Skip to main content

Providers

Each Social Login provider in Centra is backed by two values you obtain from the provider's own developer console:

  • Issuer URL: The OIDC discovery root. Storefront API fetches <issuer>/.well-known/openid-configuration from it.
  • Client ID: The public identifier for the OAuth/OIDC client you register with the provider.

You configure these in the Centra back office under Stores management → Stores → Select Store: Plugins → Add plugin method → Plugin: Social Login.

This page covers where to obtain the values on the provider side.

note

You will also need to register one or more redirect URIs on the provider side pointing back at your domain, not at Centra. Storefront API never participates in the OAuth redirect. Your server owns the redirect; Centra only sees the final ID token.

Google​

Google is a standard OIDC provider.

  • Issuer URL: https://accounts.google.com
  • Client ID: created in Google Cloud Console → APIs & Services → Credentials → Create credentials → OAuth client ID → Web application.

Steps:

  1. Go to https://console.cloud.google.com/apis/credentials.
  2. Pick (or create) a project.
  3. Configure the OAuth consent screen for your brand.
  4. Create an OAuth 2.0 Client ID of type Web application.
  5. Add your redirect URI (e.g. https://shop.com/api/auth/callback/google).
  6. Copy the Client ID into the Centra back office. The client secret is held by your backend; Centra does not need it.

Authoritative reference: https://developers.google.com/identity/openid-connect/openid-connect.

Apple​

Apple ("Sign in with Apple") is OIDC-compatible but has several quirks you should know about before shipping.

  • Issuer URL: https://appleid.apple.com
  • Client ID: the Services ID you create in the Apple Developer portal (not the App ID or Bundle ID).

Steps:

  1. Go to https://developer.apple.com/account/resources/identifiers/list.
  2. Create (or reuse) an App ID and enable Sign in with Apple on it.
  3. Create a Services ID. Its identifier (e.g. com.example.shop.web) is the Client ID you register with Centra.
  4. Under the Services ID, configure Sign in with Apple: add your domain and the redirect URL that will receive the token.
  5. Create a Sign in with Apple key and download the .p8 private key for your application to use to generate the client secret JWT. Centra does not need the key.
  6. Copy the Services ID into the Centra back office as the Client ID.
warning

email_verified can be false for Apple. For company and school managed Apple IDs, Apple returns email_verified: false. Storefront API rejects these.

email can be missing for Apple. Same scenario: some managed accounts do not expose an email claim at all.

Names only on first authorization. Apple returns given_name and family_name only the first time a shopper authorizes your Services ID. On subsequent authorizations these fields will not be returned. Your application should capture the name from Apple's response on first consent and pass it via SocialLoginVerifyInput.overrides. Centra will use the override only when the claim is absent, so it is always safe to pass.

Authoritative reference: https://developer.apple.com/documentation/sign_in_with_apple.

Facebook​

Facebook is OIDC-compatible when you request the openid scope through Facebook Login.

  • Issuer URL: https://www.facebook.com
  • Client ID: the App ID from your Facebook developer app.

Steps:

  1. Go to https://developers.facebook.com/apps/.
  2. Create an app of type Consumer.
  3. Add the Facebook Login product.
  4. Under Facebook Login → Settings, add your redirect URI.
  5. Request the email and openid permissions. Depending on your use case you may need to submit the app for App Review before email is available to all users.
  6. Copy the App ID into the Centra back office as the Client ID.
note

email can be missing for Facebook. If the user signed up to Facebook with a phone number only, or never confirmed an email address, no email claim will be present and the login will be rejected. This is the same failure mode as Apple's managed accounts — fall back to email/password.

Authoritative reference: https://developers.facebook.com/docs/facebook-login/guides/advanced/oidc-token

Generic OIDC​

Any standards-compliant OIDC provider can be configured in the Centra back office.

  • Issuer URL: the discovery root.
  • Client ID: the client ID registered with the provider.

The ID token must still:

  • Be signed with RS256 or ES256.
  • Carry a valid sub.
  • Carry a non-empty email.
  • Carry email_verified.
warning

Discovery and JWKS endpoints must respond within one second. A provider that regularly exceeds it will cause login failures.

Common broker-specific pointers:

Common issues​

  • Issuer URL has a trailing path that does not match the one in the token's iss claim.
  • Client ID in the back office does not match the token's aud claim.
  • Provider discovery or JWKS endpoint is slower than one second.
  • Clock skew on the device issuing the token.
Tags:
Last updated on