diff --git a/embedded-wallets/authentication/README.mdx b/embedded-wallets/authentication/README.mdx index 19f0a224dca..76df7ba4383 100644 --- a/embedded-wallets/authentication/README.mdx +++ b/embedded-wallets/authentication/README.mdx @@ -50,13 +50,13 @@ export const SocialLoginSetup = [ key: 'apple', title: 'Apple', icon: 'logo-apple.png', - path: 'social-logins/oauth/#log-in-with-apple', + path: 'social-logins/apple', }, { key: 'twitter', - title: 'Twitter (X)', + title: 'X', icon: 'logo-twitter.png', - path: 'social-logins/oauth/#log-in-with-x', + path: 'social-logins/x', }, { key: 'facebook', @@ -80,43 +80,49 @@ export const SocialLoginSetup = [ key: 'github', title: 'GitHub', icon: 'logo-github.png', - path: 'social-logins/oauth/#log-in-with-github', + path: 'social-logins/github', }, { key: 'farcaster', title: 'Farcaster', icon: 'logo-farcaster.png', - path: 'social-logins/oauth/#log-in-with-farcaster', + path: 'social-logins/farcaster', }, { key: 'reddit', title: 'Reddit', icon: 'logo-reddit.png', - path: 'social-logins/oauth/#log-in-with-reddit', + path: 'social-logins/reddit', }, { key: 'kakao', title: 'Kakao', icon: 'logo-kakao.png', - path: 'social-logins/oauth/#log-in-with-kakao', + path: 'social-logins/kakao', }, { key: 'linkedin', title: 'LinkedIn', icon: 'logo-linkedin.png', - path: 'social-logins/oauth/#log-in-with-linkedin', + path: 'social-logins/linkedin', }, { key: 'line', title: 'Line', icon: 'logo-line.png', - path: 'social-logins/oauth/#log-in-with-line', + path: 'social-logins/line', }, { key: 'wechat', title: 'WeChat', icon: 'logo-wechat.png', - path: 'social-logins/oauth/#log-in-with-wechat', + path: 'social-logins/wechat', + }, + { + key: 'telegram', + title: 'Telegram', + icon: 'logo-telegram.svg', + path: 'social-logins/telegram', }, ], }, diff --git a/embedded-wallets/authentication/basic-logins/email-passwordless.mdx b/embedded-wallets/authentication/basic-logins/email-passwordless.mdx index 38155bcfeb5..b6f104f398a 100644 --- a/embedded-wallets/authentication/basic-logins/email-passwordless.mdx +++ b/embedded-wallets/authentication/basic-logins/email-passwordless.mdx @@ -1,81 +1,120 @@ --- -title: Email passwordless Login with Embedded Wallets +title: Email passwordless with Embedded Wallets sidebar_label: Email passwordless -description: 'Email Passwordless Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom email OTP sign-in with MetaMask Embedded Wallets. --- -import EmailPasswordlessToggle from '@site/static/img/embedded-wallets/dev-dashboard/email-passwordless-toggle.png' import EmailPasswordlessAddConnection from '@site/static/img/embedded-wallets/dev-dashboard/email-passwordless-add-connection.png' import EmailPasswordlessOnboarding from '@site/static/img/embedded-wallets/dev-dashboard/email-passwordless-onboarding.png' +import EmailPasswordlessToggle from '@site/static/img/embedded-wallets/dev-dashboard/email-passwordless-toggle.png' + +Email passwordless sends a one-time passcode (OTP) or magic link to the user's email address. +Choose the default connection for the quickest setup, or create a custom connection when you want +the email field and OTP to stay inside the +[modal](../../sdk/react/advanced/whitelabel.mdx) +instead of a popup. + +Email passwordless onboarding -Embedded Wallets provides built-in support for email and SMS-based authentication, allowing users to sign in without repeating the full flow using a one-time passcode (OTP) sent to their email address or phone number. This form of passwordless authentication simplifies the onboarding process, removes friction for end users, and expands accessibility, especially in regions where social login options may be limited. +## Default email passwordless -Email Passwordless Onboarding +The default connection uses the email OTP service managed by Embedded Wallets. +Enable **Email Passwordless** and the SDK reads it from the dashboard. +You don't add an Auth Connection ID. -## Set up a custom email connection +### Caveats -:::success Enable on dashboard +- With the modal, the user enters their email address and OTP in a **popup**, not in the modal + itself. +- The default connection and a custom email connection are separate connections, so they produce + different wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). -To use this feature, developers must first enable **Email Passwordless** from the Social Connections section in the [dashboard](https://developer.metamask.io). +### Configure the default connection -By default, Web3Auth uses its own pre-configured credentials for email login. +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Email Passwordless**. + +Email Passwordless in the Social Connections settings + +## Custom email passwordless + +A custom email connection on the dashboard is only an identifier. +You don't paste SMTP credentials, an OAuth client ID, or a JWT JWKS URL. +You create the connection, copy the **Auth Connection ID**, and pass that ID in your SDK +configuration. + +:::note Login stays in the modal + +Default email login opens a popup so the user can enter their address and OTP. +When you attach your Auth Connection ID to `email_passwordless` in `modalConfig.loginMethods`, that +input stays inside the modal. ::: -Email Passwordless Toggle +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default email connection to a custom email connection changes every user's wallet +address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. -For enhanced control and branding, developers are encouraged to configure a custom email connection. Follow these steps: +::: + +### Create the connection -1. Visit the [dashboard](https://developer.metamask.io). -2. Navigate to the **Social Connections** section. -3. Click the **Settings** icon (next to the toggle for **Email Passwordless**. -4. Enter your custom `Auth Connection ID`. -5. Click **Add Connection** to complete the setup. +1. Open **Social Connections** in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select the settings icon next to **Email Passwordless**. +3. Enter an **Auth Connection ID**. +4. Select **Add Connection**. Email Passwordless Add Connection -## Usage - -```tsx title="web3authContext.tsx" -import { WALLET_CONNECTORS, WEB3AUTH_NETWORK } from '@web3auth/modal' -import { type Web3AuthContextConfig } from '@web3auth/modal/react' - -const web3AuthContextConfig: Web3AuthContextConfig = { - web3AuthOptions: { - clientId: 'YOUR_WEB3AUTH_CLIENT_ID', // Pass your Web3Auth Client ID, ideally using an environment variable - web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET, - modalConfig: { - connectors: { - [WALLET_CONNECTORS.AUTH]: { - label: 'auth', - // focus-start - loginMethods: { - email_passwordless: { - name: 'email passwordless login', - authConnectionId: 'w3a-email_passwordless-demo', - }, - }, - // focus-end - }, - }, - }, - }, -} +There are no other fields. +If you already issue email OTPs from your own backend, use a +[custom JWT connection](../custom-connections/custom-jwt.mdx) instead of this dashboard identifier. + +## Group email connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods, for example email passwordless and Google. + +Default email and a custom email connection are separate. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: -export default web3AuthContextConfig +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.EMAIL_PASSWORDLESS, + authConnectionId: '', + groupedAuthConnectionId: '', + extraLoginOptions: { + login_hint: 'user@example.com', + }, +}) ``` +## Usage examples + +Use `login_hint` for the email address when you call `connectTo`. +For the modal, pass the Auth Connection ID in `loginMethods` so the flow stays in the modal. + + + ## Troubleshooting -If OTP or magic link emails do not arrive, the recipient may have unsubscribed from Embedded -Wallets transactional email. +If OTP or magic link emails do not arrive, the recipient may have unsubscribed from Embedded Wallets +transactional email. See [Email OTP or magic link not received](/embedded-wallets/troubleshooting/email-otp-not-received/) for the resubscribe form and other checks. - -## Next steps - -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. diff --git a/embedded-wallets/authentication/basic-logins/sms-otp.mdx b/embedded-wallets/authentication/basic-logins/sms-otp.mdx index a20e13053fe..50e4fb62911 100644 --- a/embedded-wallets/authentication/basic-logins/sms-otp.mdx +++ b/embedded-wallets/authentication/basic-logins/sms-otp.mdx @@ -1,71 +1,113 @@ --- -title: SMS OTP login with Embedded Wallets +title: SMS OTP with Embedded Wallets sidebar_label: SMS OTP -description: 'SMS OTP Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom SMS OTP sign-in with MetaMask Embedded Wallets. --- -import SMSOTPToggle from '@site/static/img/embedded-wallets/dev-dashboard/sms-otp-toggle.png' import SMSOTPAddConnection from '@site/static/img/embedded-wallets/dev-dashboard/sms-otp-add-connection.png' import SMSOTPOnboarding from '@site/static/img/embedded-wallets/dev-dashboard/sms-otp-onboarding.png' +import SMSOTPToggle from '@site/static/img/embedded-wallets/dev-dashboard/sms-otp-toggle.png' + +SMS OTP sends a one-time passcode to the user's phone number. +Choose the default connection for the quickest setup, or create a custom connection when you want +the phone field and OTP to stay inside the +[modal](../../sdk/react/advanced/whitelabel.mdx) +instead of a popup. + +SMS OTP onboarding + +## Default SMS OTP + +The default connection uses the SMS OTP service managed by Embedded Wallets. +Enable **SMS OTP** and the SDK reads it from the dashboard. +You don't add an Auth Connection ID. -Web3Auth provides built-in support for email and SMS-based authentication, allowing users to sign in without repeating the full flow using a one-time passcode (OTP) sent to their email address or phone number. This form of passwordless authentication simplifies the onboarding process, removes friction for end users, and expands accessibility, especially in regions where social login options may be limited. +### Caveats -SMS OTP Onboarding +- With the modal, the user enters their phone number and OTP in a **popup**, not in the modal + itself. +- The default connection and a custom SMS connection are separate connections, so they produce + different wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). -## Set up a custom SMS OTP connection +### Configure the default connection -:::success Enable on dashboard +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **SMS OTP**. -To use this feature, developers must first enable **SMS OTP** from the **Social Connections** section in the [dashboard](https://developer.metamask.io). +SMS OTP in the Social Connections settings -By default, Web3Auth uses its own pre-configured credentials for SMS OTP login. +You can restrict SMS by country in +[Access control](../../dashboard/access-control.mdx). + +## Custom SMS OTP + +A custom SMS connection on the dashboard is only an identifier. +You don't paste a Twilio key, an OAuth client ID, or a JWT JWKS URL. +You create the connection, copy the **Auth Connection ID**, and pass that ID in your SDK +configuration. + +:::note Login stays in the modal + +Default SMS login opens a popup so the user can enter their phone number and OTP. +When you attach your Auth Connection ID to `sms_passwordless` in `modalConfig.loginMethods`, that +input stays inside the modal. ::: -SMS OTP Toggle - -For enhanced control and branding, developers are encouraged to configure a custom SMS OTP connection. Follow these steps: - -1. Visit the [dashboard](https://developer.metamask.io). -2. Go to the **Social Connections** section. -3. Click the **Settings** icon next to the toggle for **SMS OTP**. -4. Enter your custom `Auth Connection ID`. -5. Click **Add Connection** to complete the setup. - -SMS OTP Add Connection - -## Usage - -```tsx title="web3authContext.tsx" -import { WALLET_CONNECTORS, WEB3AUTH_NETWORK } from '@web3auth/modal' -import { type Web3AuthContextConfig } from '@web3auth/modal/react' - -const web3AuthContextConfig: Web3AuthContextConfig = { - web3AuthOptions: { - clientId: 'YOUR_WEB3AUTH_CLIENT_ID', // Pass your Web3Auth Client ID, ideally using an environment variable - web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET, - modalConfig: { - connectors: { - [WALLET_CONNECTORS.AUTH]: { - label: 'auth', - // focus-start - loginMethods: { - sms_passwordless: { - name: 'SMS Passwordless', - authConnection: AUTH_CONNECTION.SMS_PASSWORDLESS, - authConnectionId: 'sms-test-demo', // Replace with your custom SMS OTP Auth Connection ID - }, - }, - // focus-end - }, - }, - }, - }, -} +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default SMS connection to a custom SMS connection changes every user's wallet +address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. -export default web3AuthContextConfig +::: + +### Create the connection + +1. Open **Social Connections** in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select the settings icon next to **SMS OTP**. +3. Enter an **Auth Connection ID**. +4. Select **Add Connection**. + +Add a custom SMS OTP connection + +There are no other fields. +If you already issue SMS OTPs from your own backend, use a +[custom JWT connection](../custom-connections/custom-jwt.mdx) instead of this dashboard identifier. + +## Group SMS connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default SMS and a custom SMS connection are separate. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier. +SMS often doesn't share an email address with Google or email passwordless, so grouping only works +if you normalize a stable identifier. + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.SMS_PASSWORDLESS, + authConnectionId: '', + groupedAuthConnectionId: '', + extraLoginOptions: { + login_hint: '+1-555-555-0100', + }, +}) ``` -## Next steps +## Usage examples + +Use `login_hint` for the phone number when you call `connectTo`. +For the modal, pass the Auth Connection ID in `loginMethods` so the flow stays in the modal. -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. + diff --git a/embedded-wallets/authentication/social-logins/apple.mdx b/embedded-wallets/authentication/social-logins/apple.mdx new file mode 100644 index 00000000000..5b3c72c259e --- /dev/null +++ b/embedded-wallets/authentication/social-logins/apple.mdx @@ -0,0 +1,184 @@ +--- +title: Apple sign-in with Embedded Wallets +sidebar_label: Apple +description: Configure default or custom Apple sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Sign in with Apple](https://developer.apple.com/sign-in-with-apple/) lets users authenticate with +their Apple Account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Apple credentials, consent screen, or identity provider. + +## Default Apple sign-in + +The default connection uses the Apple OAuth credentials managed by Embedded Wallets. +You don't need an Apple Developer account or an Apple Services ID. + +### Caveats + +- The Apple consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Apple application configuration, such as its scopes or branding, because you + don't own the credentials. +- Apple scopes its user identifier to the developer team that owns the credentials. The same person + receives a different identifier on the default connection and on a connection that uses your own + Apple credentials. See + [Receiving a user's identity token](https://developer.apple.com/documentation/signinwithapple/receiving-a-users-identity-token). +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person. + You can't reconcile them later, because the default Apple connection can't join a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Apple**. + +Apple in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Apple credentials to your SDK configuration. + +## Custom Apple sign-in + +Use a custom connection when the Apple authorization belongs to your dapp or an identity platform +you control. +Your Apple credentials sit in an identity provider such as Auth0, Firebase, or Amazon Cognito, or in +your own backend. +That service runs Sign in with Apple and issues an ID token, which Embedded Wallets validates +through a custom connection. + +:::note Apple credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +Apple can't work that way: its token exchange requires a +[client secret](https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret) +signed with your private key, and a Services ID can only return to +[domains you verify](https://developer.apple.com/documentation/signinwithapple/configuring-your-environment-for-sign-in-with-apple). + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Apple connection to Auth0, Firebase, Amazon Cognito, or your own JWT +connection changes every user's wallet address, and a group connection can't merge the two, because +the default Apple connection can't be grouped. + +::: + +### Auth0 + +Auth0 can host the Apple authorization flow and either redirect through Embedded Wallets +(implicit flow) or provide an ID token to your dapp (JWT flow). + +1. [Configure Sign in with Apple in Auth0](https://marketplace.auth0.com/integrations/apple-social-connection). + Apple requires an App ID, Services ID, Team ID, Key ID, and private signing key. +2. Enable the Apple social connection for your Auth0 application. +3. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +4. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `apple`. +5. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +Use `sub` as the user identifier unless your identity architecture deliberately normalizes a +different stable claim. + +### Firebase Authentication + +Firebase handles Apple authorization and returns a Firebase ID token. +Embedded Wallets validates that token through a Firebase custom connection. + +1. [Enable Apple authentication in Firebase](https://firebase.google.com/docs/auth/web/apple). +2. [Create a Firebase connection](../custom-connections/firebase.mdx) in the MetaMask Developer + Dashboard. +3. Sign the user in with the Firebase SDK and obtain a fresh Firebase ID token. +4. Pass the Firebase ID token and your Firebase connection ID to Embedded Wallets using the JWT + flow. + +### Amazon Cognito + +Amazon Cognito can federate Apple accounts into a user pool and issue Cognito ID tokens. + +1. [Configure Apple as a social identity provider in Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-social-idp.html). +2. Map a stable Apple claim to the Cognito user attribute you use as the user identifier. +3. [Create an Amazon Cognito connection](../custom-connections/aws-cognito.mdx) in the MetaMask + Developer Dashboard. +4. Authenticate through Cognito, obtain a fresh Cognito ID token, and pass it to Embedded Wallets + using the JWT flow. + +### Your own backend + +Use this flow when your backend owns user records and token issuance. + +1. Implement Sign in with Apple in your client and send the Apple authorization result to your + backend. +2. Validate the Apple ID token against Apple's + [OpenID Connect configuration](https://appleid.apple.com/.well-known/openid-configuration). + Validate its signature, issuer, audience, expiry, and nonce before trusting the identity. +3. Resolve the Apple subject to your own stable user ID. +4. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +5. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your issuer, + audience, JWKS, and user identifier. +6. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send an Apple private signing key, Auth0 client secret, or your backend JWT signing key to a +client application. + +## Group Apple connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods, for example Apple and Google. + +:::caution Apple can't be grouped directly + +You can't add the default Apple social connection to a group. +Group Apple through an [Auth0](../custom-connections/auth0.mdx) connection that runs Sign in with +Apple, and set the Auth0 connection's **JWT user identifier** to `email`. + +::: + +The identifier must be `email` because grouping links accounts that resolve to the same identifier +value. +Apple's `sub` is scoped to the Apple developer team that issued it, so it never matches the +identifier any other connection returns. +The email address is the only claim that can match across providers. + +This puts two requirements on your setup: + +- Every connection in the group must use `email` as its user identifier. +- Apple must return an email address that matches the one the other providers return. + A user who selects **Hide My Email** gets a private relay address, which won't match their Google + or passwordless email, so they receive a separate wallet. + Test this case before you onboard users. + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open an Apple or Auth0 authorization flow. +The JWT examples assume your Auth0, Firebase, Cognito, or backend integration has already returned a +fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/discord.mdx b/embedded-wallets/authentication/social-logins/discord.mdx index 3bf23603bc2..31721bc2f15 100644 --- a/embedded-wallets/authentication/social-logins/discord.mdx +++ b/embedded-wallets/authentication/social-logins/discord.mdx @@ -1,77 +1,145 @@ --- -title: Discord Social Login with Embedded Wallets +title: Discord sign-in with Embedded Wallets sidebar_label: Discord -description: 'Discord Social Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom Discord sign-in with MetaMask Embedded Wallets. --- -import DiscordToggle from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' import DiscordConnection from '@site/static/img/embedded-wallets/dev-dashboard/discord-connection.png' +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' -[Discord login](https://discord.com/developers/docs/topics/oauth2) is a social login provider that allows users to sign in using their Discord credentials. Embedded Wallets supports Discord as a social login provider, allowing developers to offer a familiar and quick authentication method for users with Discord accounts. +[Discord OAuth2](https://discord.com/developers/docs/topics/oauth2) lets users authenticate with a +Discord account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Discord application, consent screen, or identity provider. -To integrate Discord with Web3Auth, developers must first create a Discord App via the [Discord Developer Portal](https://discord.com/developers/applications). +## Default Discord sign-in -## Step 1: Create a Discord app +The default connection uses the Discord OAuth credentials managed by Embedded Wallets. +You don't need a Discord Developer Portal application. -1. Create a Discord [API application](https://discord.com/developers/applications). +### Caveats + +- The Discord consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Discord application configuration, such as its scopes or branding, because + you don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Discord**. + +Discord in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Discord credentials to your SDK configuration. + +## Custom Discord sign-in -2. Navigate to **OAuth2** from the sidebar, and paste the following as Redirect URI into the "Redirect URI" field. - - https://auth.web3auth.io/auth +Use a custom connection when the Discord authorization belongs to your dapp or an identity platform +you control. +You can register a Discord client ID on the social connection, or run Discord through Auth0 or your +own backend. + +:::note Firebase and Amazon Cognito + +Firebase Authentication and Amazon Cognito don't offer Discord as a first-party social provider. +Use Auth0, a native Discord client ID, or your own JWT. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Discord connection to a custom Discord, Auth0, or JWT connection changes +every user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Your Discord application + +1. Create a Discord [API application](https://discord.com/developers/applications). +2. Open **OAuth2** and add `https://auth.web3auth.io/auth` as a redirect URI. Discord OAuth2.0 App Dashboard -3. Ensure you save your changes. - -4. Copy the **Client ID** from here. We will use this in the Embedded Wallets dashboard. +3. Save your changes and copy the **Client ID**. Discord OAuth2.0 App Client ID and Secret -## Step 2: Create a Discord connection - -:::success Enable on dashboard +4. In the MetaMask Developer Dashboard, open **Social Connections**, select the settings icon next + to **Discord**, and enter an **Auth Connection ID** and the **Discord Client ID**. -To use this feature, enable `Discord` from the Social Connections section in the [dashboard](https://developer.metamask.io). +Discord connection settings -By default, Web3Auth uses its own pre-configured credentials for Discord login. +Call Embedded Wallets with `AUTH_CONNECTION.DISCORD` and that Auth Connection ID. -::: +### Auth0 -Toggle Discord Connection on Dashboard +1. [Configure Discord as a social connection in Auth0](https://marketplace.auth0.com/integrations/discord-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `discord`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. -Follow these steps to create a Discord connection: +### Your own backend -1. Visit the [dashboard](https://developer.metamask.io). -1. Go to the **Social Connections** section. -1. Click the **Settings** icon near the Discord connection. -1. Enter the `Auth Connection ID`. -1. Enter the `Discord Client ID`. -1. Click the **Add Connection** button to save the settings. +1. Complete Discord OAuth in your client and send the result to your backend. +2. Exchange the authorization code with Discord's token endpoint and validate the user identity + before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. -Discord Connection +Don't send a Discord client secret to a client application. -## Usage +## Group Discord connections -Since the Discord connection details are available from the dashboard, developers don't need to pass any additional parameters to the `Web3AuthProvider`. +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. -:::tip +Default Discord, a native Discord client ID, and Discord through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. +Pass both the child connection ID and grouped connection ID when you bypass the modal: -::: - -### Log in with Discord - -```jsx +```tsx await connectTo(WALLET_CONNECTORS.AUTH, { - authConnection: AUTH_CONNECTION.DISCORD, - authConnectionId: 'w3a-discord-demo', + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, }) ``` + +## Usage examples + +The implicit examples open a Discord or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/facebook.mdx b/embedded-wallets/authentication/social-logins/facebook.mdx index b4d83517a3e..d416d1a6d54 100644 --- a/embedded-wallets/authentication/social-logins/facebook.mdx +++ b/embedded-wallets/authentication/social-logins/facebook.mdx @@ -1,81 +1,170 @@ --- -title: Facebook Social Login with Embedded Wallets +title: Facebook sign-in with Embedded Wallets sidebar_label: Facebook -description: 'Facebook Social Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom Facebook sign-in with MetaMask Embedded Wallets. --- -import FacebookToggle from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' import FacebookConnection from '@site/static/img/embedded-wallets/dev-dashboard/facebook-connection.png' -import ImplicitLoginFacebook from '../../sdk/react/advanced/_custom-authentication-snippets/_implicit_login_facebook.mdx' +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' -[Facebook login](https://developers.facebook.com/docs/facebook-login/) enables users to sign in using their Facebook credentials. Embedded Wallets supports Facebook as a social login provider, allowing developers to offer a familiar and quick authentication method for users with Facebook accounts. +[Facebook Login](https://developers.facebook.com/docs/facebook-login/) lets users authenticate with +a Facebook account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Facebook app, consent screen, or identity provider. -To integrate Facebook with Web3Auth, developers must first create a Facebook App via the [Meta for Developers Console](https://developers.facebook.com/). +## Default Facebook sign-in -## Step 1: Create a Facebook app +The default connection uses the Facebook OAuth credentials managed by Embedded Wallets. +You don't need a Meta for Developers app. -1. Follow Facebook's instructions to [create a new app](https://developers.facebook.com/docs/development/create-an-app). -2. When creating an app, make sure to select `Consumer` from this screen to use Facebook Login. ![Facebook OAuth2.0 App Dashboard](/img/embedded-wallets/authentication/facebook/facebook-app.png) +### Caveats -3. On the next screen, you'll be presented with different products you can integrate into your Facebook app. Click **"Set Up"** in the card representing the **Facebook Login** capability. +- The Facebook consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Facebook application configuration, such as its scopes or branding, because + you don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). - Facebook OAuth2.0 App Dashboard +### Configure the default connection -4. Paste the following as a redirect URI into the "Valid OAuth Redirect URIs" field. - - https://auth.web3auth.io/auth - - Facebook OAuth2.0 App Dashboard +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Facebook**. -5. Obtain the "App ID" and "App Secret" from the **Settings > Basic** screen. +Facebook in the Social Connections settings - Facebook OAuth2.0 App Dashboard +The SDK reads the connection from the dashboard. +You don't need to add Facebook credentials to your SDK configuration. -## Step 2: Create a Facebook connection +## Custom Facebook sign-in -:::success Enable on Dashboard +Use a custom connection when the Facebook authorization belongs to your dapp or an identity platform +you control. +You can register a Facebook App ID and App Secret on the social connection, or run Facebook through +Auth0, Firebase, Amazon Cognito, or your own backend. -To use this feature, enable `Facebook` from the Social Connections section in the [dashboard](https://developer.metamask.io). +:::caution Preserve wallet addresses -By default, Web3Auth uses its own pre-configured credentials for Facebook login. +Decide between the default and a custom connection before you onboard users. +Moving from the default Facebook connection to a custom Facebook, Auth0, Firebase, Amazon Cognito, +or JWT connection changes every user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. ::: -Toggle Facebook Connection on Dashboard - -Follow these steps to create a Facebook connection: +### Your Facebook app -1. Visit the [Embedded Wallets dashboard](https://developer.metamask.io). -1. Go to the **Social Connections** section. -1. Click the **Settings** icon near the Facebook connection. -1. Enter the **Auth Connection ID**. -1. Enter the **Facebook App ID**. -1. Enter the **Facebook App Secret**. -1. Click the **Add Connection** button to save the settings. +1. [Create a Facebook app](https://developers.facebook.com/docs/development/create-an-app) and + select **Consumer** so you can use Facebook Login. -Facebook Connection + ![Facebook app type](/img/embedded-wallets/authentication/facebook/facebook-app.png) -## Usage +2. Set up **Facebook Login** on the app. -Since the Facebook connection details are available from the dashboard, developers don't need to pass any additional parameters to the `Web3AuthProvider`. + Facebook Login product setup -:::tip +3. Add `https://auth.web3auth.io/auth` as a Valid OAuth Redirect URI. -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. + Facebook Valid OAuth Redirect URIs -::: +4. Copy the App ID and App Secret from **Settings > Basic**. -### Implicit login with Facebook + Facebook App ID and App Secret - +5. In the MetaMask Developer Dashboard, open **Social Connections**, select the settings icon next + to **Facebook**, and enter an **Auth Connection ID**, the **Facebook App ID**, and the + **Facebook App Secret**. + +Facebook connection settings + +Call Embedded Wallets with `AUTH_CONNECTION.FACEBOOK` and that Auth Connection ID. + +### Auth0 + +1. [Configure Facebook as a social connection in Auth0](https://marketplace.auth0.com/integrations/facebook-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `facebook`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +### Firebase Authentication + +1. [Enable Facebook sign-in in Firebase](https://firebase.google.com/docs/auth/web/facebook-login). +2. [Create a Firebase connection](../custom-connections/firebase.mdx) in the MetaMask Developer + Dashboard. +3. Sign the user in with the Firebase SDK and obtain a fresh Firebase ID token. +4. Pass the Firebase ID token and your Firebase connection ID to Embedded Wallets using the JWT + flow. + +### Amazon Cognito + +1. [Configure Facebook as a social identity provider in Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-social-idp.html). +2. [Create an Amazon Cognito connection](../custom-connections/aws-cognito.mdx) in the MetaMask + Developer Dashboard. +3. Authenticate through Cognito, obtain a fresh Cognito ID token, and pass it to Embedded Wallets + using the JWT flow. + +### Your own backend + +1. Complete Facebook Login in your client and send the access token or Facebook-limited login token + to your backend. +2. Validate the token with Facebook's Graph API or JWKS before trusting the identity. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a Facebook App Secret to a client application. + +## Group Facebook connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default Facebook, a native Facebook app, and Facebook through Auth0 or Firebase are separate +connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a Facebook or Auth0 authorization flow. +The JWT examples assume your Auth0, Firebase, Cognito, or backend integration has already returned a +fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/farcaster.mdx b/embedded-wallets/authentication/social-logins/farcaster.mdx new file mode 100644 index 00000000000..bdcfc0b325d --- /dev/null +++ b/embedded-wallets/authentication/social-logins/farcaster.mdx @@ -0,0 +1,57 @@ +--- +title: Farcaster sign-in with Embedded Wallets +sidebar_label: Farcaster +description: Configure default Farcaster sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Farcaster](https://docs.farcaster.xyz/) sign-in lets users authenticate with a Farcaster identity. +Use the default connection hosted by Embedded Wallets. + +This page documents the default `connectTo` path (`AUTH_CONNECTION.FARCASTER`). +Embedded Wallets doesn't provide a dashboard Client ID field for Farcaster, and this guide doesn't +document a custom Auth0, Firebase, or Cognito path. + +## Default Farcaster sign-in + +The default connection uses the Farcaster credentials managed by Embedded Wallets. + +### Caveats + +- The Farcaster authorization identifies the application managed by Embedded Wallets, not your dapp. +- You can't change the Farcaster application configuration, because you don't own the credentials. +- Switching away from the default Farcaster connection later produces a different wallet address + for the same person. + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Farcaster**. + +Farcaster in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Farcaster credentials to your SDK configuration. + +## Group Farcaster connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Only group Farcaster with another connection when both resolve to the same JWT user identifier. +Don't assume a Farcaster FID matches a Google or email identifier. + +## Usage examples + + diff --git a/embedded-wallets/authentication/social-logins/github.mdx b/embedded-wallets/authentication/social-logins/github.mdx new file mode 100644 index 00000000000..5c41ec9f12f --- /dev/null +++ b/embedded-wallets/authentication/social-logins/github.mdx @@ -0,0 +1,131 @@ +--- +title: GitHub sign-in with Embedded Wallets +sidebar_label: GitHub +description: Configure default or custom GitHub sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[GitHub OAuth](https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/authorizing-oauth-apps) +lets users authenticate with a GitHub account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own GitHub OAuth app, consent screen, or identity provider. + +## Default GitHub sign-in + +The default connection uses the GitHub OAuth credentials managed by Embedded Wallets. +You don't need a GitHub OAuth app. + +### Caveats + +- The GitHub consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the GitHub application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **GitHub**. + +GitHub in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add GitHub credentials to your SDK configuration. + +## Custom GitHub sign-in + +Use a custom connection when the GitHub authorization belongs to your dapp or an identity platform +you control. +Your GitHub credentials sit in an identity provider such as Auth0 or Firebase, or in your own +backend. + +:::note GitHub credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +A GitHub OAuth app requires a client secret to exchange the authorization code, so Embedded Wallets +doesn't accept a GitHub client ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default GitHub connection to Auth0, Firebase, or your own JWT connection changes +every user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +1. [Configure GitHub as a social connection in Auth0](https://marketplace.auth0.com/integrations/github-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `github`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +### Firebase Authentication + +1. [Enable GitHub authentication in Firebase](https://firebase.google.com/docs/auth/web/github-auth). +2. [Create a Firebase connection](../custom-connections/firebase.mdx) in the MetaMask Developer + Dashboard. +3. Sign the user in with the Firebase SDK and obtain a fresh Firebase ID token. +4. Pass the Firebase ID token and your Firebase connection ID to Embedded Wallets using the JWT + flow. + +Amazon Cognito doesn't offer GitHub as a first-party social identity provider. + +### Your own backend + +1. Complete GitHub OAuth in your client and send the result to your backend. +2. Exchange the authorization code with GitHub's token endpoint using your client secret, then + validate the user identity before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a GitHub client secret to a client application. + +## Group GitHub connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default GitHub and GitHub through Auth0 or Firebase are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a GitHub or Auth0 authorization flow. +The JWT examples assume your Auth0, Firebase, or backend integration has already returned a fresh +ID token. + + diff --git a/embedded-wallets/authentication/social-logins/google.mdx b/embedded-wallets/authentication/social-logins/google.mdx index b887058b868..fe96f11578a 100644 --- a/embedded-wallets/authentication/social-logins/google.mdx +++ b/embedded-wallets/authentication/social-logins/google.mdx @@ -1,73 +1,155 @@ --- -title: Google Login with Embedded Wallets +title: Google sign-in with Embedded Wallets sidebar_label: Google -description: 'Google Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom Google sign-in with MetaMask Embedded Wallets. --- -import Tabs from '@theme/Tabs' -import TabItem from '@theme/TabItem' -import GoogleToggle from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' +import JwtLoginGoogle from '../../sdk/react/advanced/_custom-authentication-snippets/_jwt_login_google_one_tap.mdx' import GoogleConnection from '@site/static/img/embedded-wallets/dev-dashboard/google-connection.png' +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' -import JwtLoginGoogle from '../../sdk/react/advanced/_custom-authentication-snippets/_jwt_login_google_one_tap.mdx' -import ImplicitLoginGoogle from '../../sdk/react/advanced/_custom-authentication-snippets/_implicit_login_google.mdx' +[Google Sign-In](https://developers.google.com/identity/sign-in/web/sign-in) lets users authenticate +with a Google account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Google OAuth client, consent screen, or identity provider. + +## Default Google sign-in + +The default connection uses the Google OAuth credentials managed by Embedded Wallets. +You don't need a Google Cloud project. + +### Caveats + +- The Google consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Google application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Google**. + +Google in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Google credentials to your SDK configuration. + +## Custom Google sign-in -[Google Sign-In](https://developers.google.com/identity/sign-in/web/sign-in) is a widely adopted authentication method that allows users to log in using their existing Google accounts. Embedded Wallets supports Google as a social login provider, enabling onboarding and authentication experiences for users with Google credentials. +Use a custom connection when the Google authorization belongs to your dapp or an identity platform +you control. +You can register a Google OAuth client ID on the social connection, or run Google through Auth0, +Firebase, Amazon Cognito, or your own backend. -To integrate Google Sign-In with Embedded Wallets, developers must first configure a Google OAuth 2.0 Client ID in the Google Cloud Console. +:::caution Preserve wallet addresses -## Step 1: Create a Google app +Decide between the default and a custom connection before you onboard users. +Moving from the default Google connection to a custom Google, Auth0, Firebase, Amazon Cognito, or +JWT connection changes every user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. -1. Follow Google's instructions to [set up an OAuth 2.0 app.](https://support.google.com/cloud/answer/6158849?hl=en) -2. Paste the following URI as a redirect URI into the "Authorized redirect URIs" field. - - `https://auth.web3auth.io/auth` +::: + +### Your Google OAuth client + +1. Follow Google's instructions to [set up an OAuth 2.0 app](https://support.google.com/cloud/answer/6158849?hl=en). +2. Add `https://auth.web3auth.io/auth` as an authorized redirect URI. Google OAuth2.0 App Dashboard -3. Obtain the OAuth Client ID from the [App on the Google Developer dashboard](https://console.developers.google.com/) +3. Copy the OAuth client ID from the + [Google Cloud console](https://console.developers.google.com/). +4. In the MetaMask Developer Dashboard, open **Social Connections**, select the settings icon next + to **Google**, and enter an **Auth Connection ID** and the **Google Client ID**. -## Step 2: Create a Google connection +Google connection settings -:::success Enable on Dashboard +Call Embedded Wallets with `AUTH_CONNECTION.GOOGLE` and that Auth Connection ID. -To use this feature, enable **Google** from the Social Connections section in the [dashboard](https://developer.metamask.io). +### Auth0 -By default, Web3Auth uses its own pre-configured credentials for Google login. +1. [Configure Google as a social connection in Auth0](https://marketplace.auth0.com/integrations/google-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `google-oauth2`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. -::: +### Firebase Authentication -Toggle Google Connection on Dashboard +1. [Enable Google sign-in in Firebase](https://firebase.google.com/docs/auth/web/google-signin). +2. [Create a Firebase connection](../custom-connections/firebase.mdx) in the MetaMask Developer + Dashboard. +3. Sign the user in with the Firebase SDK and obtain a fresh Firebase ID token. +4. Pass the Firebase ID token and your Firebase connection ID to Embedded Wallets using the JWT + flow. -Follow these steps to create a Google connection: +### Amazon Cognito -1. Visit the [Embedded Wallets dashboard](https://developer.metamask.io). -1. Go to the **Social Connections** section. -1. Click the **Settings** icon near the Google connection. -1. Enter the **Auth Connection ID**. -1. Enter the **Google Client ID**. -1. Click the **Add Connection** button to save the settings. +1. [Configure Google as a social identity provider in Amazon Cognito](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-social-idp.html). +2. [Create an Amazon Cognito connection](../custom-connections/aws-cognito.mdx) in the MetaMask + Developer Dashboard. +3. Authenticate through Cognito, obtain a fresh Cognito ID token, and pass it to Embedded Wallets + using the JWT flow. -Google Connection +### Your own backend -## Usage +1. Complete Google Sign-In in your client and send the Google ID token to your backend. +2. Validate the token against Google's token info or JWKS endpoint before trusting the identity. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. -Since the Google connection details are available from the dashboard, developers don't need to pass any additional parameters to the `Web3AuthProvider`. +## Group Google connections -:::tip +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods, for example Google and email passwordless. -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. +Default Google, a native Google client ID, and Google through Auth0 or Firebase are separate +connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). -::: +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a Google or Auth0 authorization flow. +The JWT examples assume your Auth0, Firebase, Cognito, or backend integration has already returned a +fresh ID token. + + + +### Google One Tap JWT + +On web, you can pass a Google One Tap credential to a custom Google connection: - - - - - - - - + diff --git a/embedded-wallets/authentication/social-logins/kakao.mdx b/embedded-wallets/authentication/social-logins/kakao.mdx new file mode 100644 index 00000000000..84a76b4fe69 --- /dev/null +++ b/embedded-wallets/authentication/social-logins/kakao.mdx @@ -0,0 +1,121 @@ +--- +title: Kakao sign-in with Embedded Wallets +sidebar_label: Kakao +description: Configure default or custom Kakao sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Kakao Login](https://developers.kakao.com/docs/latest/en/kakaologin/common) lets users authenticate +with a Kakao account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Kakao application, consent screen, or identity provider. + +## Default Kakao sign-in + +The default connection uses the Kakao OAuth credentials managed by Embedded Wallets. +You don't need a Kakao Developers application. + +### Caveats + +- The Kakao consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Kakao application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Kakao**. + +Kakao in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Kakao credentials to your SDK configuration. + +## Custom Kakao sign-in + +Use a custom connection when the Kakao authorization belongs to your dapp or an identity platform +you control. +Your Kakao credentials sit in Auth0 or your own backend. + +:::note Kakao credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +Kakao Login requires a REST API secret to complete the token exchange, so Embedded Wallets doesn't +accept a Kakao REST API key on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Kakao connection to Auth0 or your own JWT connection changes every user's +wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +1. Configure Kakao from the + [Auth0 social connections catalog](https://marketplace.auth0.com/features/social-connections). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `kakao`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +Firebase Authentication and Amazon Cognito don't offer Kakao as a first-party social provider. + +### Your own backend + +1. Complete Kakao Login in your client and send the result to your backend. +2. Exchange the authorization code with Kakao's token endpoint using your REST API secret, then + validate the user identity before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a Kakao REST API secret to a client application. + +## Group Kakao connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default Kakao and Kakao through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a Kakao or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/line.mdx b/embedded-wallets/authentication/social-logins/line.mdx new file mode 100644 index 00000000000..9181f2e7766 --- /dev/null +++ b/embedded-wallets/authentication/social-logins/line.mdx @@ -0,0 +1,120 @@ +--- +title: LINE sign-in with Embedded Wallets +sidebar_label: LINE +description: Configure default or custom LINE sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[LINE Login](https://developers.line.biz/en/docs/line-login/overview/) lets users authenticate with +a LINE account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own LINE channel, consent screen, or identity provider. + +## Default LINE sign-in + +The default connection uses the LINE OAuth credentials managed by Embedded Wallets. +You don't need a LINE Developers Console channel. + +### Caveats + +- The LINE consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the LINE application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **LINE**. + +LINE in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add LINE credentials to your SDK configuration. + +## Custom LINE sign-in + +Use a custom connection when the LINE authorization belongs to your dapp or an identity platform +you control. +Your LINE credentials sit in Auth0 or your own backend. + +:::note LINE credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +LINE Login requires a channel secret to complete the token exchange, so Embedded Wallets doesn't +accept a LINE channel ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default LINE connection to Auth0 or your own JWT connection changes every user's +wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +1. [Configure LINE as a social connection in Auth0](https://marketplace.auth0.com/integrations/line-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `line`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +Firebase Authentication and Amazon Cognito don't offer LINE as a first-party social provider. + +### Your own backend + +1. Complete LINE Login in your client and send the result to your backend. +2. Exchange the authorization code with LINE's token endpoint using your channel secret, then + validate the ID token before trusting the identity. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a LINE channel secret to a client application. + +## Group LINE connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default LINE and LINE through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a LINE or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/linkedin.mdx b/embedded-wallets/authentication/social-logins/linkedin.mdx new file mode 100644 index 00000000000..051963b0006 --- /dev/null +++ b/embedded-wallets/authentication/social-logins/linkedin.mdx @@ -0,0 +1,120 @@ +--- +title: LinkedIn sign-in with Embedded Wallets +sidebar_label: LinkedIn +description: Configure default or custom LinkedIn sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Sign In with LinkedIn](https://learn.microsoft.com/en-us/linkedin/shared/authentication/authentication) +lets users authenticate with a LinkedIn account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own LinkedIn app, consent screen, or identity provider. + +## Default LinkedIn sign-in + +The default connection uses the LinkedIn OAuth credentials managed by Embedded Wallets. +You don't need a LinkedIn developer application. + +### Caveats + +- The LinkedIn consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the LinkedIn application configuration, such as its scopes or branding, because + you don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **LinkedIn**. + +LinkedIn in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add LinkedIn credentials to your SDK configuration. + +## Custom LinkedIn sign-in + +Use a custom connection when the LinkedIn authorization belongs to your dapp or an identity platform +you control. +Your LinkedIn credentials sit in Auth0 or your own backend. + +:::note LinkedIn credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +LinkedIn OpenID Connect requires a client secret to exchange the authorization code, so Embedded +Wallets doesn't accept a LinkedIn client ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default LinkedIn connection to Auth0 or your own JWT connection changes every +user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +1. [Configure LinkedIn as a social connection in Auth0](https://marketplace.auth0.com/integrations/linkedin-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `linkedin`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +Firebase Authentication and Amazon Cognito don't offer LinkedIn as a first-party social provider. + +### Your own backend + +1. Complete Sign In with LinkedIn in your client and send the result to your backend. +2. Exchange the authorization code with LinkedIn's token endpoint using your client secret, then + validate the ID token before trusting the identity. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a LinkedIn client secret to a client application. + +## Group LinkedIn connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default LinkedIn and LinkedIn through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a LinkedIn or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/oauth.mdx b/embedded-wallets/authentication/social-logins/oauth.mdx deleted file mode 100644 index e2e2050e99a..00000000000 --- a/embedded-wallets/authentication/social-logins/oauth.mdx +++ /dev/null @@ -1,284 +0,0 @@ ---- -title: OAuth 2.0 Login with Embedded Wallets -sidebar_label: OAuth 2.0 -description: 'OAuth 2.0 Login with Embedded Wallets | Embedded Wallets' ---- - -import OAuthToggle from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' - -[OAuth 2.0](https://oauth.net/2/) is a widely adopted standard that enables users to authenticate with third-party identity providers in a secure and user-friendly manner. Web3Auth offers native support for multiple OAuth 2.0 login options, allowing developers to integrate familiar authentication experiences directly into their applications. - -:::success Enable on dashboard - -To use this feature, enable X (Twitter), Farcaster, Apple, GitHub, Reddit, Line, Kakao, LinkedIn, or WeChat from the **Social Connections** section in the [dashboard](https://developer.metamask.io). - -By default, Web3Auth uses its own pre-configured credentials for different social login providers. - -::: - -Toggle OAuth Connection on Dashboard - -## Usage - -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. - -### Log in with X - -Ensure that you enable X (Twitter) on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithX = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.TWITTER, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with Farcaster - -Ensure that you enable Farcaster on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithFarcaster = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.FARCASTER, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with Apple - -Ensure that you enable Apple on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithApple = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.APPLE, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with GitHub - -Ensure that you enable GitHub on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithGitHub = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.GITHUB, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with Reddit - -Ensure that you enable Reddit on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithReddit = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.REDDIT, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with Line - -Ensure that you enable Line on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithLine = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.LINE, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with Kakao - -Ensure that you enable Kakao on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithKakao = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.KAKAO, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with LinkedIn - -Ensure that you enable LinkedIn on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithLinkedIn = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.LINKEDIN, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` - -### Log in with WeChat - -Ensure that you enable WeChat on the dashboard. - -```tsx title="App.tsx" -import { useWeb3AuthConnect } from '@web3auth/modal/react' -import { WALLET_CONNECTORS, AUTH_CONNECTION } from '@web3auth/modal' - -function CustomConnectors() { - const { connectTo, loading, isConnected, error } = useWeb3AuthConnect() - - const loginWithWechat = async () => { - await connectTo(WALLET_CONNECTORS.AUTH, { - // focus-next-line - authConnection: AUTH_CONNECTION.WECHAT, - }) - } - - return ( -
- - {error &&
{error.message}
} -
- ) -} -``` diff --git a/embedded-wallets/authentication/social-logins/reddit.mdx b/embedded-wallets/authentication/social-logins/reddit.mdx new file mode 100644 index 00000000000..f07a50f207f --- /dev/null +++ b/embedded-wallets/authentication/social-logins/reddit.mdx @@ -0,0 +1,118 @@ +--- +title: Reddit sign-in with Embedded Wallets +sidebar_label: Reddit +description: Configure default or custom Reddit sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Reddit OAuth](https://github.com/reddit-archive/reddit/wiki/OAuth2) lets users authenticate with a +Reddit account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Reddit app, consent screen, or identity provider. + +## Default Reddit sign-in + +The default connection uses the Reddit OAuth credentials managed by Embedded Wallets. +You don't need a Reddit developer application. + +### Caveats + +- The Reddit consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Reddit application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Reddit**. + +Reddit in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Reddit credentials to your SDK configuration. + +## Custom Reddit sign-in + +Use a custom connection when the Reddit authorization belongs to your dapp or an identity platform +you control. +Your Reddit credentials sit in Auth0 or your own backend. + +:::note Reddit credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +Reddit OAuth uses a confidential client (a client secret) to exchange the authorization code, so +Embedded Wallets doesn't accept a Reddit client ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Reddit connection to Auth0 or your own JWT connection changes every user's +wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +Auth0 doesn't list Reddit as a built-in social connection in the same catalog as Google or GitHub. +Add Reddit with an Auth0 +[custom OAuth 2.0 connection](https://auth0.com/docs/authenticate/identity-providers/social-identity-providers/oauth2), +then [create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer +Dashboard. +Set `extraLoginOptions.connection` to the name Auth0 assigned to that connection. + +Firebase Authentication and Amazon Cognito don't offer Reddit as a first-party social provider. + +### Your own backend + +1. Complete Reddit OAuth in your client and send the result to your backend. +2. Exchange the authorization code with Reddit's token endpoint using your client secret, then + validate the user identity before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a Reddit client secret to a client application. + +## Group Reddit connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default Reddit and Reddit through Auth0 or your JWT are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open the default Reddit authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/telegram.mdx b/embedded-wallets/authentication/social-logins/telegram.mdx new file mode 100644 index 00000000000..41c052f962a --- /dev/null +++ b/embedded-wallets/authentication/social-logins/telegram.mdx @@ -0,0 +1,122 @@ +--- +title: Telegram sign-in with Embedded Wallets +sidebar_label: Telegram +description: Configure default or custom Telegram sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Telegram Login](https://core.telegram.org/widgets/login) lets users authenticate with a Telegram +account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Telegram bot, branding, or identity provider. + +The web SDK value for this provider is `AUTH_CONNECTION.TELEGRAM`. +Mobile and gaming SDKs documented in this site don't include a Telegram `AuthConnection` value. + +## Default Telegram sign-in + +The default connection uses the Telegram credentials managed by Embedded Wallets. +You don't need a Telegram bot. + +### Caveats + +- The Telegram login widget identifies the application managed by Embedded Wallets, not your dapp. +- You can't change the Telegram bot configuration, because you don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Telegram**. + +Telegram in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Telegram credentials to your SDK configuration. + +## Custom Telegram sign-in + +Use a custom connection when Telegram authorization belongs to your bot or an identity platform you +control. +Your Telegram bot token sits in Auth0 or your own backend. + +:::note Telegram credentials can't go in the dashboard + +Telegram Login is a widget authenticated with a bot token, not an OAuth 2.0 public client. +You can't register a Telegram bot token as a social Client ID the way you can for Google, Discord, +or Twitch. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Telegram connection to Auth0 or your own JWT connection changes every +user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +Auth0 lists Telegram in the +[social connections catalog](https://marketplace.auth0.com/features/social-connections). +Configure Telegram there, then [create an Auth0 connection](../custom-connections/auth0.mdx) in the +MetaMask Developer Dashboard. +Set `extraLoginOptions.connection` to the name Auth0 assigned (commonly `telegram`). + +Firebase Authentication and Amazon Cognito don't offer Telegram as a first-party social provider. + +### Your own backend + +1. Complete Telegram Login Widget authentication in your client and send the signed payload to your + backend. +2. Verify the HMAC signature with your bot token as described in + [Telegram Login Widget](https://core.telegram.org/widgets/login#checking-authorization) before + trusting the identity. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a Telegram bot token to a client application. + +## Group Telegram connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default Telegram and Telegram through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). +Telegram often doesn't return an email address, so grouping with Google or email passwordless only +works if you normalize another stable identifier. + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open the default Telegram authorization flow on web. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/twitch.mdx b/embedded-wallets/authentication/social-logins/twitch.mdx index ff21f9c3aca..9bfcc95a2e3 100644 --- a/embedded-wallets/authentication/social-logins/twitch.mdx +++ b/embedded-wallets/authentication/social-logins/twitch.mdx @@ -1,84 +1,151 @@ --- -title: Twitch Social Login with Embedded Wallets +title: Twitch sign-in with Embedded Wallets sidebar_label: Twitch -description: 'Twitch Social Login with Embedded Wallets | Embedded Wallets' +description: Configure default or custom Twitch sign-in with MetaMask Embedded Wallets. --- -import TwitchToggle from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' import TwitchConnection from '@site/static/img/embedded-wallets/dev-dashboard/twitch-connection.png' +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' -Twitch supports social login, allowing users to [sign in using their Twitch credentials](https://dev.twitch.tv/docs/authentication/#user-access-tokens). Embedded Wallets supports Twitch as a social login provider, allowing developers to offer a familiar and quick authentication method for users with Twitch accounts. +[Twitch authentication](https://dev.twitch.tv/docs/authentication/#user-access-tokens) lets users +authenticate with a Twitch account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own Twitch application, consent screen, or identity provider. -## Prerequisites +## Default Twitch sign-in -- Registered [Twitch App](https://dev.twitch.tv/docs/authentication/#registration) +The default connection uses the Twitch OAuth credentials managed by Embedded Wallets. +You don't need a Twitch developer application. -## Step 1: Create a Twitch app +### Caveats -1. Follow Twitch's [registration instructions](https://dev.twitch.tv/docs/authentication/#registration) to [register your app](https://dev.twitch.tv/console/apps/create). -2. Paste the following as a Redirect URI into the "OAuth Redirect URLs" field. - - [https://auth.web3auth.io/auth](https://auth.web3auth.io/auth) +- The Twitch consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the Twitch application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **Twitch**. + +Twitch in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add Twitch credentials to your SDK configuration. + +## Custom Twitch sign-in + +Use a custom connection when the Twitch authorization belongs to your dapp or an identity platform +you control. +You can register a Twitch client ID on the social connection, or run Twitch through Auth0 or your +own backend. + +:::note Firebase and Amazon Cognito + +Firebase Authentication and Amazon Cognito don't offer Twitch as a first-party social provider. +Use Auth0, a native Twitch client ID, or your own JWT. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default Twitch connection to a custom Twitch, Auth0, or JWT connection changes +every user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Your Twitch application + +1. [Register a Twitch application](https://dev.twitch.tv/docs/authentication/#registration). +2. Add `https://auth.web3auth.io/auth` as an OAuth Redirect URL. Twitch OAuth2.0 App Dashboard -3. After creation of your Twitch app, click **Manage**. +3. Open **Manage** on the application and copy the **Client ID**. Twitch OAuth2.0 App Manage -4. Obtain the **Client ID**. - Twitch OAuth2.0 App Manage -## Step 2: Create a Twitch connection - -:::success Enable on dashboard - -To use this feature, enable `Twitch` from the Social Connections section in the [dashboard](https://developer.metamask.io). +4. In the MetaMask Developer Dashboard, open **Social Connections**, select the settings icon next + to **Twitch**, and enter an **Auth Connection ID** and the **Twitch Client ID**. -By default, Web3Auth uses its own pre-configured credentials for Twitch login. +Twitch connection settings -::: - -Toggle Twitch Connection on Dashboard +Call Embedded Wallets with `AUTH_CONNECTION.TWITCH` and that Auth Connection ID. -Follow these steps to create a Twitch connection: +### Auth0 -1. Visit the [dashboard](https://developer.metamask.io). -1. Go to the **Social Connections** section. -1. Click the **Settings** icon near the Twitch connection. -1. Enter the `Auth Connection ID`. -1. Enter the `Twitch Client ID`. -1. Click the **Add Connection** button to save the settings. +1. [Configure Twitch as a social connection in Auth0](https://marketplace.auth0.com/integrations/twitch-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `twitch`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. -Twitch Connection +### Your own backend -## Usage +1. Complete Twitch OAuth in your client and send the result to your backend. +2. Exchange the authorization code with Twitch's token endpoint and validate the user identity + before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. -Since the Twitch connection details are available from the dashboard, developers don't need to pass any additional parameters to the `Web3AuthProvider`. +Don't send a Twitch client secret to a client application. -:::tip +## Group Twitch connections -Follow our [quickstart](/quickstart/?product=EMBEDDED_WALLETS&walletAggregatorOnly=NO&framework=REACT&stepIndex=0) to set up the basic flow. +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. -::: +Default Twitch, a native Twitch client ID, and Twitch through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). -### Log in with Twitch +Pass both the child connection ID and grouped connection ID when you bypass the modal: -```jsx +```tsx await connectTo(WALLET_CONNECTORS.AUTH, { - authConnection: AUTH_CONNECTION.TWITCH, - authConnectionId: 'w3a-twitch-demo', + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, }) ``` + +## Usage examples + +The implicit examples open a Twitch or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/wechat.mdx b/embedded-wallets/authentication/social-logins/wechat.mdx new file mode 100644 index 00000000000..30671ca4774 --- /dev/null +++ b/embedded-wallets/authentication/social-logins/wechat.mdx @@ -0,0 +1,118 @@ +--- +title: WeChat sign-in with Embedded Wallets +sidebar_label: WeChat +description: Configure default or custom WeChat sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[WeChat Open Platform login](https://developers.weixin.qq.com/doc/oplatform/en/Website_App/WeChat_Login/Wechat_Login.html) +lets users authenticate with a WeChat account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own WeChat application, consent screen, or identity provider. + +## Default WeChat sign-in + +The default connection uses the WeChat OAuth credentials managed by Embedded Wallets. +You don't need a WeChat Open Platform application. + +### Caveats + +- The WeChat consent screen identifies the OAuth application managed by Embedded Wallets, not your + dapp. +- You can't change the WeChat application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **WeChat**. + +WeChat in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add WeChat credentials to your SDK configuration. + +## Custom WeChat sign-in + +Use a custom connection when the WeChat authorization belongs to your dapp or an identity platform +you control. +Your WeChat credentials sit in Auth0 or your own backend. + +:::note WeChat credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +WeChat website login requires an AppSecret and an authorized callback domain you control, so +Embedded Wallets doesn't accept a WeChat App ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default WeChat connection to Auth0 or your own JWT connection changes every user's +wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +Auth0 lists WeChat in the +[social connections catalog](https://marketplace.auth0.com/features/social-connections). +Configure WeChat there, then [create an Auth0 connection](../custom-connections/auth0.mdx) in the +MetaMask Developer Dashboard. +Set `extraLoginOptions.connection` to the name Auth0 assigned (commonly `wechat`). + +Firebase Authentication and Amazon Cognito don't offer WeChat as a first-party social provider. + +### Your own backend + +1. Complete WeChat website login in your client and send the result to your backend. +2. Exchange the authorization code with WeChat's token endpoint using your AppSecret, then validate + the user identity before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send a WeChat AppSecret to a client application. + +## Group WeChat connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default WeChat and WeChat through Auth0 are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open a WeChat or Auth0 authorization flow. +The JWT examples assume your Auth0 or backend integration has already returned a fresh ID token. + + diff --git a/embedded-wallets/authentication/social-logins/x.mdx b/embedded-wallets/authentication/social-logins/x.mdx new file mode 100644 index 00000000000..36412bef8d6 --- /dev/null +++ b/embedded-wallets/authentication/social-logins/x.mdx @@ -0,0 +1,131 @@ +--- +title: X sign-in with Embedded Wallets +sidebar_label: X +description: Configure default or custom X (Twitter) sign-in with MetaMask Embedded Wallets. +--- + +import SocialConnections from '@site/static/img/embedded-wallets/dev-dashboard/authentication-social-connections.png' + +[Sign in with X](https://developer.x.com/en/docs/authentication/oauth-2-0) lets users authenticate +with an X (Twitter) account. +Choose the default connection for the quickest setup, or configure a custom connection when you +need your own X credentials, consent screen, or identity provider. + +The SDK value for this provider is `AUTH_CONNECTION.TWITTER`. + +## Default X sign-in + +The default connection uses the X OAuth credentials managed by Embedded Wallets. +You don't need an X developer project. + +### Caveats + +- The X consent screen identifies the OAuth application managed by Embedded Wallets, not your dapp. +- You can't change the X application configuration, such as its scopes or branding, because you + don't own the credentials. +- The default connection and a custom connection are separate connections, so they produce different + wallet addresses for the same person unless you link them with a + [group connection](../group-connections.mdx). + +### Configure the default connection + +1. Open your project in the [MetaMask Developer Dashboard](https://developer.metamask.io). +2. Select **Social Connections**. +3. Enable **X** (Twitter). + +X in the Social Connections settings + +The SDK reads the connection from the dashboard. +You don't need to add X credentials to your SDK configuration. + +## Custom X sign-in + +Use a custom connection when the X authorization belongs to your dapp or an identity platform you +control. +Your X credentials sit in an identity provider such as Auth0 or Firebase, or in your own backend. + +:::note X credentials can't go in the dashboard + +Google, Discord, and Twitch connections take only a client ID, because they accept +`https://auth.web3auth.io/auth` as a redirect URI for a public client. +X OAuth requires a confidential client (a client secret) to exchange the authorization code, so +Embedded Wallets doesn't accept an X client ID on the social connection. + +::: + +:::caution Preserve wallet addresses + +Decide between the default and a custom connection before you onboard users. +Moving from the default X connection to Auth0, Firebase, or your own JWT connection changes every +user's wallet address unless both connections are in a +[group connection](../group-connections.mdx) with matching user identifiers. + +::: + +### Auth0 + +1. [Configure Twitter as a social connection in Auth0](https://marketplace.auth0.com/integrations/twitter-social-connection). +2. [Create an Auth0 connection](../custom-connections/auth0.mdx) in the MetaMask Developer + Dashboard. +3. For an implicit flow, call Embedded Wallets with the Auth0 connection ID and set the Auth0 + connection name to `twitter`. +4. For a JWT flow, authenticate with the Auth0 SDK, retrieve its raw ID token, and pass that token + to Embedded Wallets. + +### Firebase Authentication + +1. [Enable Twitter authentication in Firebase](https://firebase.google.com/docs/auth/web/twitter-login). +2. [Create a Firebase connection](../custom-connections/firebase.mdx) in the MetaMask Developer + Dashboard. +3. Sign the user in with the Firebase SDK and obtain a fresh Firebase ID token. +4. Pass the Firebase ID token and your Firebase connection ID to Embedded Wallets using the JWT + flow. + +Amazon Cognito doesn't offer X as a first-party social identity provider. + +### Your own backend + +1. Complete Sign in with X in your client and send the result to your backend. +2. Exchange the authorization code with X's token endpoint using your client secret, then validate + the user identity before trusting it. +3. Issue a fresh JWT with an `iat` no more than 60 seconds old and expose the signing public key + through a JSON Web Key Set (JWKS) endpoint. +4. [Create a custom JWT connection](../custom-connections/custom-jwt.mdx) that validates your + issuer, audience, JWKS, and user identifier. +5. Pass your JWT and custom connection ID to Embedded Wallets. + +Don't send an X client secret to a client application. + +## Group X connections + +A [group connection](../group-connections.mdx) gives the same person one wallet address across +several login methods. + +Default X and X through Auth0 or Firebase are separate connections. +They produce different wallet addresses unless you group them and every connection in the group +uses the same JWT user identifier (`email` or an aligned `sub`). + +Pass both the child connection ID and grouped connection ID when you bypass the modal: + +```tsx +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + groupedAuthConnectionId: '', + idToken, +}) +``` + +## Usage examples + +The implicit examples open an X or Auth0 authorization flow. +The JWT examples assume your Auth0, Firebase, or backend integration has already returned a fresh +ID token. + + diff --git a/embedded-wallets/dashboard/authentication.mdx b/embedded-wallets/dashboard/authentication.mdx index 702915cc698..c6c1eb5b99d 100644 --- a/embedded-wallets/dashboard/authentication.mdx +++ b/embedded-wallets/dashboard/authentication.mdx @@ -53,7 +53,7 @@ export const tileGroupsDataSocial = [ key: "twitter", title: "X (Twitter)", icon: "logo-twitter.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-x", + path: "/embedded-wallets/authentication/social-logins/x", }, { key: "facebook", @@ -71,44 +71,44 @@ export const tileGroupsDataSocial = [ key: "farcaster", title: "Farcaster", icon: "logo-farcaster.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-farcaster", + path: "/embedded-wallets/authentication/social-logins/farcaster", }, { key: "apple", title: "Apple", icon: "logo-apple.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-apple", + path: "/embedded-wallets/authentication/social-logins/apple", }, { key: "github", title: "GitHub", icon: "logo-github.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-github", + path: "/embedded-wallets/authentication/social-logins/github", }, { key: "reddit", title: "Reddit", icon: "logo-reddit.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-reddit", + path: "/embedded-wallets/authentication/social-logins/reddit", }, { key: "line", title: "Line", icon: "logo-line.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-line", + path: "/embedded-wallets/authentication/social-logins/line", }, { key: "kakao", title: "KaKao", icon: "logo-kakao.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-kakao", + path: "/embedded-wallets/authentication/social-logins/kakao", }, { key: "linkedin", title: "LinkedIn", icon: "logo-linkedin.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-linkedin", + path: "/embedded-wallets/authentication/social-logins/linkedin", }, { key: "twitch", @@ -120,7 +120,13 @@ export const tileGroupsDataSocial = [ key: "wechat", title: "WeChat", icon: "logo-wechat.png", - path: "/embedded-wallets/authentication/social-logins/oauth/#log-in-with-wechat", + path: "/embedded-wallets/authentication/social-logins/wechat", + }, + { + key: "telegram", + title: "Telegram", + icon: "logo-telegram.svg", + path: "/embedded-wallets/authentication/social-logins/telegram", }, { key: "new", diff --git a/ew-sidebar.js b/ew-sidebar.js index fc2c1a27a75..edfb33f092e 100644 --- a/ew-sidebar.js +++ b/ew-sidebar.js @@ -240,10 +240,19 @@ const sidebar = { collapsed: false, items: [ 'authentication/social-logins/google', + 'authentication/social-logins/apple', 'authentication/social-logins/facebook', - 'authentication/social-logins/twitch', + 'authentication/social-logins/x', 'authentication/social-logins/discord', - 'authentication/social-logins/oauth', + 'authentication/social-logins/twitch', + 'authentication/social-logins/github', + 'authentication/social-logins/reddit', + 'authentication/social-logins/line', + 'authentication/social-logins/kakao', + 'authentication/social-logins/linkedin', + 'authentication/social-logins/wechat', + 'authentication/social-logins/telegram', + 'authentication/social-logins/farcaster', ], }, { diff --git a/src/components/PasswordlessLoginExamples/index.tsx b/src/components/PasswordlessLoginExamples/index.tsx new file mode 100644 index 00000000000..77e81b84f92 --- /dev/null +++ b/src/components/PasswordlessLoginExamples/index.tsx @@ -0,0 +1,294 @@ +import CodeBlock from '@theme/CodeBlock' +import TabItem from '@theme/TabItem' +import Tabs from '@theme/Tabs' +import type { ReactNode } from 'react' + +type Method = 'email' | 'sms' + +type Platform = + 'react' | 'vue' | 'javascript' | 'react-native' | 'android' | 'ios' | 'flutter' | 'unity' + +const LABELS: Record = { + react: 'React', + vue: 'Vue', + javascript: 'JavaScript', + 'react-native': 'React Native', + android: 'Android', + ios: 'iOS', + flutter: 'Flutter', + unity: 'Unity', +} + +const CONNECT_PLATFORMS: Platform[] = [ + 'react', + 'vue', + 'javascript', + 'react-native', + 'android', + 'ios', + 'flutter', + 'unity', +] + +const MODAL_PLATFORMS: Platform[] = ['react', 'vue', 'javascript'] + +function config(method: Method) { + if (method === 'email') { + return { + authConnection: 'EMAIL_PASSWORDLESS', + loginMethod: 'email_passwordless', + flutterProvider: 'email_passwordless', + unityProvider: 'EMAIL_PASSWORDLESS', + hint: 'user@example.com', + loginMethodsName: 'email passwordless login', + } + } + return { + authConnection: 'SMS_PASSWORDLESS', + loginMethod: 'sms_passwordless', + flutterProvider: 'sms_passwordless', + unityProvider: 'SMS_PASSWORDLESS', + hint: '+1-555-555-0100', + loginMethodsName: 'SMS passwordless login', + } +} + +function PlatformTabs({ + platforms, + children, +}: { + platforms: Platform[] + children: (platform: Platform) => ReactNode +}) { + return ( + + {platforms.map(platform => ( + + {children(platform)} + + ))} + + ) +} + +function connectTo(platform: Platform, method: Method, custom: boolean) { + const c = config(method) + const customField = custom ? `\n authConnectionId: '',` : '' + const extra = `extraLoginOptions: { + login_hint: '${c.hint}', + },` + + switch (platform) { + case 'react': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' +import { useWeb3AuthConnect } from '@web3auth/modal/react' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${c.authConnection},${customField} + ${extra} +})`} + ) + case 'vue': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' +import { useWeb3AuthConnect } from '@web3auth/modal/vue' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${c.authConnection},${customField} + ${extra} +})`} + ) + case 'javascript': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' + +await web3auth.connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${c.authConnection},${customField} + ${extra} +})`} + ) + case 'react-native': + return ( + {`import { AUTH_CONNECTION, useWeb3AuthConnect } from '@web3auth/react-native-sdk' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo({ + authConnection: AUTH_CONNECTION.${c.authConnection},${customField} + ${extra} +})`} + ) + case 'android': { + const idLine = custom ? ',\n authConnectionId = ""' : '' + return ( + {`val response = web3Auth.connectTo( + LoginParams( + AuthConnection.${c.authConnection}, + loginHint = "${c.hint}"${idLine} + ) +)`} + ) + } + case 'ios': { + const idLine = custom ? ',\n authConnectionId: ""' : '' + return ( + {`let response = try await web3Auth.connectTo( + loginParams: LoginParams( + authConnection: .${c.authConnection}, + loginHint: "${c.hint}"${idLine} + ) +)`} + ) + } + case 'flutter': { + const idNote = custom + ? `\n // Configure loginConfig with your Auth Connection ID during initialization.` + : '' + return ( + {`final response = await Web3AuthFlutter.login( + LoginParams( + loginProvider: Provider.${c.flutterProvider},${idNote} + extraLoginOptions: ExtraLoginOptions( + login_hint: '${c.hint}', + ), + ), +);`} + ) + } + case 'unity': + return ( + {`var options = new LoginParams +{ + loginProvider = Provider.${c.unityProvider}, + extraLoginOptions = new ExtraLoginOptions + { + login_hint = "${c.hint}" + } +}; + +web3Auth.login(options);`} + ) + default: + return null + } +} + +function modalConfig(platform: Platform, method: Method) { + const c = config(method) + const loginMethods = `${c.loginMethod}: { + name: '${c.loginMethodsName}', + authConnectionId: '', + },` + + if (platform === 'react') { + return ( + {`import { WALLET_CONNECTORS, WEB3AUTH_NETWORK } from '@web3auth/modal' +import { type Web3AuthContextConfig } from '@web3auth/modal/react' + +const web3AuthContextConfig: Web3AuthContextConfig = { + web3AuthOptions: { + clientId: 'YOUR_WEB3AUTH_CLIENT_ID', + web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET, + modalConfig: { + connectors: { + [WALLET_CONNECTORS.AUTH]: { + label: 'auth', + loginMethods: { + ${loginMethods} + }, + }, + }, + }, + }, +}`} + ) + } + if (platform === 'vue') { + return ( + {`import { WALLET_CONNECTORS, WEB3AUTH_NETWORK } from '@web3auth/modal' +import { type Web3AuthContextConfig } from '@web3auth/modal/vue' + +const web3AuthContextConfig: Web3AuthContextConfig = { + web3AuthOptions: { + clientId: 'YOUR_WEB3AUTH_CLIENT_ID', + web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET, + modalConfig: { + connectors: { + [WALLET_CONNECTORS.AUTH]: { + label: 'auth', + loginMethods: { + ${loginMethods} + }, + }, + }, + }, + }, +}`} + ) + } + return ( + {`import { Web3Auth, WALLET_CONNECTORS, WEB3AUTH_NETWORK } from '@web3auth/modal' + +const web3auth = new Web3Auth({ + clientId: 'YOUR_WEB3AUTH_CLIENT_ID', + web3AuthNetwork: WEB3AUTH_NETWORK.SAPPHIRE_MAINNET, + modalConfig: { + connectors: { + [WALLET_CONNECTORS.AUTH]: { + label: 'auth', + loginMethods: { + ${loginMethods} + }, + }, + }, + }, +})`} + ) +} + +export default function PasswordlessLoginExamples({ + method, + platforms, +}: { + method: Method + platforms?: Platform[] +}) { + const label = method === 'email' ? 'email address' : 'phone number' + const connectPlatforms = platforms ?? CONNECT_PLATFORMS + + return ( + <> +

Default implicit flow

+

+ Pass the user's {label} as login_hint. The default connection opens a popup for + the OTP step. +

+ + {platform => connectTo(platform, method, false)} + + +

Custom connection in the modal

+

+ Add the Auth Connection ID from the dashboard to loginMethods. The email or + phone field and OTP stay inside the modal instead of a popup. +

+ + {platform => modalConfig(platform, method)} + + +

Custom implicit flow

+

+ When you bypass the modal, pass the same Auth Connection ID together with{' '} + login_hint. +

+ + {platform => connectTo(platform, method, true)} + + + ) +} diff --git a/src/components/SocialLoginExamples/index.tsx b/src/components/SocialLoginExamples/index.tsx new file mode 100644 index 00000000000..1e01f653bde --- /dev/null +++ b/src/components/SocialLoginExamples/index.tsx @@ -0,0 +1,497 @@ +import CodeBlock from '@theme/CodeBlock' +import TabItem from '@theme/TabItem' +import Tabs from '@theme/Tabs' +import type { ReactNode } from 'react' + +export type SocialLoginPlatform = + | 'react' + | 'vue' + | 'javascript' + | 'react-native' + | 'android' + | 'ios' + | 'flutter' + | 'unity' + | 'unreal' + | 'node' + +const DEFAULT_IMPLICIT_PLATFORMS: SocialLoginPlatform[] = [ + 'react', + 'vue', + 'javascript', + 'react-native', + 'android', + 'ios', + 'flutter', + 'unity', + 'unreal', +] + +const JWT_PLATFORMS: SocialLoginPlatform[] = [...DEFAULT_IMPLICIT_PLATFORMS, 'node'] + +const LABELS: Record = { + react: 'React', + vue: 'Vue', + javascript: 'JavaScript', + 'react-native': 'React Native', + android: 'Android', + ios: 'iOS', + flutter: 'Flutter', + unity: 'Unity', + unreal: 'Unreal Engine', + node: 'Node.js', +} + +type Props = { + authConnection: string + flutterProvider: string + unityProvider?: string + unrealProvider?: string + auth0Connection?: string + nativeCustom?: boolean + showJwt?: boolean + platforms?: SocialLoginPlatform[] + jwtPlatforms?: SocialLoginPlatform[] +} + +function PlatformTabs({ + platforms, + children, +}: { + platforms: SocialLoginPlatform[] + children: (platform: SocialLoginPlatform) => ReactNode +}) { + return ( + + {platforms.map(platform => ( + + {children(platform)} + + ))} + + ) +} + +function defaultImplicit(platform: SocialLoginPlatform, props: Props) { + const { authConnection, flutterProvider, unityProvider, unrealProvider } = props + switch (platform) { + case 'react': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' +import { useWeb3AuthConnect } from '@web3auth/modal/react' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${authConnection}, +})`} + ) + case 'vue': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' +import { useWeb3AuthConnect } from '@web3auth/modal/vue' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${authConnection}, +})`} + ) + case 'javascript': + return ( + {`import { AUTH_CONNECTION, WALLET_CONNECTORS } from '@web3auth/modal' + +await web3auth.connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${authConnection}, +})`} + ) + case 'react-native': + return ( + {`import { AUTH_CONNECTION, useWeb3AuthConnect } from '@web3auth/react-native-sdk' + +const { connectTo } = useWeb3AuthConnect() + +await connectTo({ + authConnection: AUTH_CONNECTION.${authConnection}, +})`} + ) + case 'android': + return ( + {`val response = web3Auth.connectTo( + LoginParams(AuthConnection.${authConnection}) +)`} + ) + case 'ios': + return ( + {`let response = try await web3Auth.connectTo( + loginParams: LoginParams(authConnection: .${authConnection}) +)`} + ) + case 'flutter': + return ( + {`final response = await Web3AuthFlutter.login( + LoginParams(loginProvider: Provider.${flutterProvider}), +);`} + ) + case 'unity': + return ( + {`var options = new LoginParams +{ + loginProvider = Provider.${unityProvider ?? authConnection} +}; + +web3Auth.login(options);`} + ) + case 'unreal': + return ( + {`FWeb3AuthLoginParams LoginParams; +LoginParams.LoginProvider = TEXT("${unrealProvider ?? flutterProvider}"); + +UWeb3AuthSDK::GetInstance()->Login(LoginParams);`} + ) + default: + return null + } +} + +function nativeCustomImplicit(platform: SocialLoginPlatform, props: Props) { + const { authConnection } = props + switch (platform) { + case 'react': + case 'vue': + return ( + {`await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${authConnection}, + authConnectionId: '', +})`} + ) + case 'javascript': + return ( + {`await web3auth.connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.${authConnection}, + authConnectionId: '', +})`} + ) + case 'react-native': + return ( + {`await connectTo({ + authConnection: AUTH_CONNECTION.${authConnection}, + authConnectionId: '', +})`} + ) + case 'android': + return ( + {`val response = web3Auth.connectTo( + LoginParams( + authConnection = AuthConnection.${authConnection}, + authConnectionId = "" + ) +)`} + ) + case 'ios': + return ( + {`let response = try await web3Auth.connectTo( + loginParams: LoginParams( + authConnection: .${authConnection}, + authConnectionId: "" + ) +)`} + ) + case 'flutter': + return ( + {`final response = await Web3AuthFlutter.login( + LoginParams(loginProvider: Provider.${props.flutterProvider}), +);`} + ) + case 'unity': + return ( + {`var options = new LoginParams +{ + loginProvider = Provider.${props.unityProvider} +}; + +web3Auth.login(options);`} + ) + case 'unreal': + return ( +

+ Configure the custom social connection in Blueprint by following the{' '} + + Unreal Engine custom authentication guide + + . +

+ ) + default: + return null + } +} + +function auth0Implicit(platform: SocialLoginPlatform, auth0Connection: string) { + switch (platform) { + case 'react': + case 'vue': + return ( + {`await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + extraLoginOptions: { + connection: '${auth0Connection}', + }, +})`} + ) + case 'javascript': + return ( + {`await web3auth.connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + extraLoginOptions: { + connection: '${auth0Connection}', + }, +})`} + ) + case 'react-native': + return ( + {`await connectTo({ + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + extraLoginOptions: { + connection: '${auth0Connection}', + }, +})`} + ) + case 'android': + return ( + {`val response = web3Auth.connectTo( + LoginParams( + authConnection = AuthConnection.CUSTOM, + authConnectionId = "", + extraLoginOptions = ExtraLoginOptions( + domain = "https://", + connection = "${auth0Connection}" + ) + ) +)`} + ) + case 'ios': + return ( + {`let response = try await web3Auth.connectTo( + loginParams: LoginParams( + authConnection: .CUSTOM, + authConnectionId: "", + extraLoginOptions: ExtraLoginOptions( + domain: "https://", + connection: "${auth0Connection}" + ) + ) +)`} + ) + case 'flutter': + return ( + {`final response = await Web3AuthFlutter.login( + LoginParams( + loginProvider: Provider.jwt, + extraLoginOptions: ExtraLoginOptions( + domain: 'https://', + verifierIdField: 'sub', + connection: '${auth0Connection}', + ), + ), +);`} + ) + case 'unity': + return ( + {`var options = new LoginParams +{ + loginProvider = Provider.JWT, + extraLoginOptions = new ExtraLoginOptions + { + domain = "https://", + verifierIdField = "sub", + connection = "${auth0Connection}" + } +}; + +web3Auth.login(options);`} + ) + case 'unreal': + return ( +

+ The current Unreal Engine SDK documentation provides this flow through Blueprint + configuration, not a verified C++ example. Configure the Auth0 connection by following the{' '} + + Unreal Engine custom authentication guide + + . +

+ ) + default: + return null + } +} + +function jwtFlow(platform: SocialLoginPlatform) { + switch (platform) { + case 'react': + case 'vue': + return ( + {`const idToken = await getIdToken() + +await connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + idToken, +})`} + ) + case 'javascript': + return ( + {`const idToken = await getIdToken() + +await web3auth.connectTo(WALLET_CONNECTORS.AUTH, { + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + idToken, +})`} + ) + case 'react-native': + return ( + {`const idToken = await getIdToken() + +await connectTo({ + authConnection: AUTH_CONNECTION.CUSTOM, + authConnectionId: '', + idToken, +})`} + ) + case 'android': + return ( + {`val response = web3Auth.connectTo( + LoginParams( + authConnection = AuthConnection.CUSTOM, + authConnectionId = "", + idToken = idToken + ) +)`} + ) + case 'ios': + return ( + {`let response = try await web3Auth.connectTo( + loginParams: LoginParams( + authConnection: .CUSTOM, + authConnectionId: "", + idToken: idToken + ) +)`} + ) + case 'flutter': + return ( + {`final response = await Web3AuthFlutter.login( + LoginParams( + loginProvider: Provider.jwt, + extraLoginOptions: ExtraLoginOptions( + id_token: idToken, + ), + ), +);`} + ) + case 'unity': + return ( + {`var options = new LoginParams +{ + loginProvider = Provider.JWT, + extraLoginOptions = new ExtraLoginOptions + { + id_token = idToken + } +}; + +web3Auth.login(options);`} + ) + case 'unreal': + return ( +

+ The current Unreal Engine SDK documentation doesn't provide a verified C++ JWT example. + Configure the JWT connection and login in Blueprint by following the{' '} + + Unreal Engine custom authentication guide + + . +

+ ) + case 'node': + return ( + {`const result = await web3auth.connect({ + authConnectionId: '', + idToken, +})`} + ) + default: + return null + } +} + +export default function SocialLoginExamples(props: Props) { + const implicitPlatforms = props.platforms ?? DEFAULT_IMPLICIT_PLATFORMS + const jwtPlatforms = + props.jwtPlatforms ?? JWT_PLATFORMS.filter(p => p === 'node' || implicitPlatforms.includes(p)) + + return ( + <> +

Default implicit flow

+ + {platform => defaultImplicit(platform, props)} + + + {props.nativeCustom && ( + <> +

Native custom implicit flow

+

+ Use these examples after you add your own client ID on the social connection in the + dashboard. For Android and iOS, add the connection to authConnectionConfig{' '} + during initialization. Flutter, Unity, and Unreal Engine currently use their platform's{' '} + loginConfig; configure it by following the custom authentication guide for{' '} + Flutter,{' '} + Unity, or{' '} + Unreal Engine. +

+ + {platform => nativeCustomImplicit(platform, props)} + + + )} + + {props.auth0Connection && ( + <> +

Auth0 implicit flow

+

+ These examples use the Auth0 custom connection configured for your SDK. Replace the + connection ID and domain with your Auth0 values. For Android and iOS, add the connection + to authConnectionConfig during initialization. Flutter, Unity, and Unreal + Engine currently use their platform's loginConfig; configure it by + following the custom authentication guide for{' '} + Flutter,{' '} + Unity, or{' '} + Unreal Engine. +

+ + {platform => auth0Implicit(platform, props.auth0Connection as string)} + + + )} + + {props.showJwt !== false && ( + <> +

JWT flow

+

+ Obtain a fresh ID token from your identity aggregator or backend before calling Embedded + Wallets. The token issuer and claims must match the custom connection in the dashboard. +

+ {platform => jwtFlow(platform)} + + )} + + ) +} diff --git a/src/theme/MDXComponents.tsx b/src/theme/MDXComponents.tsx index 8f582612552..2b190fcff96 100644 --- a/src/theme/MDXComponents.tsx +++ b/src/theme/MDXComponents.tsx @@ -1,9 +1,13 @@ // Import the original mapper +import PasswordlessLoginExamples from '@site/src/components/PasswordlessLoginExamples' import Pill from '@site/src/components/Pill' +import SocialLoginExamples from '@site/src/components/SocialLoginExamples' import MDXComponents from '@theme-original/MDXComponents' export default { // Re-use the default mapping ...MDXComponents, Pill, + PasswordlessLoginExamples, + SocialLoginExamples, } diff --git a/static/logos/logo-telegram.svg b/static/logos/logo-telegram.svg new file mode 100644 index 00000000000..20bba56e7dd --- /dev/null +++ b/static/logos/logo-telegram.svg @@ -0,0 +1,3 @@ + + + \ No newline at end of file diff --git a/vercel.json b/vercel.json index 573af65795b..68e388088a2 100644 --- a/vercel.json +++ b/vercel.json @@ -782,6 +782,11 @@ "source": "/embedded-wallets/dashboard/whitelist/", "destination": "/embedded-wallets/dashboard/allowlist/" }, + { + "source": "/embedded-wallets/authentication/social-logins/oauth/", + "destination": "/embedded-wallets/authentication/social-logins/", + "permanent": true + }, { "source": "/embedded-wallets/how-it-works/", "destination": "/embedded-wallets/architecture/"