OAuth Settings
Configure the platform-wide Google and Facebook login providers in ISPbills.
Configure the platform-wide Google and Facebook login providers in ISPbills.
On this page
ISPbills supports Google and Facebook social login. These are platform-wide settings: only a Developer or Super Admin can change the provider credentials. A Group Admin cannot configure a separate provider for one ISP.
Supported providers and callbacks
| Provider | Callback URL |
|---|---|
https://YOUR-DOMAIN/auth/social/google/callback |
|
https://YOUR-DOMAIN/auth/social/facebook/callback |
Replace YOUR-DOMAIN with the exact public ISPbills hostname. Custom OAuth/OpenID Connect providers, GitHub, custom scopes, field mapping, and allowed-domain rules are not available on this settings screen.
Configure a provider
- Sign in as a Developer or Super Admin and open OAuth Settings.
- Create the application in the Google or Facebook developer console and register the exact callback URL above.
- Copy its client/app ID and client/app secret into the matching ISPbills fields.
- Enable that provider and save.
- Test in a separate browser session before announcing the login option.
Keep client secrets private and use HTTPS. If a provider is disabled or its credentials are invalid, its login flow will not work.
Account matching and creation
On a normal web login, ISPbills first looks for an account already linked to the returned provider ID. It then tries an existing account with the same email and links that account when its provider ID is empty. If no email match exists, the normal web flow creates an incomplete Group Admin account, treats the provider email as verified, and sends the user to profile completion.
There is no setting to switch the normal web flow between “link only” and “create account.” The iAdmin app flow accepts existing accounts only; Partner onboarding has its own completion flow.
Because an unknown email can start Group Admin registration, confirm the provider’s application settings and operational onboarding policy before enabling social login.
WebAuthn is separate
The global WebAuthn toggle is not an OAuth provider. After it is enabled platform-wide, each operator registers their own security key or passkey from Account Security / Secure Login. WebAuthn depends on HTTPS and the current relying-party domain, so test recovery access before relying on it as a sign-in method.