Let shoppers sign in and register with the accounts they already use — on your sign-in page and at checkout.
Free
No payment needed, with 12 months of updates.
Add it to your cart and complete the free checkout. Your ZIP downloads and Composer access will be in your account.
No subscription or automatic renewal. Keep using the versions included in your update period. Update and licence details
Composer package softaware/module-social-login
Every extra form field costs you customers. Social Login lets shoppers sign in and create an account with Google, Facebook or X in one click: on the sign-in page, the registration page, the checkout and anywhere else you place the buttons.
It is built for production stores: no third-party SDKs, every ID token fully validated, PKCE where the provider supports it, and careful rules for linking an existing account so a social sign-in can never be used to take over someone else's account. It works on Luma and Hyvä, per website and store view, and stores nothing but the link between the customer and the provider.
Shoppers use the account they already have. No form to fill in and no new password to remember.
The buttons sit in the checkout sign-in popup and above the email field, right where shoppers decide.
Every ID token is validated and accounts are only linked when the email address can be trusted.
All features
Feature tour
01 / 07
Buttons above the sign-in and registration forms. Icon and text or icon only, light or dark, in the order you choose.
02 / 07
The "Sign In" popup on the checkout page and the authentication popup show the same buttons, so returning customers check out faster.
03 / 07
Alpine.js and Tailwind templates for Hyvä 1.3+, picked automatically. Luma, Blank and their child themes work out of the box.
04 / 07
Buttons stack into full-width rows on phones, where typing an email address and a password is hardest.
05 / 07
My Account › Connected Accounts lists the linked providers. Customers connect another one or disconnect one — never the last way to sign in.
06 / 07
Choose where the buttons appear, how they look, what happens after sign-in and which customer group new accounts join.
07 / 07
Each provider shows the callback URL to register for the current store view, with short setup steps. Secrets are stored encrypted.
Live demo
A full Magento store with the module installed, on Luma and on Hyvä. The admin demo signs you in with one click.
Compatibility
| Magento | 2.4.7 – 2.4.9 |
|---|---|
| Storefront themes | Luma Blank Hyvä |
| PHP | 8.2 – 8.5 |
| Latest version | 1.3.0 · 7 Oct 2026 |
| composer.json requires | php ~8.2.0||~8.3.0||~8.4.0||~8.5.0 ext-json * ext-openssl * magento/framework ~103.0.7 softaware/module-core ^1.0 magento/module-backend * magento/module-checkout * magento/module-config * magento/module-customer * magento/module-store * magento/module-ui * magento/module-widget * |
Installation
Get it free, create a Composer key in your account, then in the root of your Magento project:
01Add the repository and your key (once per project)
composer config repositories.softaware composer https://repo.softawarecommerce.com composer config --auth http-basic.repo.softawarecommerce.com PUBLIC_KEY PRIVATE_KEY
02Install the module
composer require softaware/module-social-login
03Enable it
bin/magento setup:upgrade bin/magento setup:di:compile bin/magento setup:static-content:deploy bin/magento cache:flush
The last three are only needed in production mode.
Prefer a zip? Every version you are entitled to can be downloaded from My modules. More about Composer access
User guide
For version 1.3.0. The same guide comes with the module, in docs/user-guide.md.
Let customers sign in and register with Google, Facebook and X (Twitter) in one click. This guide covers installation, configuration, provider setup and day-to-day use.
| Magento | Open Source or Adobe Commerce 2.4.7 – 2.4.9 |
| PHP | 8.2 – 8.5 with ext-openssl and ext-json |
| Themes | Luma, Blank and themes based on them; Hyvä 1.3+ |
| Other | softaware/module-core (installed automatically) |
No provider SDKs or JWT libraries are installed: the module talks to the providers through Magento's own HTTP client and PHP's OpenSSL extension.
With Composer (recommended). Use the access keys from your account on shop.softawarecommerce.com:
composer config repositories.softaware composer https://repo.softawarecommerce.com
composer config --auth http-basic.repo.softawarecommerce.com PUBLIC_KEY PRIVATE_KEY
composer require softaware/module-social-login
bin/magento setup:upgrade
bin/magento setup:di:compile # production mode only
bin/magento setup:static-content:deploy # production mode only
bin/magento cache:flushOn Hyvä, the module's templates are picked automatically. If you build Tailwind CSS from your theme, run your usual Hyvä build after installing so the button styles are included.
To update later: composer update softaware/module-social-login, then the same bin/magento commands.
https://www.example.com/sociallogin/auth/callback/provider/google/.
All settings can be set per website and store view, so each domain can use its own provider apps.
| Setting | What it does |
|---|---|
| Enabled | Switches the whole module on or off. When off, no buttons are shown and the sign-in URLs return 404; existing links between customers and providers are kept. |
| Sign-in Window | Full-page redirect or Popup. A popup keeps the shopper on the current page; browsers that block it fall back to a redirect. |
| Button Style | Icon and text, or icon only. |
| Button Colour | Light or dark. |
| Setting | What it does |
|---|---|
| Sign-in Page | Buttons above the sign-in form. |
| Create Account Page | Buttons above the registration form. |
| Authentication Popup and Checkout Sign-in | Luma: the "Checkout using your account" popup and the "Sign In" link on the checkout page. Hyvä: the authentication popup. |
| Checkout Email Step | Buttons above the email field in the shipping step (guests only). |
The buttons are also available as a CMS widget and a layout block (section 7).
| Setting | What it does |
|---|---|
| Create New Accounts | Yes: shoppers without an account get one on their first social sign-in. No: only existing customers can sign in with a provider (useful for trade-only shops). |
| Existing Account with the Same Email | Link automatically when the provider has verified the address and is responsible for it, or Ask for the password every time. Other addresses always ask for the account password once. |
| Send Welcome Email to New Customers | Sends the "Welcome Email (without password)" template. |
| Customer Group for Social Sign-ups | The store's default group or a fixed group. |
| After Sign-in | Stay on the current page, go to My Account, or a custom URL. |
Each provider has Enabled, its credentials (stored encrypted), an optional Button Label (empty = "Continue with …") and a Sort Order for the button position.
Register the callback URL shown under the provider's Enabled field. With several store views or domains, register one callback URL per store view URL.
| Provider | Where to create the app | What to enter in Magento |
|---|---|---|
| Google Cloud Console > APIs & Services > Credentials > Create OAuth client ID (Web application); add the callback under "Authorised redirect URIs". | Client ID, Client Secret | |
Meta for Developers: add the Facebook Login product, enter the callback under "Valid OAuth Redirect URIs", request the email permission. | App ID, App Secret, Graph API version | |
| X | X Developer Portal > User authentication settings: OAuth 2.0, type "Web App", callback URL. | Client ID, Client Secret; "Request Email Address" only if the app has the email permission |
Signing in or registering. The customer clicks a button, approves at the provider and is signed in. A new customer gets an account with the name and email from the provider. If the provider gives no email (X without the email permission) or no name, the customer fills in a short form once.
Existing customers. If a customer with the same email already exists, the identity is linked to that account (automatically or after the password, see Accounts). From then on the provider signs them in directly.
Unverified addresses. A new account made from an address the provider has not verified must be confirmed with Magento's confirmation email before it can be used, even if your store does not normally require confirmation.
Connected Accounts. Under My Account > Connected Accounts customers see their linked providers, connect another one or disconnect one. Disconnecting is refused when it would leave the account without any way to sign in (no password and no other provider).
Hyvä and mobile. The Hyvä templates are included and the buttons stack on small screens.
| Hyvä | Mobile |
|---|---|
 |  |
CMS widget: Content > Widgets > Add Widget > "Softaware Social Login Buttons" (heading, style, colour), or Insert Widget in a page or block.
Layout XML:
<block class="Softaware\SocialLogin\Block\Buttons" name="my.social.buttons">
<arguments>
<argument name="place" xsi:type="string">widget</argument>
<argument name="title" xsi:type="string">Sign in with</argument>
</arguments>
</block>The block picks the Luma or Hyvä template automatically and hides itself for signed-in customers in the browser, so it is safe on full-page-cached pages.
Links of a provider that is not installed (for example after removing an add-on) stay visible with their provider code and can be removed; customers can remove them under Connected Accounts too.
bin/magento softaware:social-login:links [--customer=<id|email>] [--provider=google] [--limit=50]
bin/magento softaware:social-login:unlink <link_id>
bin/magento softaware:social-login:self-test [--accounts]self-test lists the registered providers and checks the security pieces (PKCE, ID token validation including tampered, expired and wrong-audience tokens, return URL handling, email trust rules) without calling any provider. Installed add-ons such as Social Login Pro add their own checks. With --accounts it also checks the account-matching rules using temporary test customers that are deleted afterwards.
| Problem | Solution |
|---|---|
| The buttons do not appear | Check General > Enabled, the provider's Enabled, client ID and secret for the store view you are looking at, then flush the cache. |
| "redirect_uri_mismatch" or similar at the provider | The callback URL registered at the provider differs from the one shown in Magento (http vs https, www, store code, trailing slash). Copy it again exactly. |
| The popup does not open | The browser blocked it; the module falls back to a full-page redirect. Choose Full-page redirect if you prefer. |
| Customer is asked for the password | Expected when the provider has not verified the address or is not responsible for it (see Accounts). It happens once; afterwards the provider signs them in directly. |
| Sign-in fails | See var/log/softaware_sociallogin.log for the technical reason (no secrets or tokens are logged). |
The add-on Social Login Pro (softaware/module-social-login-pro) adds Sign in with Apple, Microsoft (Entra ID), LinkedIn, Amazon and GitHub. After installing it (composer require softaware/module-social-login-pro, then the bin/magento commands from section 2), the new providers appear as groups in the same configuration section and use all the settings in this guide. Its own user guide describes the provider setup.
bin/magento module:disable Softaware_SocialLogin
composer remove softaware/module-social-login
bin/magento setup:upgradeIf Social Login Pro is installed, remove it first (composer remove softaware/module-social-login-pro).
Customers created through social sign-in keep their accounts; they can set a password with "Forgot Your Password?".
Changelog
icons argument of ViewModel\ProviderIcons), self-test checks (Model\SelfTest\CheckInterface, checks argument of the self-test command), and the callback URL comment for the admin (documented in the README together with the provider pool and the settings).Documentation
softaware/module-core instead of softaware/module-base. The admin menu and ACL now sit under Softaware_Core::core ("Softaware"); roles that had access keep it (migrated by module-core). After updating all SoftAware modules, softaware/module-base can be removed.https:///evil.example/ or https://evil.example\@your-shop/ passed the "own host" check (PHP and browsers read them differently) and sent the customer to another site after signing in. Return URLs are now parsed strictly (no backslashes, control characters, user info or empty hosts) before the host check.First release.
form_post callback with session restore.softaware:social-login:links, softaware:social-login:unlink, softaware:social-login:self-test.FAQ
Something else on your mind? The developers who wrote the module answer before and after you buy.
Ask a question →Already installed it? Open a support ticket
Google, Facebook and X (Twitter). Each one can be switched on separately, per website or store view.
Yes, with the add-on Social Login Pro. It adds these five providers to the same configuration section, buttons, Connected Accounts page and admin tools; everything described here applies to them too.
Yes. Hyvä templates are included (Hyvä 1.3+, tested with 1.5). On the Hyvä checkout the Luma checkout fallback is used, so the checkout buttons are the Luma ones.
No. OAuth 2.0 and OpenID Connect are implemented on Magento's HTTP client and PHP's OpenSSL extension, so there are no extra libraries to keep up to date or to conflict with other extensions.
On the sign-in page, the create-account page, the authentication popup and the checkout sign-in, above the email field in checkout (guests), anywhere as a CMS widget, and anywhere in your layout as a block.
The provider is linked to that account. If the provider has verified the address and is responsible for it (for example Gmail addresses at Google), this happens automatically; otherwise, or if you choose so, the customer enters their account password once. After that the provider signs them in directly.
Yes: set Create New Accounts to No. Shoppers without an account are asked to register first. This is useful for B2B and trade-only shops.
Yes, with Softaware Customer Approval: social sign-ups get an approval status like any other registration, and pending or rejected customers are not signed in.
X never returns one unless your app has the email permission. The customer then enters an email address once; an account created from a typed-in address must be confirmed by email before it can be used.
Yes, under My Account > Connected Accounts. The module refuses to remove the last way to sign in (no password and no other provider). Admins can remove links under Softaware > Social Login > Linked Accounts.
Only the link between the customer and the provider account is stored, no access tokens. Links are deleted with the customer, and pending sign-in data is deleted after 15 minutes.
Every sign-in uses a single-use state bound to the browser, PKCE where the provider supports it, and full ID token validation (signature, issuer, audience, expiry, nonce). Email addresses are only trusted when the provider has verified them, and accounts from unverified addresses must be confirmed by email first. Return URLs are restricted to your own store.
Yes. All settings, including the credentials, can be set per website and store view. Register one callback URL per store view URL at the provider.
Yes, developers can implement ProviderInterface (or extend AbstractOidcProvider) and register it in di.xml; icons, settings and self-test checks have extension points too. See the README.
They are kept and shown with their provider code in the admin and under Connected Accounts, where they can be removed. They are not counted as a way to sign in, so customers are never left without one.
Magento Open Source and Adobe Commerce 2.4.7 – 2.4.9, PHP 8.2 – 8.5.
Support
Social Login Pro
Social Login Pro adds five more providers to the same buttons, settings and account rules.
See Social Login Pro →| Feature | Free | Pro |
|---|---|---|
| Google, Facebook and X | ||
| Apple (Sign in with Apple) | ||
| Microsoft personal and work accounts | ||
| LinkedIn, Amazon and GitHub | ||
| All placements, popup, widget and layout block | ||
| Account linking rules and Connected Accounts | ||
| Hyvä and Luma |
From the blog
Why Luma extensions break on a Hyvä storefront, how to check an extension before you buy or migrate, and the four ways to fix it: vendor support, a compatibility module, the Luma theme fallback or your own compat module.
A practical walkthrough of installing, updating and removing Magento 2 extensions with Composer, including private repositories, auth.json and the errors you are most likely to meet.
Buy when the requirement is common and a well-built extension fits your processes. Build when the logic is unique to your business or ties into your own systems. Here is how to tell the difference.
What the published data says about social login: how often it is used, which providers win, how passkeys and in-app browsers change the picture, and what that means for a Magento store.
Where to create each sign-in app, which callback URL and scopes to use, what each provider charges or reviews, and where the keys go in the Magento admin.
We use necessary cookies to run this site and, with your permission, Google Analytics to understand how it is used. You can accept analytics, reject it or choose in the settings. Cookie policy
Choose which cookies you allow. Necessary cookies are always on because the shop cannot work without them. You can change your choice at any time with the "Cookie settings" link.
Needed for the basket, checkout, login and security. They do not track you.
Google Analytics: how many people visit, which pages they read and how they found the site. It sets the _ga cookies and sends usage data to Google.