Social Login

Social Login, a key component of Authentication and Customer Registration, offers users the convenience of bypassing traditional forms. By signing into your website using their existing social media accounts, such as Facebook, Twitter, LinkedIn, Google, and more, users can effortlessly create customer profiles and enjoy seamless login experiences. This feature simplifies the onboarding process and enhances user convenience across various use cases.

Common Use Cases

• Frictionless Onboarding: This feature simplifies registration by allowing users to sign up or log in with their social media accounts.
• Seamless Data Collection: Social Login automatically fetches verified user data such as email, name, and profile picture, significantly reducing the need for additional input fields. This not only saves users time and effort but also simplifies the registration process for developers.
• Improved Engagement Rates: By offering a convenient login method that users are familiar with, Social Login can significantly boost sign-up and engagement rates. This not only enhances the user experience but also increases the reach and impact of your application.

To explore these workflows, visit our Live Demo Page to experience how Social Login can enhance your applications.

note

LoginRadius provides an Account Linking feature that links customer profiles from different providers. See Account Linking below.

Configurations

Enable Social Providers

• Navigate to the Authentication -> Identity Providers -> Social Providers section in the LoginRadius Admin Console.
• Choose the social providers (e.g., Google, Facebook, Twitter) you want to enable.
• Use the toggle switch on the right to enable the provider.
• Click on the provider's icon or name to open the Configuration tab.
• Go to the Setup Guide tab and follow the instructions to create an app in the provider’s developer portal.
• Obtain the Consumer Key and Consumer Secret from the developer portal.
• Return to the Configuration tab and enter the consumer Key and Secret in the input fields.
• Click Update to save the configuration.

note

To disable a social provider, simply toggle the switch to the OFF position.

Configure Redirect URLs

• Ensure the correct redirect URLs are configured so each social provider can handle login callbacks securely.
• Example of a Standard Redirect URI Format:

https://<LoginRadius tenant name>.hub.loginradius.com:443/socialauth/validate.sauth

• Note: The exact format may vary slightly based on the social provider's requirements. Configuration of Redirect URLs is managed in the respective social provider's app, not within the LoginRadius platform.

Customize Permissions

• Define the scope of data requested during login (e.g., email, profile, and contacts) based on your app's requirements. These permissions are typically managed by clicking the settings icon in the top-right corner of the Social Provider section in the LoginRadius Console, which opens a pop-up window.

Updating Existing Social Apps

You can reuse existing social apps integrated with your website or update them to support additional settings. Follow these steps to manage this process:

• Following the instructions provided earlier, configure the desired social provider.
• Once you've selected a provider, locate the section to set valid Redirect URIs or Website URIs.
• Modify the existing URI to match the format specified in the documentation. Common formats include:
  • <LoginRadius tenant name>.hub.loginradius.com
  • <LoginRadius tenant name>.hub.loginradius.com:443/socialauth/validate.sauth
• Save your changes and continue with the remaining setup steps.

Impact of Updating a Social App

• Updating the Consumer key and Consumer Secret for a social provider will trigger the following behaviors:
  • Users will be prompted again to grant access (e.g., email, public profile).
  • If the email address matches, LoginRadius will link the new provider ID to the same UID.
  • The UID remains unchanged; users may have two social provider IDs under the same UID.
  • No impact on users registered via standard registration or other providers.

Integration Guide

This section offers a detailed walkthrough for integrating a robust and secure social login process into your application using LoginRadius. It includes back-end integration, front-end customization, LoginRadius SocialLogin Library functions, programmatic links, SDKs and Libraries, and post-login management to deliver a seamless user experience.

Implementing Social Login Using LoginRadius JavaScript Interface

LoginRadius provides a built-in JavaScript interface to render a customizable social login experience.

Create Custom Interface

var custom_interface_option = {};
custom_interface_option.templateName = "loginradiuscustom_tmpl";

LRObject.util.ready(function () {
  LRObject.customInterface(".interfacecontainerdiv", custom_interface_option);
});

Add an HTML container where the interface will be rendered:

<div id="interfacecontainerdiv" class="interfacecontainerdiv"></div>

Apply Social Login Template

Define a social login button template using JavaScript.

<script type="text/html" id="loginradiuscustom_tmpl">
    <a class="lr-provider-label" href="javascript:void(0)"
       onclick="return <#=ObjectName #>.util.openWindow('<#=Endpoint #>');"
       title="<#=Name #>"
       alt="Sign in with <#=Name #>">
        <#=Name #>
    </a>
</script>

This template dynamically generates social login buttons based on configured providers.

Process Login Response

When a user logs in, the response contains the access token and the user’s social profile.

var sl_options = {};
sl_options.onSuccess = function (response) {
  // Login Successful
  console.log("Access Token:", response.access_token);
  console.log("User Profile:", response.Profile);

  // Store the access token securely
  localStorage.setItem("lrAccessToken", response.access_token);
};

sl_options.onError = function (errors) {
  // Handle login errors
  console.error("Social Login Failed:", errors);
};

sl_options.container = "sociallogin-container";

LRObject.util.ready(function () {
  LRObject.init("socialLogin", sl_options);
});

Display Social Login UI

• Identify Placement: Determine where you want the social login buttons to appear on your webpage, such as a login page, signup form, or modal popup.

• Insert HTML Container: Add the following <div> element to your webpage at the desired location:

<div id="sociallogin-container">
</div>

• Ensure Proper Styling: Apply CSS styles to adjust the layout, spacing, and alignment of the social login buttons within the container.

API-Driven Approach

If you obtain a social provider's access token (e.g., from Google, Facebook, etc.) separately, you can exchange it for a LoginRadius access token.

Get Social Access Token

Capture the access token from the provider’s response.

• Google OAuth: Returns both an ID token and an access token.
• Facebook SDK: Issues an access token after login.
• Firebase: Generates an authentication token for the signed-in user

Exchange for LoginRadius Token

Use the Social Token to LoginRadius Token API:

API Endpoint:

POST https://api.loginradius.com/identity/v2/auth/sociallogin

Request Body:

{
  "provider": "google",
  "token": "your_social_access_token",
  "key": "your_loginradius_api_key"
}

Replace:

• "google" with the correct provider name.
• "your_social_access_token" with the token received from Google, Facebook, etc.
• "your_loginradius_api_key" with your LoginRadius API key.

Handle Token Response

Upon success, LoginRadius returns a new access token and user profile.

Example Response:

{
  "access_token": "your_loginradius_token",
  "Profile": {
    "FullName": "John Doe",
    "Email": "john.doe@example.com",
    "Provider": "google"
  }
}

Authenticate with LoginRadius Token

• Secure Token Storage: Store the access_token securely to prevent unauthorized access.
• Use for API authentication: Include the access_token in API requests to authenticate and authorize user actions.
• Reference V2JS Library: Utilize the V2JS Library Documentation for token management and authentication implementation.

Using Programmatic Link

You can create custom links for buttons or trigger social login. To initiate authentication, format your links as follows:

• Link Format:

https://<Site-Name>.hub.loginradius.com/RequestHandler.aspx?apikey=<LoginRadius API Key>&provider=<Provider Name>

In the above, replace <your LoginRadius tenant name> with your actual LoginRadius tenant name, <your LoginRadius API Key> with your API key, and <Provider Name> with the lowercase name of the social provider (e.g., Facebook, twitter, etc.).

Account Linking

What is Account Linking?

Account Linking allows all of a user's login methods to resolve to one centralized account, regardless of which one they used to sign in this time.

There are three ways an account can get linked:

• Automatic Account Linking : If a new social profile's verified email matches an existing account's verified email, LoginRadius creates the social profile and links it to the existing account under the same Account ID (UID) automatically.
• User-Initiated Linking : If a user updates their email on the provider side and later logs in with that provider, LoginRadius detects the change and links it to the account with the matching verified email.
• API-Based (Programmatic) Linking : Your application calls a Link/Unlink API directly, so linking happens on your own logic and timing rather than LoginRadius's built-in matching.

API-Based Account Linking

Use this approach when linking needs to happen under your application's own control, for example, letting a logged-in user attach a second provider from an account settings page, merging two known accounts, or catching cases automatic matching won't (unverified email, no email returned by the provider, etc.).

How It Works

1. The user is already logged in, holding a valid access_token for their primary account.
2. The user authenticates with a second provider (via the JavaScript Interface or the API-Driven Approach above), producing a candidate token for that identity.
3. Your application calls the Link Social Identities API with both tokens.

Link Social Identities

POST /identity/v2/auth/socialIdentity

Request Body:

{
  "access_token": "<primary account's session token>",
  "candidateToken": "<token from the second provider's authentication>"
}

This associates the second provider's identity with the primary account rather than creating a new profile.

Note: For no-callback / polling flows (common in SPAs and mobile apps), use the Ping-based variant instead, which links using a client_guid your application generated rather than a candidate token.

Unlink Social Identities

DELETE /identity/v2/auth/socialIdentity/:provider

Request Parameters:

Parameter	Required	Description
access_token	Yes	Session token of the account to unlink from
provider	Yes	The provider being unlinked (e.g. facebook)
providerid	Yes	The provider-specific ID of the linked identity

The unlinked identity is removed from the account's linked set — it is not deleted as a standalone profile.

Security Note: Never link two identities purely because their emails match unless the email is verified on both sides and hasn't just changed. Without that check, an attacker could register with a victim's email and their own social account and have your system link them into the victim's existing profile. Always gate API-based linking behind the logged-in user's own session token — never an unauthenticated request that names which account to link into.

Account Linking in Identity Orchestration

The Social Login workflow template (Workflows → New Workflow → From Template) covers authentication only, it does not include account-linking logic out of the box. To add API-based linking inside a no-code flow, insert a custom Script node that calls the Link Social Identities API.

SDKs and Libraries

LoginRadius offers robust SDKs to simplify Social Login implementation:

• Web SDK:
  To implement Social login using Web SDK, please refer to this document.
• Mobile SDK
  To implement Social login using Mobile SDK, please refer to this document.

Post-Login Actions

1. Session Management:

   • Store the access token securely (e.g., in-session storage).

   • Handle token expiration securely to maintain user sessions.

     To learn more about managing sessions, please refer to this document.

2. Profile Enrichment:
   • Use the access token to fetch additional user details via LoginRadius Auth APIs.

ID Provider Limitations

When configuring social login apps, LoginRadius initially grants access to basic scopes like public profile data (e.g., public_profile on Facebook or r_liteprofile on LinkedIn). Advanced scopes—such as posting to social feeds or accessing friends lists—require explicit configuration and in most cases, provider review.

Be aware of provider-specific API call limits and token lifetimes, which may impact user experience and integration stability.

Provider Comparison

Provider	Token Lifetime	API Rate Limit
Facebook	2 hours	600 calls per 600 seconds per IP/token
Google	Never expires	N/A
Twitter	Never expires	Twitter Rate Limits
LinkedIn	60 days	LinkedIn Rate Limits

note

Google tokens may stop working if revoked, unused for 6 months, or if too many tokens are generated under one user account.

Facebook

Default Scopes

• public_profile (basic user info)
• email
• user_friends (app friends)

These permissions are granted by default and do not require review.

Requires Review The following scopes must be submitted for review via Facebook's developer portal:

• Extended profile fields
• Page and group management
• Posting to user timelines
• Open Graph data access

Deprecation Notice

Facebook no longer supports Direct Messaging APIs. Only the Send Dialog is supported, which is managed by Facebook directly and cannot be customized via LoginRadius.

Google

** Default Scopes**

• openid
• profile
• email

Limitations

• Tokens technically do not expire, but can become invalid if:
  • The user revokes access
  • The token is unused for more than 6 months
  • Too many tokens are generated (15–25 per user)

note

Google+ APIs are deprecated. Use the People API for user profile access instead.

Twitter

Default Scopes

• Read access (profile and timeline)

Requires Elevated Access: To post tweets or send Direct Messages, your app must request elevated access via the Twitter Developer Portal.

• Twitter Permissions & Rate Limits

LinkedIn

Default Scopes

• r_liteprofile
• r_emailaddress

Advanced Scopes (Require Approval)

• w_member_social – Post updates on behalf of users
• rw_organization_admin – Manage LinkedIn Pages
• r_organization_social – Read organization posts

Scope configuration and meanings: LinkedIn Permissions Guide

Limit Social Data Collection

To enhance privacy, your LoginRadius tenant can be configured from the backend to restrict the storage of data received from Social Providers during Social Login or Registration. With this setup, only the fields defined in your Registration Schema will be stored in our system.

note

Contact LoginRadius at support@loginradius.com to have this feature enabled for your app.

Best Practices

• Review Provider Docs: Check token handling, permissions, and review requirements before going live (e.g., secure storage, HTTPS, short lifetimes).
• Limit Scope to Necessity: Only request what your app truly needs to avoid lengthy approval processes.
• Use Test Accounts: Validate behavior with test users before production rollout.
• Track Provider Updates: API limitations and permission models change frequently. Stay up to date with developer changelogs.
• Review redirect URI configuration:Configure accurate Redirect URIs to prevent callback failures.
• Verify Before Linking: Require verified, current email addresses before treating two identities as the same user during API-based linking.

Related Resources

SDK LibrariesSocial Login APIsData Points by ProviderStandard LoginCustomer Identity APIsLoginRadius Social Data Points