Sign In with Google or Facebook (REST)

In This Article

Let members sign in with their Google or Facebook account. You add a login interface, like a Sign in with Google button, to your own site whose handler starts the login flow. For Wix Studio enterprise and Wix Channels sites, the same flow also works with custom OpenID Connect (OIDC) connections.

Wix runs the authentication flow, so you don't need to build a login page, manage the provider's OAuth flow, or use an API key. The member simply signs in with their existing account.

Important: Wix's Astro integration doesn't currently support this flow. Instead, add a Wix login page and enable your providers as sign-in buttons on that page.

To sign members in with a provider Wix doesn't support, such as GitHub, see Bring Your Own Identity Provider, where your backend runs the provider's OAuth.

Before you begin

Before starting to code, make sure that you:

Create a headless client and note its client ID.
Set your callback URL as an allowed authorization redirect URI.

Send members straight to a provider

This is the recommended approach for most sites: the member clicks a provider button in your own UI and goes directly to that provider, with no Wix login page in between.

The flow is the same as a Wix login page, except that you add an idp field to the authorization request, set to the provider's connection ID. Use the following connection IDs:

Provider	Connection ID
Google	`0e6a50f5-b523-4e29-990d-f37fa2ffdd69`
Facebook	`3ecad13f-52c3-483d-911f-31dbcf2a6d23`

Note: Custom OpenID Connect (OIDC) connections, such as your own single sign-on (SSO) provider, are available only for Wix Studio enterprise and Wix Channels sites. Eligible sites have SSO settings in the dashboard, where you can configure a connection and get its ID. To sign members in through such a connection, set idp to that connection's ID. Wix still runs the flow. To learn more, see Setting up SSO.

Step 1 | Prepare security data

Before starting the login, prepare the following:

A redirect URI for your callback page. It must be an allowed authorization redirect URI.
Your client ID, found in your project's Headless Settings under Headless clients.
A PKCE code verifier and code challenge.
An OAuth 2.0 state parameter.

Store the code verifier, code challenge, and state so they're available on your callback page.

Step 2 | Create a redirect session

In the handler for your Sign in with Google button, call Create Redirect Session with the security data, plus an idp field set to the provider's connection ID. Authorize the request with the current visitor's access token.

Copy

The response includes a fullUrl that sends the member to the provider.

Note: The fullUrl is single-use. If the member needs to retry signing in, create a new redirect session.

Step 3 | Redirect the member to the provider

Redirect the member to the fullUrl from the response. Wix sends them straight to the provider's sign-in page. After they authenticate, Wix redirects them back to your redirect URI with code and state in the URL fragment.

Step 4 | Retrieve member tokens

On your callback page, confirm the returned state matches the value you stored, then exchange the code for member tokens by calling Retrieve Tokens:

Copy

The response includes an access_token, a refresh_token, and expires_in. Use the tokens to make authenticated API calls as the member. To refresh tokens or log the member out, see Add a Wix Login Page (REST).

Note: You can also send members to the Wix login page, where each available provider appears as a button alongside email login and members choose how to sign in. To do so, follow the standard Wix login page flow without an idp field.