Log in with Google, GitHub, and more

OneDrop can show Continue with … buttons on the log-in and sign-up pages. Each provider appears once you add its OAuth client ID and secret to .env. With none set, the pages look as they do out of the box.

How it works

• New people can sign up with a provider when sign-up is open. Their account uses the provider’s name and email and has no password. They can add one later under Settings → Security.
• Returning people are logged in to the account connected to that provider.
• Existing accounts are connected automatically when the provider confirms it verified the email and the OneDrop account’s email is verified too. Otherwise the person sees a message asking them to log in first and connect the provider from security settings. This stops anyone from taking over an account by adding its email address at a provider.
• One account, many providers. Someone can connect Google, GitHub and the rest to one account and log in with any of them, or with a password.
• Profile pictures come from the provider. The first provider with a picture sets the avatar, and signing in with it again keeps it current. Connecting another provider doesn’t replace it; disconnecting the provider switches to another connected provider’s picture.
• Two-factor authentication is still asked for after the provider sign-in.
• Invite links work: signing up with a provider from an invite accepts it.
• Security settings list each provider, with Connect and Disconnect buttons. People can’t disconnect their last way to log in.

Callback URLs

When you create the OAuth app at each provider, use this redirect (callback) URL, with your APP_URL:

https://zap.example.com/login/{provider}/callback

where {provider} is google, microsoft, github, gitlab, or oidc.

Set up a provider

After changing .env on a server, run php artisan config:cache (the deploy script does this for you).