Skip to main content

External Identity Providers

External Identity Providers​

Last verified: 2026-07-08

External identity providers let users connect an OAuth or OIDC provider account to their WordPress account. Awthy supports provider-based sign-in while keeping WordPress account ownership, local policy, and audit events under the site owner's control.

Provider setup overview​

Configure one provider at a time in Awthy Settings. Add the client ID, client secret, redirect URI, audience, and provider-specific options, then use the built-in test before enabling that provider for users.

Store client secrets in Awthy settings only through the plugin UI. Do not paste provider secrets into support channels, public issue trackers, screenshots, or browser console logs.

Microsoft Entra​

Use Entra when staff or administrators already sign in with a Microsoft tenant. Confirm the tenant and redirect URI match the app registration. Keep the staff audience separate from customer login decisions unless the site intentionally supports that workflow.

Google​

Use Google when the site owner supports Google account sign-in. Confirm the OAuth consent screen and callback URL before enabling the provider. For managed Google Drive audit export, see the separate Google Drive and Hub documentation; that workflow is not the same as user login.

GitHub​

Use GitHub for teams that already rely on GitHub accounts. It is usually a staff/admin convenience provider, not a broad customer login choice for WooCommerce stores.

Facebook​

Use Facebook only when it matches the store's customer login strategy and support process. Confirm the configured app mode, callback URL, and allowed domains before exposing it to customers.

Audience boundaries​

Awthy separates provider configuration from audience policy. A provider can be technically configured but still disabled for customers, staff, or administrators until the site owner chooses the right audience.

Do not enable a provider for a broader audience than you support. Provider sign-in should not weaken privileged-account enrollment rules.

Testing expectations​

Before enabling a provider:

  • Confirm the redirect URI shown in Awthy matches the provider application.
  • Run the provider test from Awthy Settings.
  • Link a controlled test account first.
  • Verify the audit log records start, success, failure, link, unlink, and blocked outcomes without exposing tokens.

Troubleshooting​

Most provider failures are caused by callback URL mismatch, disabled provider apps, incorrect client secrets, missing scopes, tenant restrictions, or a user account that has not been linked to the WordPress account.

If login fails after a provider change, disable that provider from Awthy Settings and keep password plus second-factor recovery available while you correct the provider configuration.

Last updated on