1.0.0
Nov 3, 2026
Latest- First release: Continue with Facebook for OpenCart 4.x and 3.0.x.
Facebook Login for OpenCart
by Kavio Labs · for OpenCart 4.x and 3.0.x
Continue with Facebook for OpenCart 4.x and 3.0.x: a Facebook button on the login, register and checkout pages; OAuth code flow with state and browser binding, every Graph API call signed with appsecret_proof, safe account matching (optional password step for existing e-mails), connected accounts for customers, sign-in statistics with failure reasons, numbered setup steps. Works with the SameSite=Strict session cookie of OpenCart 4. Upgrade path: Social Login Pro imports its keys and connected accounts. No OCMOD. Tested against a local mock of Facebook.
Built forOpenCart
Continue with Facebook, no password to forget1 of 6
What it does
Continue with Facebook for OpenCart 4.x and 3.0.x: a Facebook button on the login, register and checkout pages; OAuth code flow with state and browser binding, every Graph API call signed with appsecret_proof, safe account matching (optional password step for existing e-mails), connected accounts for customers, sign-in statistics with failure reasons, numbered setup steps. Works with the SameSite=Strict session cookie of OpenCart 4. Upgrade path: Social Login Pro imports its keys and connected accounts. No OCMOD. Tested against a local mock of Facebook.
Features
Where people sign in
- Login page, register page and the checkout for signed-out shoppers
- Facebook blue, outline or icon only; rounded, pill or square; above or below the login form
Safe by design
- OAuth code flow with state and browser binding, single-use states
- Every Graph API call signed with appsecret_proof; app secret stored encrypted; Graph API version you choose
- An e-mail of an existing customer connects to that account, or the account password is asked once (your choice)
- Works with the SameSite=Strict session cookie of OpenCart 4: cart and session are kept
For customers and for you
- Connected accounts in the customer account
- Statistics: sign-ins, new accounts, completion rate, failure reasons
- Numbered setup steps, redirect URI with a Copy button, "Check settings"
- Need Google with One Tap, Apple or Microsoft later? Social Login Pro imports the keys and connected accounts, and this extension steps back by itself
- Events only, no OCMOD
- One license for OpenCart 4 and 3, tested on 4.1.0.4 and 3.0.5.1
- Fewer forgotten passwords, more finished checkouts. Shoppers sign in with the Facebook account they already use; new customers arrive with their name and e-mail.
What you get
- Download & installTwo installer packages (.ocmod.zip): one for OpenCart 4.0.2 – 4.1.x and one for 3.0.3 – 3.0.5. One license key covers both. Download it from My licenses right after payment.
- 12 months of updates & supportNew versions and help for 12 months (24 or 36 months at checkout). After that the extension keeps working; renew anytime at 50%.
- License for your storeOne production domain with all its subdomains; staging and local development hosts are free. How licensing works
- 30-day refundFull refund within 30 days of your first purchase, no reason needed. Refund policy
- Tested buildsOpenCart 4.1.0.4, 3.0.5.1. Tested on OpenCart 4.1.0.4 and OpenCart 3.0.5.1.
- Documentation & supportFull guide (Installation, Configuration, Usage, FAQ) on this page. Tickets from your account, first reply within 1 business day.
Compatibility
Facebook Login works with OpenCart 4.1.0.4, 3.0.5.1.
We list the builds we install and test on. “Tested” means the test plan ran on that build; “Supported” means the build is inside the supported range.
| Version | Range | Runs on | Status |
|---|---|---|---|
| OpenCart 4.1.0.x | 4.1.0.0 – 4.1.0.4 | PHP 8.1 – 8.3 | Tested on 4.1.0.4 |
| OpenCart 4.0.2.x | 4.0.2.0 – 4.0.2.3 | PHP 8.0 – 8.2 | Supported |
| OpenCart 3.0.x | 3.0.3.8 – 3.0.5.x | PHP 7.4 – 8.1 | Tested on 3.0.5.1 |
How do I install the extension?
- Upload. Extensions > Installer: upload the .ocmod.zip for your OpenCart version (4.x or 3.0.x). Both packages come with every license.
- Install and enable. Extensions > Extensions > Modules: install, open the settings and switch it on. Events register themselves; nothing is patched.
- Enter the license key. Paste the key from My licenses. Subdomains, staging and local hosts are included; you have 14 days to do it.
The Documentation tab covers the settings and every screen.
Which OpenCart versions does it work with?
OpenCart 4.1.0.4, 3.0.5.1. Tested on OpenCart 4.1.0.4 and OpenCart 3.0.5.1. The Compatibility tab lists every version range.
Do the extensions change core files?
No. They work through OpenCart events and standard extension types (modules, order totals, themes). No core file edits, no OCMOD patches, no theme template edits, so OpenCart updates and other extensions keep working.
Do I get packages for OpenCart 4 and OpenCart 3?
Yes. Every download has a package for OpenCart 4.0.2 to 4.1.x and one for OpenCart 3.0.3 to 3.0.5, and the license key works with both. Moving from OpenCart 3 to 4 later costs nothing.
What does the license cover?
One production store domain with every subdomain (www, shop., staging.), plus local development hosts such as localhost, *.local and *.test. A store on another domain needs its own license; a second-store license is 40% off. You have 14 days after installing to enter the key. 12 months of updates and support are included; after that the extension keeps working and renewals are 50% off. How licensing works
Can I get a refund?
Yes. Ask for a full refund within 30 days of your first purchase, no reason needed: open a ticket or write to [email protected] with your order number. The money goes back to the card or bank account you paid with within 5 business days of approval. Refund policy
How do I get help?
Open a ticket from your account, so your license details are attached. We answer Monday to Friday: bug reports within 1 business day, how-to questions within 2. Support policy. Not a customer yet? Ask a pre-sales question.
7 more answers about setup and daily use in the Documentation tab.
Overview
Facebook Login lets shoppers sign in and register with their Facebook account: a "Continue with Facebook" button on the login, register and checkout pages.
- Buttons where people sign in. On the login page, the register page and the checkout for signed-out shoppers, in Facebook blue, outline or icon only, three shapes, above or below the login form. In narrow columns the label shortens to "Facebook".
- Safe account matching. Facebook shares an e-mail only when the person confirmed it. An e-mail of an existing customer connects to that customer (or, if you prefer, the account password is asked once). New customers get an account with their name and e-mail; when Facebook shares no e-mail, a short "Almost done" form asks for it.
- Connected accounts. Customers see their connected Facebook account in their account and can disconnect it once they have a password.
- Security. OAuth code flow with state and browser binding, single-use states, every Graph API call signed with appsecret_proof, app secret stored encrypted, Graph API version you choose. Works with OpenCart 4's SameSite=Strict session cookie: the return from Facebook continues on your own site, so the cart and session are kept.
- Statistics. Sign-ins, new accounts, completion rate and the reasons why sign-ins failed, per day.
- Room to grow. Need Google with One Tap, Apple or Microsoft later? Social Login Pro (sold separately) adds them; when you install it, it copies the Facebook keys and the connected accounts of this extension, and this extension steps back so shoppers never see two Facebook buttons.
No OCMOD, no core file edits. One licence covers OpenCart 4 and 3. Tested on OpenCart 4.1.0.4 and 3.0.5.1 with the default themes against a local mock of Facebook's login and Graph API endpoints (no real Facebook account was used); other 4.0.2.x to 4.1.x and 3.0.3.8 to 3.0.5.x versions are expected to work but are not tested. Themes that replace the login, register or checkout templates may need a different place for the button.
Installation
Requirements
- OpenCart 4.0.2.0 - 4.1.x or 3.0.3.8 - 3.0.5.x, PHP 7.4 or newer with the cURL and OpenSSL extensions.
- HTTPS on the live storefront: Facebook accepts only https redirect addresses for live apps.
- A Meta for Developers app with the Facebook Login use case (free), switched to Live.
OpenCart 4
- Extensions > Installer: upload
kv_facebook_login.ocmod.zipand press the install button. - Extensions > Extensions > Modules: install Facebook Login, then open it.
OpenCart 3
- Extensions > Installer: upload
kv_facebook_login-oc3.ocmod.zip. - Extensions > Modifications: press Refresh (the extension has no OCMOD changes; this only clears the cache).
- Extensions > Extensions > Modules: install Facebook Login, then open it.
The page is also under Customers > Facebook sign-in.
First steps
- Facebook keys: press "Open the console" and follow the numbered steps: create the app, add the redirect URI shown on the page (Copy button) to "Valid OAuth Redirect URIs" and keep "Use Strict Mode" on. Paste the App ID and App secret, tick "Show the button" and save.
- Check settings tells you what is missing.
- Settings: choose the pages and the button style.
- Enter your licence key in Settings (14-day trial without a key). Without a valid licence the storefront shows no button; the admin and the connected accounts stay.
Update
- OpenCart 4: Extensions > Installer, uninstall and delete the old upload, upload the new zip and install it. Do not uninstall the module under Extensions > Modules: that removes the keys and connected accounts.
- OpenCart 3: upload the new zip over the old one, then Modifications > Refresh.
Moving to Social Login Pro
Install Social Login Pro as usual. It copies the Facebook keys (when it has none of its own) and every connected Facebook account of this extension. While Social Login Pro is switched on, this extension shows nothing on the storefront and says so on its admin page; you can then uninstall it. If you switch Social Login Pro off or remove it, this extension works again with its own data.
Uninstall
Extensions > Extensions > Modules > Uninstall removes the events, the settings and all data of the extension (Facebook keys, connected accounts, statistics). Customer accounts stay; customers who only used Facebook can set a password with "Forgotten password".
Configuration
Facebook keys
| Field | What to enter |
|---|---|
| Client ID | The App ID (App settings > Basic) |
| Client secret | The App secret. Stored encrypted and never shown again; leave the field empty to keep the stored value. |
| Graph API version | For example v26.0. An invalid value falls back to the version the extension was tested with. |
| Show the button | On when the required fields are filled in. With incomplete keys the button stays off. |
In Meta for Developers add the redirect URI shown on the page under Facebook Login > Settings > "Valid OAuth Redirect URIs", keep "Use Strict Mode" on, and switch the app to Live. The extension asks for public_profile and email.
Settings
- Status: on or off for the storefront.
- Show buttons on: login page, register page, checkout (signed-out shoppers).
- Button style: Facebook blue, outline or icon only. Shape: rounded, pill or square. Position: above or below the login form.
- Existing e-mail: connect automatically (Facebook shares only confirmed e-mails; default), or always ask for the account password once.
- New customers: create an account at the first sign-in, or only let existing customers sign in. New accounts get the default customer group; if that group needs approval, the shopper is told so and signs in after approval.
- Keep statistics: days of the sign-in log (7 - 3650).
- License key (own-store edition).
Usage
For shoppers
- A shopper clicks "Continue with Facebook" on the login, register or checkout page and approves at Facebook.
- Back in the store the shopper is signed in and returns to the page they came from (the checkout stays the checkout).
- Known Facebook account: signed in at once.
- E-mail of an existing customer: the Facebook account is connected to that customer and signed in (or, when the store always asks, "Connect your account" asks the account password once).
- New shopper: the account is created with the name and e-mail from Facebook. When Facebook shares no e-mail, "Almost done" asks for it first.
- Account > Connected accounts shows the connected Facebook account. An account created by a Facebook sign-in keeps it as its only sign-in method until the customer sets a password with "Forgotten password"; then it can be disconnected.
For you
- Overview: sign-ins, new accounts, completion (button clicks that ended signed in), connected customers and problems for the last 7, 30 or 90 days, per day, with the latest activity, a setup checklist and the redirect URI.
- Why sign-ins failed: cancelled at Facebook, finished in another browser, link used twice, took too long, wrong password, Facebook not reachable and more, in plain words.
- Deleting a customer in the admin also removes their connection.
FAQ
Does it change core files or use OCMOD?
No. It works with OpenCart events only.
Can someone take over an account with a Facebook account that uses the same e-mail?
Facebook shares an e-mail only when its owner confirmed it, so the extension treats it like a confirmed e-mail. If you prefer, set "Existing e-mail" to always ask for the account password once.
My store uses the SameSite=Strict session cookie (OpenCart 4 default). Does that matter?
No. The return from Facebook is a cross-site request, so the extension stores the answer, does not touch the session there, and continues on your own site, where the session cookie is sent again.
Do I need HTTPS?
For the live store, yes: Facebook accepts only https redirect addresses for live apps.
I also want Google, Apple or Microsoft. Social Login Pro (sold separately) has them. Installing it copies this extension's Facebook keys and connected accounts; this extension then steps back automatically, so there is never a second Facebook button.
What happens without a valid licence?
The storefront shows no button; the admin, the Facebook keys and the connected accounts stay.
Which themes work?
The default themes of OpenCart 4 and 3. Themes that replace the login, register or checkout templates may place the button differently.
Is it tested with a real Facebook account?
It is tested against a local mock of Facebook's login dialog, code exchange and Graph API, and with contract tests of the Facebook sign-in (authorization parameters, code exchange, appsecret_proof, Graph version fallback, missing e-mail). Check your keys with the "Check settings" button after setup.
Details
Compatibility- Version
- 1.0.0
- Compatible with
- OpenCart 4.1.0.4, 3.0.5.1
- Core edits
- None
- Extension ID
- kv_facebook_login
- Developer
- Kavio Labs Software Limited
Support
Policy- Bug reports
- 1 business day
- How-to questions
- 2 business days
- Channel
- Tickets in your account
Buy with confidence
What stands behind your license
-
Tested builds
This product was tested on these builds. Builds we did not test are not listed.
- OpenCart4.1.0.4
- OpenCart3.0.5.1
-
12 months of updates
Updates and support are included in the price. The product keeps working afterwards; renewing is optional.
How licensing works -
30-day refund
If it is not what you expected, tell us within 30 days and we refund the order.
Refund policy -
Secure checkout
Card payments are processed by Stripe. Your card number never reaches our server.
Ask a pre-sales question
Sold by Kavio Labs Software Limited, registered in England and Wales No. 17532441. About us
More for OpenCart
Works well alongside it.
Server-Side Tracking: GA4, Meta Conversions API, TikTok
Extension · v1.0.0Server-side tracking for OpenCart 4.x and 3.0.x: purchases, refunds, add to cart, checkout, product views and leads go from your server to the free official GA4 Measurement Protocol, Meta Conversions API and TikTok Events API, deduplicated with the browser pixels through shared event ids. Consent-aware, SHA-256 hashed customer data, order status mapping, queue with retries, test mode and an event log. No paid relay, events only, no OCMOD.
- 4.1.0.x
- 4.0.2.x
- 3.0.x
from$59Buy
Atlas: Department Store Theme
Theme · v1.0.1The department store theme for OpenCart 4.x and 3.0.x: colour-coded departments, a department list beside the hero slider with two side promos, a big search with a department selector, tabbed product blocks, a 2 + 1 + 2 offer grid, deals of the day with real countdowns, a department showcase, a promotions band and a three-column product page with a sticky buy box. Four styles (Meridian, Harbor, Citrus, Night) and your own colours on top. Events only, no core changes.
- 4.1.0.x
- 4.0.2.x
- 3.0.x
from$129Buy
Bot & Country Blocker
Extension · v1.0.0Stop AI crawlers, scrapers, vulnerability scanners and unwanted countries before OpenCart 4.x or 3.0.x builds a page. Googlebot and Bingbot are verified by DNS and always allowed; 50+ bots get one switch each; country rules use free GeoIP databases and can close only the checkout; IP and network lists, rate limits, honeypots and the cart flood fix; a one-second challenge instead of a captcha; learning mode, dashboard, log, IP tester and Cloudflare export. No core changes, no OCMOD.
- 4.1.0.x
- 4.0.2.x
- 3.0.x
from$49Buy