images/account-page.png) Multiple providers can be linked to one customer. Unlinking is always safe: every Magento customer has a password (a random one if the account was created via social login), so access is recoverable through the standard "Forgot password" flow.

Links between customers and social accounts live in the `yu_social_login`table (unique index on provider + social user id, FK to `customer_entity`with cascade delete).

Customizing the buttons
-----------------------

[](#customizing-the-buttons)

Each button is a separate child block with its own template, so a theme can change one button without touching the rest:

- **Restyle or replace one icon** — override a single small file in your theme: `Yu_SocialLogin/templates/social/buttons/.phtml`, or point the block to your own template via layout:

    ```

    ```
- **Reorder buttons** — no code needed, use the Sort Order field in the admin.
- **Remove a button** — disable the provider in the admin, or `` in a theme.
- **Add a provider** — see [Adding your own provider](#adding-your-own-provider)below: a third-party module can do it without changing this module.

Adding your own provider
------------------------

[](#adding-your-own-provider)

A provider is described entirely by configuration, so a third-party module can add one **without changing a single file of this module** — `config.xml`, `system.xml` and layout XML are all merged across modules. You need any HybridAuth 3.x adapter and three small files. The example below adds Okta as a module named `Acme_SocialLoginOkta`.

### 1. Declare the provider — `etc/config.xml`

[](#1-declare-the-provider--etcconfigxml)

The node under `yu_social_login` is the complete provider definition:

```

                0
                100
                Okta
                Hybridauth\Provider\OktaOIDC
                client_id,client_secret
                client_secret

```

- `label` — the brand name used on the button and in messages (fallback: capitalized code).
- `adapter` — the HybridAuth adapter class.
- `required_fields` — comma-separated credential fields that must be filled before the provider is considered configured; the button stays hidden until they are. There is no default — declare your own list.
- `encrypted_fields` — comma-separated fields stored encrypted. **Must match the fields your `system.xml` backs with `Backend\Encrypted`** (see step 2): a field listed here but stored plain — or the other way around — breaks the provider silently.
- `` (optional) — overrides the adapter's default OAuth scope (the bundled Microsoft provider uses this to trim its consent screen).

### 2. Admin settings — `etc/adminhtml/system.xml`

[](#2-admin-settings--etcadminhtmlsystemxml)

Add a group to the existing `yu_social_login` section; the Redirect URI field is rendered by this module's block and works for any provider code:

```

                Okta

                    Enabled
                    Magento\Config\Model\Config\Source\Yesno

                    Client ID

                    Client Secret
                    Magento\Config\Model\Config\Backend\Encrypted

                    Sort Order
                    validate-digits
                    Buttons with lower values appear first on the login and registration pages.

                    Redirect URI
                    Yu\SocialLogin\Block\Adminhtml\Config\RedirectUri

```

### 3. The button — layout + template

[](#3-the-button--layout--template)

`view/frontend/layout/yu_social_login_buttons.xml` (the handle is merged with this module's own file, so your block simply joins the list and takes part in the admin-driven sorting):

```

                    okta

```

`view/frontend/templates/button.phtml` — copy any bundled template (`view/frontend/templates/social/buttons/*.phtml` in this module) and replace the CSS modifier and the inline SVG icon:

```