---
title: "Social login"
description: "Configure social OAuth providers while keeping provider-ready separate from production support."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# Social login

## Provider status

Social login is provider-ready until real provider callback L4 exists. XID has local callback, profile mapping, nonce, policy, and organization gate coverage, but real provider secrets and callbacks are required before production-supported claims.

| Provider | Protocol | Status |
| --- | --- | --- |
| GitHub | OAuth authorization code | Provider-ready, missing real GitHub callback L4. |
| Google | OIDC authorization code | Provider-ready, missing real Google callback L4. |
| Microsoft account | OIDC authorization code | Provider-ready, separate from Microsoft Entra ID. |
| Apple | Sign in with Apple | Provider-ready, missing real Apple web configuration and callback L4. |

## Configuration contract

- Provider credentials are stored as secret references and are never returned to the browser.
- Hosted Auth only displays enabled providers that have credentials and organization policy permission.
- Callbacks verify state, nonce, issuer, audience, and email policy before creating or linking users.
- GitHub social login is separate from GitHub Enterprise Cloud SAML or SCIM.
- Microsoft account login is separate from Microsoft Entra ID enterprise SSO.

Source: https://xid.dev/social-login/index.mdx