Login flows

Routes

With routes enabled, the package registers three routes in the web middleware group:

Route	Name	Description
`GET /socialite/{driver}`	`socialite.redirect`	Redirects to the provider
`ANY /socialite/{driver}/callback`	`socialite.callback`	Callback of the provider, signs the user in
`ANY /socialite/{driver}/token`	`socialite.token`	Signs in with a provider token from a mobile or web SDK

Build the links with the route names, e.g. route('socialite.redirect', 'google'). Projects which only use the token login of crudadmin/helpers set 'routes' => false. Apple and Google One Tap send the callback as a POST request. Exclude socialite/* from CSRF verification when you use them. The default for websites, 'stateless' => false.

<a href="{{ route('socialite.redirect', 'google') }}?url_previous={{ urlencode(url()->current()) }}">
    {{ _('Sign in with Google') }}
</a>

The previous url is taken from url_previous, or from the Referer header.
After the callback, the user is signed in with the guard of the config, with the remember option.
The browser is redirected back to the previous url, or to app_url.

Errors redirect back with the errorMessage key in the session errors. For separate frontends, e.g. Nuxt, set 'stateless' => true. The flow is the same, but the user is not signed in to a session. The previous url receives the token in the query string:

https://app.example.com/account?auth_token=12|abc...&expires_in=&previous_path=https://app.example.com/account

Errors redirect with ?errorMessage=....

Passing data through the redirect

List request parameters in store to keep them until the callback. Read them with getStorage() in the hooks:

/socialite/google?store=referral&referral=SUMMER26

JSON requests return JSON instead of redirects. Mobile apps sign in with the native SDK of the provider and send its token:

POST /socialite/apple/token

{ "token": "eyJraWQiOiJXNldjT0tC...", "username": "Jane Doe" }

{ "data": { "auth_token": "12|abc...", "expires_in": null, "previous_path": null } }

Google and Facebook send an access token, Apple sends the identity token.
Apple sends the name of the user only on the first sign in. Pass it as username.
expires_in is stored in {prefix}_token_expires_at.

Apps using the helpers authentication call its route instead. It returns the same login response as the password login:

POST /api/auth/login/socialite/google

{ "token": "ya29.a0AfH6SM..." }

Google One Tap

The onetap driver verifies the credential of the Google Identity Services script. Point its login_uri to the callback:

<div id="g_id_onload"
     data-client_id="{{ config('services.google.client_id') }}"
     data-login_uri="{{ route('socialite.callback', 'onetap') }}">
</div>

The account is stored in the gp_* columns, the same as the google driver.

Linking accounts

A signed in user who goes through the login links the provider to his account. The provider id, e-mail and token are saved, the user is not changed otherwise.

Session login: the user is signed in with the guard of the config.
Stateless login: pass the API token of the user with store:

/socialite/facebook?store=access_token&access_token=12|abc...

No new token is created in this case.

Disabling registration

With 'register' => false, only existing users can sign in. A list of drivers allows registration only through them:

config/admin_socialite.php

'register' => ['google', 'apple'],

Getting started

Helpers

Socialite

REST API

Website

Gutenberg

Package development

Routes

Passing data through the redirect

Google One Tap

Linking accounts

Disabling registration

​Routes

​Session login

​Stateless login

​Passing data through the redirect

​Token login

​Token login with crudadmin/helpers

​Google One Tap

​Linking accounts

​Disabling registration

Routes

Session login

Stateless login

Passing data through the redirect

Token login

Token login with crudadmin/helpers

Google One Tap

Linking accounts

Disabling registration