Overview
Social Login Pro lets shoppers sign in and register with an account they already have: Google (with Google One Tap), Apple, Microsoft, Facebook, Amazon, LinkedIn, Discord, Yandex ID or your own OpenID Connect provider (Okta, Auth0, Keycloak and others).
- Buttons where people sign in. On the login page, the register page and the checkout for signed-out shoppers, in brand colours, outline or icons only, three shapes, one per row or two columns, above or below the login form. Long labels shorten to the provider name in narrow columns.
- Google One Tap. The Google account prompt on storefront pages for signed-out shoppers, with optional automatic sign-in for returning customers.
- Safe account matching. A confirmed e-mail of an existing customer connects to that account; otherwise the account password is asked once. New customers get an account with their name and e-mail; a provider without an e-mail (or without a confirmed one) leads to a short "Almost done" form.
- Connected accounts. Customers connect and disconnect providers from their account. The only sign-in method of an account without a known password cannot be removed.
- Security. Authorization code flow with state, nonce and PKCE, signed ID tokens verified against the provider keys (issuer, audience, expiry, nonce), browser binding, single-use states, secrets stored encrypted, Apple client secret signed for every sign-in so it never expires. Works with OpenCart 4's SameSite=Strict session cookie: the return from the provider continues on your own site, so the cart and session are kept.
- Statistics. Sign-ins, new accounts, completion rate, One Tap share and the reasons why sign-ins failed, per provider and per day.
No OCMOD, no core file edits. One licence covers OpenCart 4 and 3. Tested on OpenCart 4.1.0.4 and 3.0.5.1 with the default themes against a local mock identity provider; other 4.0.2.x to 4.1.x and 3.0.3.8 to 3.0.5.x versions are expected to work but are not tested. Themes that replace the login, register or checkout templates may need a different place for the buttons.
Installation
Requirements
- OpenCart 4.0.2.0 - 4.1.x or 3.0.3.8 - 3.0.5.x, PHP 7.4 or newer with the cURL and OpenSSL extensions.
- HTTPS on the storefront: Apple and most providers accept only https redirect addresses.
OpenCart 4
- Extensions > Installer: upload
kv_social_login_pro.ocmod.zip and press the install button. - Extensions > Extensions > Modules: install Social Login Pro, then open it.
OpenCart 3
- Extensions > Installer: upload
kv_social_login_pro-oc3.ocmod.zip. - Extensions > Modifications: press Refresh (the extension has no OCMOD changes; this only clears the cache).
- Extensions > Extensions > Modules: install Social Login Pro, then open it.
The page is also under Customers > Social sign-in.
First steps
- Providers: copy the redirect URI, open the provider console from the "Open the console" button and follow the numbered steps. Paste the keys, tick "Show the button" and save.
- Check settings asks the provider for its keys and tells you what is missing.
- Settings: choose the pages, the button style and whether Google One Tap is on.
- Enter your licence key in Settings (14-day trial without a key). Without a valid licence the storefront shows no buttons; the admin and the connected accounts stay.
Update
- OpenCart 4: Extensions > Installer, uninstall and delete the old upload, upload the new zip and install it. Do not uninstall the module under Extensions > Modules: that removes the providers and connected accounts.
- OpenCart 3: upload the new zip over the old one, then Modifications > Refresh.
Uninstall
Extensions > Extensions > Modules > Uninstall removes the events, the settings and all data of the extension (provider keys, connected accounts, statistics). Customer accounts stay; customers who only used a provider can set a password with "Forgotten password".
Configuration
Providers
Every provider uses the same redirect URI, shown on the Providers page with a Copy button. Secrets and the Apple private key are stored encrypted and never shown again; leave the field empty to keep the stored value.
| Provider | What you enter | Notes |
|---|
| Google | Client ID, client secret | Also add your store address as an authorized JavaScript origin for One Tap. |
| Apple | Services ID, Team ID, Key ID, the .p8 private key | The client secret is signed for every sign-in. Apple sends the name only at the first sign-in; it is used for the new account. Hidden "relay" e-mails work like any other e-mail. |
| Microsoft | Application (client) ID, client secret, tenant | Tenant common for personal and work accounts, consumers, organizations or one tenant ID. |
| Facebook | App ID, app secret, Graph API version | Calls carry appsecret_proof. |
| Amazon, LinkedIn, Discord, Yandex ID | Client ID, client secret | |
| OpenID Connect | Button label, issuer URL (https), client ID, secret, scopes | Endpoints and keys come from the issuer's discovery document. |
A button is shown only when its provider is switched on and all required fields are filled in. The arrow moves a provider up; the order is the order of the buttons.
Settings
- Status: on or off for the storefront.
- Show buttons on: login page, register page, checkout (signed-out shoppers).
- Button style: brand colours, outline or icons only. Shape: rounded, pill or square. Layout: one per row or two columns. Position: above or below the login form.
- Existing e-mail: connect automatically when the provider confirmed the e-mail (default), or always ask for the account password once.
- New customers: create an account at the first sign-in, or only let existing customers sign in. New accounts get the default customer group; if that group needs approval, the shopper is told so and signs in after approval.
- Google One Tap and automatic sign-in for returning customers (not shown in the checkout).
- Keep statistics: days of the sign-in log (7 - 3650).
- License key (own-store edition).
FAQ
Does it change core files or use OCMOD?
No. It works with OpenCart events only.
Can someone take over an account by signing in with a provider that uses the same e-mail?
Only when the provider confirmed that the shopper owns the e-mail. Without that confirmation the account password is asked once. You can also make the password step mandatory for every existing e-mail.
My store uses the SameSite=Strict session cookie (OpenCart 4 default). Does that matter?
No. The return from the provider is a cross-site request, so the extension stores the answer, does not touch the session there, and continues on your own site, where the session cookie is sent again.
Do I need HTTPS?
For the live store, yes: Apple and most providers accept only https redirect addresses.
What happens without a valid licence?
The storefront shows no buttons; the admin, the provider keys and the connected accounts stay.
Which themes work?
The default themes of OpenCart 4 and 3. Themes that replace the login, register or checkout templates may place the buttons differently.
Is it tested with real Google or Apple accounts?
It is tested against a local mock of the providers (authorization, token and key endpoints, form_post for Apple) and with provider contract tests for all nine providers. Check your keys with the "Check settings" button after setup.
I already use Google Login & One Tap or Facebook Login from Kavio Labs. Install Social Login Pro as usual: it copies their keys (for providers Social Login Pro has no keys for yet), the One Tap setting and every connected account. The single-provider extension steps back while Social Login Pro is switched on, so shoppers never see two buttons; uninstall it when you are ready.
