Set up a sign-in method

This walks through adding a method, where to get the credentials for the popular providers, and the two switches that change how sign-in behaves: per-space overrides and approval.

Add a method

1. Open your organization → Sign-in & auth → the Reader sign-in panel.

2. Pick a method from the Add method dropdown and click + Add method.

3. Fill in the fields it shows (built-in methods have none), then click Save.

Each method shows only the fields it needs. Built-ins show none. Social and enterprise methods show the credential fields from the tables below.

Secret fields

Any field marked as a secret (client secret, shared secret, bind password, directory token) is write-only. After you save, it's hidden. To keep it, leave the field blank on your next save; to change it, type a new value. Blank means "keep what's there."

The redirect / callback URL

Social and OIDC providers ask you for an authorized redirect URI (a.k.a. callback URL) when you create the app on their side. Use your API origin followed by the reader callback path — for a Forumulate-hosted site that's:

https://<your-site>/api/public/visitor-oidc/callback

Add that to your provider app's allowed redirect URIs, or sign-in will be rejected by the provider.

Where to get credentials (popular providers)

• Google — Google Cloud Console → APIs & Services → Credentials → OAuth client ID (type: Web). Copy the Client ID and Client secret; add the redirect URI.

• Microsoft — Entra ID (Azure AD) → App registrations → New registration. Use the Application (client) ID; create a client secret under Certificates & secrets; add the redirect URI.

• Apple — Apple Developer → Certificates, Identifiers & Profiles → a Services ID; configure Sign in with Apple and the return URL.

• LinkedIn — LinkedIn Developers → your app → Auth tab → Client ID / Primary secret; add the redirect URL.

• GitHub — GitHub → Settings → Developer settings → OAuth Apps → New OAuth App; set the callback URL; copy the Client ID and generate a client secret.

• Discord — Discord Developer Portal → your application → OAuth2; copy the Client ID and secret; add the redirect.

• Facebook — Meta for Developers → your app → Facebook Login → Settings; add the redirect; use the App ID / App secret.

• GitLab — for gitlab.com, create an application under User Settings → Applications. Self-hosting GitLab? Also fill in your GitLab base URL as the issuer.

• Any OIDC provider — from your provider you need the issuer URL (the base it publishes /.well-known/openid-configuration under), a client ID, and a client secret.

• SAML — from your identity provider you need the entity ID, the SSO URL, and the signing certificate.

Order and labels

Methods appear on the sign-in card in the order you add them, and you can give a method a custom label (for example, "Sign in with Acme SSO" instead of the default). Remove a method any time to take it off the card.

Per-space overrides

By default your reader sign-in methods apply to the whole organization. A single space can override them — useful when, say, your public docs allow Google and email, but your internal knowledge base should only allow your company SSO.

Set an override from the space's own Sign-in & auth settings. A space with an override ignores the org defaults entirely and uses its own list. Remove the override to fall back to the org defaults.

Require approval for new members

Turn on approval if you don't want a fresh sign-in to instantly become a full member. With approval on, a first-time reader is created as pending: they're signed in, but they can't post until an admin approves them. This is a good gate for private communities or paid tiers.

Approval is a single toggle in the Reader sign-in panel and applies to readers who arrive through any method.

Test before you announce

After saving a social or OIDC method, click its button on your own sign-in card and complete a real sign-in. A misconfigured redirect URI or client secret is caught immediately — far better than a reader finding it.

Next: Reader sign-in on your own domain →