Skip to content
A
For administrators
Running the administration — content, users, e-shop, invoicing and settings
Users and permissions / External sign-in

External sign-in#

Signing in with an account from another service — Google, Facebook and others. The visitor does not have to create a password.

Sign-in providers

Find them under Základy → Uživatelé → Externí přihlášení.

The list#

Column What it shows
Název what the button is called
Klíč the technical identifier (google, facebook, …)
Aktivní whether the button is offered on the site

A disabled provider keeps its configuration, it just is not displayed. Switching it on and off is therefore a safe operation — nothing is erased.

Setting one up#

Configuration has two parts, and the first happens outside this administration:

  1. At the provider (Google Cloud Console, Meta for Developers…) create an application and obtain a client ID and a client secret.
  2. Register your site's redirect URI there — without it sign-in ends in an error.
  3. In the administration open the provider and fill in the client ID and secret.
  4. Turn Aktivní on and try signing in.

The client secret is the password to your application

Anyone who obtains it can impersonate your site. Do not send it by email or chat, do not put it in documentation, and do not take screenshots of the form where it is visible. If it leaks, revoke it at the provider and generate a new one.

The redirect URI#

The most common reason sign-in does not work. The provider only returns users to an address it has on file — and it must match exactly, including https:// and any trailing slash.

The test address and the live address are two different addresses

When the site runs on both cms.dev.example.cz and example.cz, both must be registered at the provider. Otherwise sign-in works on one and fails on the other with an invalid-redirect error.

Linking to an existing account#

If someone signs in via Google with an email already in the system, it links the accounts rather than create a second one — this is not an optional setting, it always works this way. Verify it on a test account before enabling a provider for real.

The username is usually machine-generated

Accounts created through an external service have usernames like google-1025779…. That is not a fault — it is the identifier from the provider. They sign in with the button, not with that name.

A blocked account does not get through here either

External sign-in rejects a disabled (Aktivní) or banned account just like password sign-in does — see Users. The provider button is not a back door.

When sign-in does not work#

In order:

  1. Is the provider Aktivní?
  2. Does the redirect URI at the provider match the site address, protocol included?
  3. Are the client ID or secret pasted with a stray space?
  4. Is the application at the provider still in test mode? Google and Meta let new applications in only for listed accounts at first.
  5. Has the client secret expired? Some have a limited lifetime.