Social login — Zkrinet plugin
On Zkrinet: add the block under Building blocks in the panel — one click, your own code is untouched and a snapshot is taken first. The installation steps below apply if you run PocketBase yourself, for example after an export.
Log in with Google, GitHub, Apple, Microsoft, Facebook, Discord and more. Tested against PocketBase 0.40.4.
#Honestly, what is what
The login itself is PocketBase's own (OAuth2, around thirty providers). The plugin turns it on, maps name and profile picture from the provider, and adds a check that tells you exactly what is missing. What usually stops people is not the code — it is the settings at Google & co. That is why the guide below is the most important part.
#Install
Copy pb_hooks/ and pb_migrations/ into the project and restart. Set Application URL under Settings to your real address (https).
#The check
GET /api/zk/social/kontroll (superuser)Responds with the callback address you should paste in at the provider, which providers have been added, and warnings (missing or incorrect Application URL, http instead of https, localhost, no provider added).
#Add a provider
- Get the callback address from the check. It looks like this:
https://dinapp.se/api/oauth2-redirect - Create an app at the provider (below) and paste the address in as redirect URI / callback URL.
- Copy Client ID and Client secret to the admin panel: Collections → users → ⚙ → OAuth2 → Add provider.
| Provider | Where you create the app | Pitfall |
|---|---|---|
| console.cloud.google.com → APIs & Services → Credentials → OAuth client ID (Web) | The app must be "published" on the OAuth consent screen, otherwise only test users can log in. | |
| GitHub | github.com → Settings → Developer settings → OAuth Apps | The easiest of all. A good one to start with. |
| Microsoft | portal.azure.com → App registrations | Choose which accounts are allowed to log in (personal, work or both). |
| Discord | discord.com/developers → Applications → OAuth2 | — |
| Apple | developer.apple.com → Identifiers + Keys | Requires a paid developer account. Apple also requires Sign in with Apple in iPhone apps that offer other social login. The secret is a key that expires every 6 months. |
| developers.facebook.com → My Apps | Only works for yourself until the app is verified as a business app (Business verification). |
#The button in your app
await pb.collection("users").authWithOAuth2({ provider: "google" })Which providers are enabled (with name and logo) you fetch without logging in:
const { oauth2 } = await pb.collection("users").listAuthMethods()#Security
- The keys live in PocketBase's settings, never in the code. The public list of login methods never shows the secrets (tested).
- PocketBase itself rejects a provider without a secret.
- The check requires superuser.