Sign in and sign up with Google, GitHub or X (Twitter) on a FlatBB site.

What it does

  • Provider buttons on the sign-in page (and on the registration page when sign-up is open).
  • Verified-email matching: an account already linked to the provider's subject signs in. Otherwise the provider's
    verified email is matched against existing accounts and linked automatically — a provider that does not confirm
    the email can never take over an existing account.
  • New accounts are created for verified emails when sign-up is allowed (respects allow_register, invite codes
    and the registration IP limit).
  • Connected accounts (Settings → Connected accounts): connect or disconnect providers any time. The last sign-in
    method cannot be removed while the account has no password.
  • One-time use of the provider access token; tokens are never stored. state + PKCE (S256) in a signed ten-minute
    cookie protect the callback.

Setup

  1. In Admin → Plugins → TabRe Social settings, enter the client id and secret for each provider you want.
    Both fields must be filled for a provider to appear.
  2. Configure the provider console:
    • Google — an OAuth 2.0 Web client at https://console.cloud.google.com. Authorized redirect URI:
      https://<your-domain>/social/google/callback.
    • GitHub — an OAuth App at https://github.com/settings/developers. Callback URL:
      https://<your-domain>/social/github/callback.
    • X — an OAuth 2.0 app in the X developer portal with the Request email from users permission.
      Callback: https://<your-domain>/social/x/callback. X sign-in needs the app's confirmed email;
      users without one can still connect the provider to an existing account.
  3. Toggle Create new accounts through social sign-in to choose whether visitors may register this way.

Requirements

  • FlatBB 0.2.4+ with the curl PHP extension.
  • The plugin stores only provider credentials (owner-provided), the provider subject, email and display name.
    No access or refresh tokens are kept.