Configure social login

MyListing can sign users in with Google or Facebook. It adds the enabled providers to the theme’s WooCommerce My Account form and lets signed-in users connect or disconnect them under Account details.

Requirements and account behavior

• WooCommerce is required. MyListing does not initialize its social-login extension unless the WooCommerce class is available.
• Assign a published My Account page under WooCommerce → Settings → Advanced → Page setup → My account page. MyListing renders the provider buttons in its WooCommerce-based login template.
• Use HTTPS in production and create the provider app for the exact public origin. Treat www, non-www, staging, and local origins as separate unless the provider explicitly supports a broader pattern.
• MyListing needs a Google Client ID and a Facebook App ID. There are no Client Secret or App Secret fields on the theme settings screen.

Social login is both a login and registration route. If no WordPress user has the provider identity or email, MyListing creates a user with a generated password. Turning off WooCommerce → Settings → Accounts & Privacy → Allow customers to create an account on the My account page hides the normal Register tab, but it does not block this social-account creation path. Disable both providers if the site must prevent new accounts.

Configure Google

1. In Google Cloud Console, create or select a project and configure its OAuth branding and consent settings.
2. Create an OAuth client whose application type is Web application.
3. Add each site origin to Authorized JavaScript origins. Use the scheme and fully qualified hostname only, such as https://example.com; do not add a page path.
4. Copy the client ID.
5. In wp-admin, go to Theme Tools → Social Login.
6. Under Google, enter the Client ID, turn on Enable Sign-In with Google, and select Save Changes.

The theme loads Google Identity Services, posts the returned ID token to WordPress, and checks the token with Google’s tokeninfo endpoint. The token audience must match the Client ID saved in MyListing. Your host must therefore allow outbound HTTPS requests to Google as well as browser access to https://accounts.google.com/gsi/ and https://www.googleapis.com/.

Google’s current setup guidance also notes that restrictive Content Security Policy or Cross-Origin-Opener-Policy headers can break the button or popup. Follow the Google Identity Services web setup when those headers are in use.

Configure Facebook

1. In Meta for Developers, create an app with a Facebook Login use case that supports websites.
2. Add the website platform and configure the app domain and JavaScript SDK domain for the site’s exact hostname. Meta changes its dashboard labels periodically, so use the settings presented for the app’s selected use case.
3. Supply the privacy-policy URL, user-data deletion instructions, contact details, and any verification Meta requires before public use.
4. Copy the App ID.
5. In wp-admin, go to Theme Tools → Social Login.
6. Under Facebook, enter the App ID, turn on Enable Sign-In with Facebook, and select Save Changes.
7. Test with an app-role account first. Complete any required access review and switch the app to Live mode before testing an ordinary Facebook account.

The current theme loads Facebook’s JavaScript SDK with Graph API version v21.0, requests public_profile and email, and then requests id, name, picture, and email from /me. MyListing requires an email before it can sign in or create the WordPress user. A Facebook account that does not return an email cannot complete this flow.

Test identity matching before launch

MyListing first looks for a user already connected to the provider. If none exists, it automatically connects and signs in an existing WordPress user with the same email address; otherwise it creates a new user. Test this behavior with controlled addresses and make sure the site’s privacy, deletion, and role policies match that automatic linking behavior.

Roles, connected accounts, and profile pictures

When MyListing creates a social user, it accepts the selected registration account type only when the alternate account type feature is enabled and the submitted value is valid. Otherwise it uses Theme Tools → User Roles → Default account type; if alternate account types are disabled, the role is Customer.

An existing user can open My Account → Account details to connect or disconnect either enabled provider. A provider identity already connected to another site user cannot be connected again. New social users default to the provider picture; Account details lets them switch between an available provider picture and a custom picture.

Provider settings saved by older MyListing releases remain a compatibility fallback until the current Social Login options are saved. The current screen stores each provider’s enabled state and identifier as normal WordPress options.

Test and troubleshoot

Use a private browser window and test all of these cases: a new email, an email that already belongs to a WordPress user, each enabled account type, a returning provider user, and connect/disconnect under Account details.

If a button or popup fails:

• confirm WooCommerce is active, the My Account page is assigned, the provider is enabled, and its identifier is not empty;
• compare the browser’s exact origin with the provider’s authorized origin or domain, including scheme, subdomain, and port;
• check whether the provider app is still limited to administrators, developers, or test users;
• inspect the browser console for blocked Google or Facebook scripts, frames, popups, cookies, or Content Security Policy rules;
• inspect WordPress/PHP logs and confirm the server can reach Google’s token endpoint or Meta’s Graph API;
• temporarily exclude the provider scripts and the MyListing authentication script from delay, defer, combine, or consent rules while diagnosing load-order problems;
• clear page and CDN caches after changing the provider configuration.

Google and Meta accounts are external services and their production-app requirements can change. Neither provider requires an extra MyListing add-on, but WooCommerce is required and the provider may require organization verification or policy review.

Next: Configure account types and permissions →