# Social login

Social login is separate from workspace integrations.

Configure Facebook, X, and Google sign-in credentials under `Admin → Settings → Profiles → Social Auth`.

The page displays the callback URLs generated for your App URL. Their pattern is:

- `https://your-domain.example/socialAuth/facebook/callback`
- `https://your-domain.example/socialAuth/x/callback`
- `https://your-domain.example/socialAuth/google/callback`

Create a separate provider application for each environment, register the exact callback, and test both new-account registration and an existing user's login. Social login still respects the platform's email-verification and 2FA behavior.

## X OAuth 2.0

1. Open the [X Developer Portal](https://developer.x.com/) and create or select the app used by this JustFlows environment.
2. Enable `OAuth 2.0` under the app's user-authentication settings, select a confidential `Web App`, and grant read access.
3. Register the exact callback shown by JustFlows: `https://your-domain.example/socialAuth/x/callback`. Add the public site URL when X requests it.
4. Copy the OAuth 2.0 `Client ID` and `Client secret` into the `X client ID` and `X client secret` fields under `Admin → Settings → Profiles → Social Auth`, then save.
5. Test sign-in with an account whose email address X can return. JustFlows uses the authorization-code flow with PKCE and requests `users.read`, `users.email`, and `tweet.read`.

<Warning>
Existing installations must replace legacy Twitter OAuth 1.0a API Key and API Secret credentials with the X OAuth 2.0 Client ID and Client Secret. The old `twitter` provider slug and `/socialAuth/twitter/callback` URL are no longer accepted.
</Warning>