"Sign in with Google" saves new customers from inventing yet another password, and it can lift sign-ups noticeably. It also brings questions: what happens when someone already has an account with that email, can a social sign-in be used to take over an account, and what do the app stores require? This guide covers Google, Apple and Facebook sign-in for BidKing, RaffKing and PrizeX: setting them up, how accounts are matched, the checks a social sign-up goes through, and what to know before you put them in a mobile app.
Who has it
- Google Login, Apple Login and Facebook Login are included in PrizeX, BidKing Plus, BidKing Pro and RaffKing. For BidKing Starter they're add-ons.
- Each is switched on separately, so you can offer just Google, or all three.
- The buttons appear on your sign-in and registration pages.
Setting them up
- Google: a Client ID and Client secret from Google Cloud.
- Apple: a Services ID, Team ID, Key ID and private key (.p8) from Apple Developer.
- Facebook: an App ID and App secret from Meta for Developers. You also set the Graph API version, and change it when Meta's dashboard says the current one is ending.
- Return addresses are built from the Site URL in your settings, and each plugin's panel shows the exact address to paste into the provider's console. Set your Site URL first, with the right www and https.
How accounts are matched
This is where social sign-in can go wrong on other platforms, so it's worth knowing exactly what happens.
- A returning customer is recognised by their provider account and signed straight in.
- A new email creates a new account, as long as the provider has confirmed the email address.
- An email that already has an account is only joined to it when both sides are trustworthy: Google or Apple has confirmed the email, and the existing account has proved it owns that email too, for example through a password reset link or an email code. Otherwise the customer is asked to sign in with their email and password.
That second check matters. Without it, someone could register an account with your customer's email address before the customer ever arrives, and share the account when the real owner later signs in with Google.
Facebook is treated more carefully
- Facebook can create a new account but never joins an existing one.
- If the real owner of that email turns up later and proves it, for example with a password reset, the Facebook sign-in is removed from the account, other devices are signed out, and the customer is told why.
The same checks as any sign-up
- Age: new customers confirm their date of birth before the account is made. On raffle, auction and prize sites the minimum is 18.
- Fraud rules: the same device and VPN checks as a password sign-up, and the same rules for withholding sign-up bonuses from repeat accounts.
- Referrals: a referral link still counts if the new customer signs up with Google, Apple or Facebook.
- Bonuses: any sign-up bonus you offer is given the same way.
- Email codes: if your store asks for an email code at every sign-in, with the Email OTP add-on, Google, Apple and Facebook sign-ins ask for it too.
Apple sign-in
- The customer's name is kept on their new account, even though Apple only shares it the first time.
- Hide My Email: Apple lets customers give you a private relay address. For your emails to reach them, register your sending domain with Apple's private email relay service. Do this before launch.
- Deleted accounts: when a customer deletes their account, the store tells Apple to revoke the sign-in, as Apple requires.
Social sign-in in a mobile app
If you publish your site as an app with the Mobile App add-on:
- Facebook sign-in is hidden in the app.
- Google sign-in uses the phone's own Google sign-in. Test it on a real Android phone and iPhone before you submit, and add your iOS client ID for the iPhone.
- Apple sign-in opens Apple's sign-in page inside the app.
- Apple's rule: Apple asks apps that offer Google sign-in to offer Sign in with Apple too. Switch on Apple Login before you submit an iPhone app with Google sign-in.
Good practice
- Start with Google, which most customers have, and add Apple if you have many iPhone users or an iPhone app.
- Keep your keys safe. Anyone with your app secrets can pretend to be your site to the provider.
- Say in your privacy policy which providers you use and what you receive from them: name, email and, for Google, a profile picture.
- Test every button after changing your domain or Site URL.
Common questions
Which social sign-ins are supported?
Google, Apple and Facebook. Each is its own plugin, included in PrizeX, BidKing Plus, BidKing Pro and RaffKing, and an add-on for BidKing Starter.
What happens if a customer already has an account with the same email?
Google or Apple sign-in joins the existing account only when the provider has confirmed the email and the account has proved it owns that email too. Otherwise the customer signs in with their email and password. Facebook never joins an existing account.
Do social sign-ups skip the age check or fraud rules?
No. New customers confirm their date of birth, and the same device, VPN and bonus rules apply as for a password sign-up.
Do I need Sign in with Apple in my iPhone app?
Apple asks apps that offer Google sign-in to also offer Sign in with Apple, so switch on Apple Login before you submit.