@capgo/capacitor-social-login
v6.0.1TypeScript
All social logins in one plugin
0/weekUpdated 2 days agoMITUnpacked: 431.2 KB
Published by Martin Donadieu
npm install @capgo/capacitor-social-login@capgo/capacitor-social-login
Fork Information
This plugin is a fork of @codetrix-studio/capacitor-google-auth. We created this fork because the original plugin is "virtually" archived with no way to reach the maintainer in any medium, and only one person (@reslear) has write rights but doesn't handle native code.
If you're currently using @codetrix-studio/capacitor-google-auth, we recommend migrating to this plugin. You can follow our migration guide here.
About
All social logins in one plugin
This plugin implements social auth for:
- Google (with credential manager)
- Apple (with OAuth on android)
- Facebook (with latest SDK)
- Twitter/X (OAuth 2.0)
- Generic OAuth2 (supports multiple providers: GitHub, Azure AD, Auth0, Okta, and any OAuth2-compliant server)
This plugin is the all-in-one solution for social authentication on Web, iOS, and Android.
It is our official alternative to the Appflow Social Login plugin.
Ionic Auth Connect compatibility
This plugin is designed to be compatible with Ionic Auth Connect provider names using the built-in OAuth2 engine.
Use the Auth Connect preset wrapper (SocialLoginAuthConnect) to log in with auth0, azure, cognito, okta, and onelogin.
- Compatibility guide: https://github.com/Cap-go/capacitor-social-login/blob/main/docs/auth_connect_compatibility.md
- Migration guide: https://github.com/Cap-go/capacitor-social-login/blob/main/MIGRATION_AUTH_CONNECT.md
Documentation
Best experience to read the doc here:
https://capgo.app/docs/plugins/social-login/getting-started/
Compatibility
| Plugin version | Capacitor compatibility | Maintained |
| -------------- | ----------------------- | ---------- |
| v8.\.\ | v8.\.\ | ✅ |
| v7.\.\ | v7.\.\ | On demand |
| v6.\.\ | v6.\.\ | ❌ |
| v5.\.\ | v5.\.\ | ❌ |
> Note: The major version of this plugin follows the major version of Capacitor. Use the version that matches your Capacitor installation (e.g., plugin v8 for Capacitor 8). Only the latest major version is actively maintained.
Install
``bash`
npm install @capgo/capacitor-social-login
npx cap sync
Dynamic Provider Dependencies
You can configure which providers to include to reduce app size. This is especially useful if you only need specific providers.
$3
Add provider configuration to your capacitor.config.ts:
`typescript
import type { CapacitorConfig } from '@capacitor/cli';
const config: CapacitorConfig = {
appId: 'com.example.app',
appName: 'MyApp',
webDir: 'dist',
plugins: {
SocialLogin: {
providers: {
google: true, // true = enabled (bundled), false = disabled (not bundled)
facebook: true, // Use false to reduce app size
apple: true, // Apple uses system APIs, no external deps
twitter: false // false = disabled (not bundled)
}
}
}
};
export default config;
`
$3
- true (default): Provider is enabled - dependencies are bundled in final APK/IPA
- false: Provider is disabled - dependencies are not bundled in final APK/IPA
$3
- Changes require running npx cap sync to take effecttrue
- If configuration is not provided, all providers default to (enabled, backward compatible)false
- Important: Disabling a provider () will make it unavailable at runtime, regardless of whether it actually adds any dependencies. The provider will be disabled even if it uses only system APIs.false
- This configuration only affects iOS and Android platforms; it does not affect the web platform.
- Important: Using means the dependency won't be bundled, but the plugin code still compiles against it. Ensure the consuming app includes the dependency if needed.
- Apple Sign-In on Android uses OAuth flow without external SDK dependencies
- Twitter uses standard OAuth 2.0 flow without external SDK dependencies
$3
To only include Google Sign-In and disable others:
`typescript`
plugins: {
SocialLogin: {
providers: {
google: true, // Enabled
facebook: false, // Disabled (not bundled)
apple: true, // Enabled
twitter: false // Disabled (not bundled)
}
}
}
Apple
How to get the credentials
How to setup redirect url
$3
For android you need a server to get the callback from the apple login. As we use the web SDK .
Call the initialize method with the apple provider
`typescript`
await SocialLogin.initialize({
apple: {
clientId: 'your-client-id',
redirectUrl: 'your-redirect-url',
},
});
const res = await SocialLogin.login({
provider: 'apple',
options: {
scopes: ['email', 'name'],
},
});
$3
call the initialize method with the apple provider
`typescript`
await SocialLogin.initialize({
apple: {
clientId: 'your-client-id', // it not used at os level only in plugin to know which provider initialize
},
});
const res = await SocialLogin.login({
provider: 'apple',
options: {
scopes: ['email', 'name'],
},
});
Docs: How to setup facebook login
$3
More information can be found here: https://developers.facebook.com/docs/android/getting-started
Then call the initialize method with the facebook provider
`typescript`
await SocialLogin.initialize({
facebook: {
appId: 'your-app-id',
clientToken: 'your-client-token',
},
});
const res = await SocialLogin.login({
provider: 'facebook',
options: {
permissions: ['email', 'public_profile'],
},
});
$3
In file ios/App/App/AppDelegate.swift add or replace the following:
`swift
import UIKit
import Capacitor
import FBSDKCoreKit
@UIApplicationMain
class AppDelegate: UIResponder, UIApplicationDelegate {
var window: UIWindow?
func application(_ application: UIApplication, didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?) -> Bool {
// Override point for customization after application launch.
FBSDKCoreKit.ApplicationDelegate.shared.application(
application,
didFinishLaunchingWithOptions: launchOptions
)
return true
}
...
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey: Any] = [:]) -> Bool {
// Called when the app was launched with a url. Feel free to add additional processing here,
// but if you want the App API to support tracking app url opens, make sure to keep this call
if (FBSDKCoreKit.ApplicationDelegate.shared.application(
app,
open: url,
sourceApplication: options[UIApplication.OpenURLOptionsKey.sourceApplication] as? String,
annotation: options[UIApplication.OpenURLOptionsKey.annotation]
)) {
return true;
} else {
return ApplicationDelegateProxy.shared.application(app, open: url, options: options)
}
}
}
`
Add the following in the ios/App/App/info.plist file inside of the outermost :
`xml
`
More information can be found here: https://developers.facebook.com/docs/facebook-login/ios
Then call the initialize method with the facebook provider
`typescript`
await SocialLogin.initialize({
facebook: {
appId: 'your-app-id',
},
});
const res = await SocialLogin.login({
provider: 'facebook',
options: {
permissions: ['email', 'public_profile'],
},
});
$3
For Google login to work properly across all platforms, you need different client IDs and must understand the requirements for each mode:
`typescript`
await SocialLogin.initialize({
google: {
webClientId: 'YOUR_WEB_CLIENT_ID', // Required for Android and Web
iOSClientId: 'YOUR_IOS_CLIENT_ID', // Required for iOS
iOSServerClientId: 'YOUR_WEB_CLIENT_ID', // Required for iOS offline mode and server authorization (same as webClientId)
mode: 'online', // 'online' or 'offline'
}
});
Important Notes:
- webClientId: Required for Android and Web platformsiOSClientId
- : Required for iOS platform iOSServerClientId
- : Required when using mode: 'offline' on iOS or when you need to verify the token on the server (should be the same value as webClientId)mode: 'offline'
- : Returns only serverAuthCode for backend authentication, no user profile datamode: 'online'
- : Returns user profile data and access tokens (default)
$3
The implementation use the new library of Google who use Google account at Os level, make sure your device does have at least one google account connected
Call the initialize method with the google provider:
`typescript`
await SocialLogin.initialize({
google: {
webClientId: 'your-web-client-id', // Required: the web client id for Android and Web
},
});
const res = await SocialLogin.login({
provider: 'google',
options: {
scopes: ['email', 'profile'],
},
});
$3
Call the initialize method with the google provider:
`typescript`
await SocialLogin.initialize({
google: {
iOSClientId: 'your-ios-client-id', // Required: the iOS client id
iOSServerClientId: 'your-web-client-id', // Required for offline mode: same as webClientId
mode: 'online', // 'online' for user data, 'offline' for server auth code only
},
});
const res = await SocialLogin.login({
provider: 'google',
options: {
scopes: ['email', 'profile'],
},
});
Offline Mode Behavior:
When using mode: 'offline', the login response will only contain:`typescript`
{
provider: 'google',
result: {
serverAuthCode: 'auth_code_for_backend',
responseType: 'offline'
}
// Note: No user profile data is returned in offline mode
}
$3
Initialize method to create a script tag with Google lib. We cannot know when it's ready so be sure to do it early in web otherwise it will fail.
OAuth2 (Generic)
The plugin supports generic OAuth2 authentication, allowing you to integrate with any OAuth2-compliant provider (GitHub, Azure AD, Auth0, Okta, custom servers, etc.). You can configure multiple OAuth2 providers simultaneously.
$3
`typescript`
await SocialLogin.initialize({
oauth2: {
// GitHub OAuth2
github: {
appId: 'your-github-client-id',
authorizationBaseUrl: 'https://github.com/login/oauth/authorize',
accessTokenEndpoint: 'https://github.com/login/oauth/access_token',
redirectUrl: 'myapp://oauth/github',
scope: 'read:user user:email',
pkceEnabled: true,
},
// Azure AD OAuth2
azure: {
appId: 'your-azure-client-id',
authorizationBaseUrl: 'https://login.microsoftonline.com/common/oauth2/v2.0/authorize',
accessTokenEndpoint: 'https://login.microsoftonline.com/common/oauth2/v2.0/token',
redirectUrl: 'myapp://oauth/azure',
scope: 'openid profile email',
pkceEnabled: true,
resourceUrl: 'https://graph.microsoft.com/v1.0/me',
},
// Auth0 OAuth2
auth0: {
appId: 'your-auth0-client-id',
authorizationBaseUrl: 'https://your-tenant.auth0.com/authorize',
accessTokenEndpoint: 'https://your-tenant.auth0.com/oauth/token',
redirectUrl: 'myapp://oauth/auth0',
scope: 'openid profile email offline_access',
pkceEnabled: true,
additionalParameters: {
audience: 'https://your-api.example.com',
},
},
},
});
Auth Connect Presets (Auth0, Azure AD, Cognito, Okta, OneLogin)
If you want the same provider names as Ionic Auth Connect, use the preset wrapper. It maps those providers to the existing OAuth2 engine.
`typescript
import { SocialLoginAuthConnect } from '@capgo/capacitor-social-login';
await SocialLoginAuthConnect.initialize({
authConnect: {
auth0: {
domain: 'https://your-tenant.auth0.com',
clientId: 'your-auth0-client-id',
redirectUrl: 'myapp://oauth/auth0',
audience: 'https://your-api.example.com',
},
azure: {
tenantId: 'common',
clientId: 'your-azure-client-id',
redirectUrl: 'myapp://oauth/azure',
},
okta: {
issuer: 'https://dev-12345.okta.com/oauth2/default',
clientId: 'your-okta-client-id',
redirectUrl: 'myapp://oauth/okta',
},
},
});
const auth0Result = await SocialLoginAuthConnect.login({
provider: 'auth0',
});
`
Notes:
- Presets can be overridden: any oauth2 entry with the same provider key (for example, oauth2: { auth0: ... }) overrides the preset for that provider.authorizationBaseUrl
- If your provider uses non-standard endpoints, override , accessTokenEndpoint, resourceUrl, or logoutUrl in the preset.
$3
`typescript
// Login with GitHub
const githubResult = await SocialLogin.login({
provider: 'oauth2',
options: {
providerId: 'github', // Required: must match key from initialize()
},
});
// Login with Azure AD
const azureResult = await SocialLogin.login({
provider: 'oauth2',
options: {
providerId: 'azure',
scope: 'openid profile email', // Optional: override default scopes
},
});
console.log('Access Token:', azureResult.result.accessToken?.token);
console.log('ID Token:', azureResult.result.idToken);
console.log('User Data:', azureResult.result.resourceData);
`
$3
`typescript`
const status = await SocialLogin.isLoggedIn({
provider: 'oauth2',
providerId: 'github', // Required for OAuth2
});
console.log('Is logged in:', status.isLoggedIn);
$3
`typescript`
await SocialLogin.logout({
provider: 'oauth2',
providerId: 'github', // Required for OAuth2
});
$3
`typescript`
await SocialLogin.refresh({
provider: 'oauth2',
options: {
providerId: 'github', // Required for OAuth2
},
});
$3
| Option | Type | Required | Description |
|--------|------|----------|-------------|
| appId | string | Yes | OAuth2 Client ID |authorizationBaseUrl
| | string | Yes | Authorization endpoint URL |accessTokenEndpoint
| | string | No | Token endpoint URL (Required for code flow) |redirectUrl
| | string | Yes | Callback URL for OAuth redirect |responseType
| | 'code' \| 'token' | No | OAuth flow type (default: 'code') |pkceEnabled
| | boolean | No | Enable PKCE (default: true) |scope
| | string | No | Default scopes to request |resourceUrl
| | string | No | URL to fetch user profile after auth |additionalParameters
| | RecordadditionalResourceHeaders
| | RecordlogoutUrl
| | string | No | URL to open on logout |logsEnabled
| | boolean | No | Enable debug logging (default: false) |
$3
iOS: Uses ASWebAuthenticationSession for secure authentication.
Android: Uses a WebView-based authentication flow.
Web: Opens a popup window for OAuth flow.
$3
1. Always use PKCE (pkceEnabled: true) for public clientsresponseType: 'code'
2. Use authorization code flow () instead of implicit flow
3. Store tokens securely using @capgo/capacitor-persistent-account
4. Use HTTPS for all endpoints and redirect URLs in production
Troubleshooting
$3
If you get this error on App Store Connect:
> ITMS-91056: Invalid privacy manifest - The PrivacyInfo.xcprivacy file from the following path is invalid: ...
How to fix:
- Make sure your app's PrivacyInfo.xcprivacy is valid JSON, with only Apple-documented keys/values.
- Do not include a privacy manifest in the plugin, only in your app.
$3
Problem: After submitting your app to Google Play, you receive this error:
`
Google Api Error: Invalid request - This release includes the com.google.android.gms.permission.AD_ID permission
but your declaration on Play Console says your app doesn't use advertising ID.
Root Cause: The Facebook SDK includes AD_ID and other advertising-related permissions.
Solution: If you're not using Facebook login, set facebook: false in your capacitor.config.ts:
`typescript`
const config: CapacitorConfig = {
plugins: {
SocialLogin: {
providers: {
google: true,
facebook: false, // Completely excludes Facebook SDK and its permissions
apple: true,
},
},
},
};
Then run npx cap sync. The plugin uses stub classes instead of the real Facebook SDK, so no Facebook dependencies or permissions are included in your build.
$3
Problem: When users try to sign in with Google accounts supervised by Family Link, login fails with:
`
NoCredentialException: No credentials available
Root Cause: Family Link supervised accounts have different authentication requirements and may not work properly with certain Google Sign-In configurations.
Solution:
When implementing Google Sign-In for apps that need to support Family Link accounts, use the following configuration:
`typescript
import { SocialLogin } from '@capacitor/social-login';
// For Family Link accounts, disable filtering by authorized accounts
await SocialLogin.login({
provider: 'google',
options: {
style: 'bottom', // or 'standard'
filterByAuthorizedAccounts: false, // Important for Family Link (default is true)
scopes: ['profile', 'email']
}
});
`
Key Points:
- Set filterByAuthorizedAccounts to false to ensure Family Link accounts are visible (default is true)filterByAuthorizedAccounts
- The plugin will automatically retry with 'standard' style if 'bottom' style fails with NoCredentialException
- These options only affect Android; iOS handles Family Link accounts normally
- The error message will suggest disabling if login fails
Note: Other apps like Listonic work with Family Link accounts because they use similar configurations. The default settings may be too restrictive for supervised accounts.
Where to store access tokens?
You can use the @capgo/capacitor-persistent-account plugin for this.
This plugin stores data in secure locations for native devices.
For Android, it will store data in Android's Account Manager, which provides system-level account management.
For iOS, it will store data in the Keychain, which is Apple's secure credential storage.
API
* initialize(...)
* login(...)
* logout(...)
* isLoggedIn(...)
* getAuthorizationCode(...)
* refresh(...)
* providerSpecificCall(...)
* getPluginVersion()
* openSecureWindow(...)
* Interfaces
* Type Aliases
$3
`typescript`
initialize(options: InitializeOptions) => Promise
Initialize the plugin
| Param | Type |
| ------------- | --------------------------------------------------------------- |
| options | InitializeOptions |
--------------------
$3
`typescript`
login
Login with the selected provider
| Param | Type |
| ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| options | Extract<{ provider: 'facebook'; options: FacebookLoginOptions; }, { provider: T; }> \| Extract<{ provider: 'google'; options: GoogleLoginOptions; }, { provider: T; }> \| Extract<{ provider: 'apple'; options: AppleProviderOptions; }, { provider: T; }> \| Extract<{ provider: 'twitter'; options: TwitterLoginOptions; }, { provider: T; }> \| Extract<{ provider: 'oauth2'; options: OAuth2LoginOptions; }, { provider: T; }> |
Returns: Promise<{ provider: T; result: ProviderResponseMap[T]; }>
--------------------
$3
`typescript`
logout(options: { provider: 'apple' | 'google' | 'facebook' | 'twitter' | 'oauth2'; providerId?: string; }) => Promise
Logout
| Param | Type |
| ------------- | ----------------------------------------------------------------------------------------------------------- |
| options | { provider: 'apple' \| 'google' \| 'facebook' \| 'twitter' \| 'oauth2'; providerId?: string; } |
--------------------
$3
`typescript`
isLoggedIn(options: isLoggedInOptions) => Promise<{ isLoggedIn: boolean; }>
IsLoggedIn
| Param | Type |
| ------------- | --------------------------------------------------------------- |
| options | isLoggedInOptions |
Returns: Promise<{ isLoggedIn: boolean; }>
--------------------
$3
`typescript`
getAuthorizationCode(options: AuthorizationCodeOptions) => Promise
Get the current authorization code
| Param | Type |
| ------------- | ----------------------------------------------------------------------------- |
| options | AuthorizationCodeOptions |
Returns: Promise<AuthorizationCode>
--------------------
$3
`typescript`
refresh(options: LoginOptions) => Promise
Refresh the access token
| Param | Type |
| ------------- | ----------------------------------------------------- |
| options | LoginOptions |
--------------------
$3
`typescript`
providerSpecificCall
Execute provider-specific calls
| Param | Type |
| ------------- | --------------------------------------------------------------------- |
| options | { call: T; options: ProviderSpecificCallOptionsMap[T]; } |
Returns: Promise<ProviderSpecificCallResponseMap[T]>
--------------------
$3
`typescript`
getPluginVersion() => Promise<{ version: string; }>
Get the native Capacitor plugin version
Returns: Promise<{ version: string; }>
--------------------
$3
`typescript`
openSecureWindow(options: OpenSecureWindowOptions) => Promise
Opens a secured window for OAuth2 authentication.
For web, you should have the code in the redirected page to use a broadcast channel to send the redirected url to the app
Something like:
`html`
<html>
<head></head>
<body>
<script>
const searchParams = new URLSearchParams(location.search)
if (searchParams.has("code")) {
new BroadcastChannel("my-channel-name").postMessage(location.href);
window.close();
}
</script>
</body>
</html>
For mobile, you should have a redirect uri that opens the app, something like:
And make sure to register it in the app's info.plist:xml`
<key>CFBundleURLTypes</key>
<array>
<dict>
<key>CFBundleURLSchemes</key>
<array>
<string>myapp</string>
</array>
</dict>
</array>
And in the AndroidManifest.xml file:xml`
<activity>
<intent-filter>
<action android:name="android.intent.action.VIEW" />
<category android:name="android.intent.category.DEFAULT" />
<category android:name="android.intent.category.BROWSABLE" />
<data android:host="oauth_callback" android:scheme="myapp" />
</intent-filter>
</activity>
| Param | Type | Description |
| ------------- | --------------------------------------------------------------------------- | ------------------------------------------- |
| options | OpenSecureWindowOptions | - the options for the openSecureWindow call |
Returns: Promise<OpenSecureWindowResponse>
--------------------
$3
#### InitializeOptions
| Prop | Type | Description |
| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------ |
| oauth2 | Record<string, OAuth2ProviderConfig> | OAuth2 provider configurations. Supports multiple providers by using a Record with provider IDs as keys. |
| twitter | { clientId: string; redirectUrl: string; defaultScopes?: string[]; forceLogin?: boolean; audience?: string; } | |
| facebook | { appId: string; clientToken?: string; locale?: string; } | |
| google | { iOSClientId?: string; iOSServerClientId?: string; webClientId?: string; mode?: 'online' \| 'offline'; hostedDomain?: string; redirectUrl?: string; } | |
| apple | { clientId?: string; redirectUrl?: string; useProperTokenExchange?: boolean; useBroadcastChannel?: boolean; } | |
#### OAuth2ProviderConfig
Configuration for a single OAuth2 provider instance
| Prop | Type | Description | Default |
| ------------------------------- | --------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------- |
| appId | string | The OAuth 2.0 client identifier (App ID / Client ID) | |
| authorizationBaseUrl | string | The base URL of the authorization endpoint | |
| accessTokenEndpoint | string | The URL to exchange the authorization code for tokens Required for authorization code flow | |
| redirectUrl | string | Redirect URL that receives the OAuth callback | |
| resourceUrl | string | Optional URL to fetch user profile/resource data after authentication The access token will be sent as Bearer token in the Authorization header | |
| responseType | 'code' \| 'token' | The OAuth response type - 'code': Authorization Code flow (recommended, requires accessTokenEndpoint) - 'token': Implicit flow (less secure, tokens returned directly) | 'code' |
| pkceEnabled | boolean | Enable PKCE (Proof Key for Code Exchange) Strongly recommended for public clients (mobile/web apps) | true |
| scope | string | Default scopes to request during authorization | |
| additionalParameters | Record<string, string> | Additional parameters to include in the authorization request | |
| additionalResourceHeaders | Record<string, string> | Additional headers to include when fetching the resource URL | |
| logoutUrl | string | Custom logout URL for ending the session | |
| logsEnabled | boolean | Enable debug logging | false |
#### FacebookLoginResponse
| Prop | Type |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| accessToken | AccessToken \| null |
| idToken | string \| null |
| profile | { userID: string; email: string \| null; friendIDs: string[]; birthday: string \| null; ageRange: { min?: number; max?: number; } \| null; gender: string \| null; location: { id: string; name: string; } \| null; hometown: { id: string; name: string; } \| null; profileURL: string \| null; name: string \| null; imageURL: string \| null; } |
#### AccessToken
| Prop | Type |
| ------------------------- | --------------------- |
| applicationId | string |
| declinedPermissions | string[] |
| expires | string |
| isExpired | boolean |
| lastRefresh | string |
| permissions | string[] |
| token | string |
| tokenType | string |
| refreshToken | string |
| userId | string |
#### GoogleLoginResponseOnline
| Prop | Type |
| ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| accessToken | AccessToken \| null |
| idToken | string \| null |
| profile | { email: string \| null; familyName: string \| null; givenName: string \| null; id: string \| null; name: string \| null; imageUrl: string \| null; } |
| responseType | 'online' |
#### GoogleLoginResponseOffline
| Prop | Type |
| -------------------- | ---------------------- |
| serverAuthCode | string |
| responseType | 'offline' |
#### AppleProviderResponse
| Prop | Type | Description |
| ----------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- |
| accessToken | AccessToken \| null | Access token from Apple |
| idToken | string \| null | Identity token (JWT) from Apple |
| profile | { user: string; email: string \| null; givenName: string \| null; familyName: string \| null; } | User profile information |
| authorizationCode | string | Authorization code for proper token exchange (when useProperTokenExchange is enabled) |
#### TwitterLoginResponse
| Prop | Type |
| ------------------ | ----------------------------------------------------------- |
| accessToken | AccessToken \| null |
| refreshToken | string \| null |
| scope | string[] |
| tokenType | 'bearer' |
| expiresIn | number \| null |
| profile | TwitterProfile |
#### TwitterProfile
| Prop | Type |
| --------------------- | --------------------------- |
| id | string |
| username | string |
| name | string \| null |
| profileImageUrl | string \| null |
| verified | boolean |
| email | string \| null |
#### OAuth2LoginResponse
| Prop | Type | Description |
| ------------------ | ------------------------------------------------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| providerId | string | The provider ID that was used for this login |
| accessToken | AccessToken \| null | The access token received from the OAuth provider |
| idToken | string \| null | The ID token (JWT) if provided by the OAuth server (e.g., OpenID Connect) |
| refreshToken | string \| null | The refresh token if provided (requires appropriate scope like offline_access) |
| resourceData | Record<string, unknown> \| null | Resource data fetched from resourceUrl if configured Contains the raw JSON response from the resource endpoint |
| scope | string[] | The scopes that were granted |
| tokenType | string | Token type (usually 'bearer') |
| expiresIn | number \| null | Token expiration time in seconds |
#### FacebookLoginOptions
| Prop | Type | Description | Default |
| ------------------ | --------------------- | ---------------- | ------------------ |
| permissions | string[] | Permissions | |
| limitedLogin | boolean | Is Limited Login | false |
| nonce | string | Nonce | |
#### GoogleLoginOptions
| Prop | Type | Description | Default | Since |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------- | ----------------------- | ------ |
| scopes | string[] | Specifies the scopes required for accessing Google APIs The default is defined in the configuration. | | |
| nonce | string | Nonce | | |
| forceRefreshToken | boolean | Force refresh token (only for Android) | false | |
| forcePrompt | boolean | Force account selection prompt (iOS) | false | |
| style | 'bottom' \| 'standard' | Style | 'standard' | |
| filterByAuthorizedAccounts | boolean | Filter by authorized accounts (Android only) | true | |
| autoSelectEnabled | boolean | Auto select enabled (Android only) | false | |
| prompt | 'none' \| 'consent' \| 'select_account' \| 'consent select_account' \| 'select_account consent' | Prompt parameter for Google OAuth (Web only) | | 7.12.0 |
#### AppleProviderOptions
| Prop | Type | Description | Default |
| ------------------------- | --------------------- | --------------------------------------------- | ------------------ |
| scopes | string[] | Scopes | |
| nonce | string | Nonce | |
| state | string | State | |
| useBroadcastChannel | boolean | Use Broadcast Channel for authentication flow | false |
#### TwitterLoginOptions
| Prop | Type | Description |
| ------------------ | --------------------- | --------------------------------------------------------------------------------------------------------------------------------------- |
| scopes | string[] | Additional scopes to request during login. If omitted the plugin falls back to the default scopes configured during initialization. |
| state | string | Provide a custom OAuth state value. When not provided the plugin generates a cryptographically random value. |
| codeVerifier | string | Provide a pre-computed PKCE code verifier (mostly used for testing). When omitted the plugin generates a secure verifier automatically. |
| redirectUrl | string | Override the redirect URI for a single login call. Useful when the same app supports multiple callback URLs per platform. |
| forceLogin | boolean | Force the consent screen on every attempt, maps to force_login=true. |
#### OAuth2LoginOptions
| Prop | Type | Description |
| -------------------------- | --------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- |
| providerId | string | The provider ID as configured in initialize() This is required to identify which OAuth2 provider to use |
| scope | string | Override the scopes for this login request If not provided, uses the scopes from initialization |
| state | string | Custom state parameter for CSRF protection If not provided, a random value is generated |
| codeVerifier | string | Override PKCE code verifier (for testing purposes) If not provided, a secure random verifier is generated |
| redirectUrl | string | Override redirect URL for this login request |
| additionalParameters | Record<string, string> | Additional parameters to add to the authorization URL |
#### isLoggedInOptions
| Prop | Type | Description |
| ---------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------- |
| provider | 'apple' \| 'google' \| 'facebook' \| 'twitter' \| 'oauth2' | Provider |
| providerId | string | Provider ID for OAuth2 providers (required when provider is 'oauth2') |
#### AuthorizationCode
| Prop | Type | Description |
| ----------------- | ------------------- | ------------ |
| jwt | string | Jwt |
| accessToken | string | Access Token |
#### AuthorizationCodeOptions
| Prop | Type | Description |
| ---------------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------- |
| provider | 'apple' \| 'google' \| 'facebook' \| 'twitter' \| 'oauth2' | Provider |
| providerId | string | Provider ID for OAuth2 providers (required when provider is 'oauth2') |
#### FacebookGetProfileResponse
| Prop | Type | Description |
| ------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------- |
| profile | { [key: string]: any; id: string \| null; name: string \| null; email: string \| null; first_name: string \| null; last_name: string \| null; picture?: { data: { height: number \| null; is_silhouette: boolean \| null; url: string \| null; width: number \| null; }; } \| null; } | Facebook profile data |
#### FacebookRequestTrackingResponse
| Prop | Type | Description |
| ------------ | ------------------------------------------------------------------------ | --------------------------------- |
| status | 'authorized' \| 'denied' \| 'notDetermined' \| 'restricted' | App tracking authorization status |
#### FacebookGetProfileOptions
| Prop | Type | Description |
| ------------ | --------------------- | ---------------------------------------- |
| fields | string[] | Fields to retrieve from Facebook profile |
#### OpenSecureWindowResponse
| Prop | Type | Description |
| ------------------- | ------------------- | --------------------------------------- |
| redirectedUri | string | The result of the openSecureWindow call |
#### OpenSecureWindowOptions
| Prop | Type | Description |
| -------------------------- | ------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| authEndpoint | string | The endpoint to open |
| redirectUri | string | The redirect URI to use for the openSecureWindow call. This will be checked to make sure it matches the redirect URI after the window finishes the redirection. |
| broadcastChannelName | string | The name of the broadcast channel to listen to, relevant only for web |
$3
#### Record
Construct a type with a set of properties K of type T
{
[P in K]: T;
}
#### ProviderResponseMap
{ facebook: FacebookLoginResponse; google: GoogleLoginResponse; apple: AppleProviderResponse; twitter: TwitterLoginResponse; oauth2: OAuth2LoginResponse; }
#### GoogleLoginResponse
GoogleLoginResponseOnline | GoogleLoginResponseOffline
#### LoginOptions
{ provider: 'facebook'; options: FacebookLoginOptions; } | { provider: 'google'; options: GoogleLoginOptions; } | { provider: 'apple'; options: AppleProviderOptions; } | { provider: 'twitter'; options: TwitterLoginOptions; } | { provider: 'oauth2'; options: OAuth2LoginOptions; }
#### Extract
Extract from T those types that are assignable to U
T extends U ? T : never
#### ProviderSpecificCallResponseMap
{ 'facebook#getProfile': FacebookGetProfileResponse; 'facebook#requestTracking': FacebookRequestTrackingResponse; }
#### ProviderSpecificCall
'facebook#getProfile' | 'facebook#requestTracking'
#### ProviderSpecificCallOptionsMap
{ 'facebook#getProfile': FacebookGetProfileOptions; 'facebook#requestTracking': FacebookRequestTrackingOptions; }
#### FacebookRequestTrackingOptions
Record<string, never>
Privacy Manifest for App Developers
If you use Google, Facebook, or Apple login, you must declare the data collected by their SDKs in your app's PrivacyInfo.xcprivacy file (not in the plugin).
Add this file in your app at: ios/App/PrivacyInfo.xcprivacy
$3
`
json
{
"NSPrivacyCollectedDataTypes": [
{ "NSPrivacyCollectedDataType": "EmailAddress", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "Name", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "UserID", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false }
]
}
`$3
json
{
"NSPrivacyCollectedDataTypes": [
{ "NSPrivacyCollectedDataType": "EmailAddress", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "Name", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "UserID", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "FriendsList", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false }
]
}
`$3
json
{
"NSPrivacyCollectedDataTypes": [
{ "NSPrivacyCollectedDataType": "EmailAddress", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false },
{ "NSPrivacyCollectedDataType": "Name", "NSPrivacyCollectedDataTypeLinked": true, "NSPrivacyCollectedDataTypeTracking": false }
]
}
`- Adjust the data types to match your app's usage and the SDK documentation.
- See Apple docs for all allowed keys and values.
Combine facebook and google URL handler in
swift
func application(_ app: UIApplication, open url: URL, options: [UIApplication.OpenURLOptionsKey: Any] = [:]) -> Bool {
// Called when the app was launched with a url. Feel free to add additional processing here,
// but if you want the App API to support tracking app url opens, make sure to keep this call // Return true if the URL was handled by either Facebook or Google authentication
// https://github.com/Cap-go/capacitor-social-login/blob/main/docs/setup_facebook.md#ios-setup
// https://github.com/Cap-go/capacitor-social-login/blob/main/docs/setup_google.md#using-google-login-on-ios
if FBSDKCoreKit.ApplicationDelegate.shared.application(
app,
open: url,
sourceApplication: options[UIApplication.OpenURLOptionsKey.sourceApplication] as? String,
annotation: options[UIApplication.OpenURLOptionsKey.annotation]
) || GIDSignIn.sharedInstance.handle(url) {
return true
}
// If URL wasn't handled by auth services, pass it to Capacitor for processing
return ApplicationDelegateProxy.shared.application(app, open: url, options: options)
}
``$3
This plugin implementation of google is based on CapacitorGoogleAuth with a lot of rework, the current maintainer is unreachable, we are thankful for his work and are now going forward on our own!
Thanks to reslear for helping to transfer users to this plugin from the old one and all the work.