Social Login Plugins
AVideo includes separate login plugins for Apple, Facebook, Google, LinkedIn, Twitter/X, Yahoo, WordPress and LDAP. These let a visitor use an account from another service; they do not automatically grant upload or administrator permission.
- Make a backup and keep the normal AVideo administrator login working.
- Use a public HTTPS domain with a valid certificate. Most providers reject
localhostand changing callback URLs. - Create an application in the provider's official developer dashboard.
- Copy the callback/redirect URL shown by the AVideo plugin exactly into that application.
- Enter the client/application ID and secret in Plugins → provider plugin → Edit parameters.
- Test with a normal account in a private browser window before showing the button to everyone.
Provider dashboards, review requirements, scopes and policies change frequently. Follow the current provider instructions displayed by the plugin/dashboard rather than an old screenshot.
| Plugin | Use it when |
|---|---|
| LoginApple | Visitors should sign in with Apple. |
| LoginFacebook | Visitors should sign in with Facebook. |
| LoginGoogle | Visitors should sign in with Google. |
| LoginLinkedin | Visitors should sign in with LinkedIn. |
| LoginTwitter | Visitors should sign in with Twitter/X, subject to its current API plan. |
| LoginYahoo | Visitors should sign in with Yahoo. |
| LoginWordPress | A WordPress installation is the identity provider. |
| LoginLDAP | An organization authenticates against LDAP/Active Directory. See LDAP configuration. |
| LoginLDAP_DYNA | A specialized installation synchronizes users/groups from a configured file; use only when your deployment requires it. |
Redirect URI mismatch: copy the exact HTTPS callback, including domain, path, slash and port. Update both sides after a domain change.
The provider returns to AVideo but login fails: inspect the provider error and AVideo log; check client secret, allowed domain, scopes and server clock.
A second AVideo account is created: providers may return a different e-mail or no verified e-mail. Decide how accounts should be matched before enabling the provider for existing users.
The button is missing: confirm the plugin is enabled and has its required ID/secret, then clear relevant cache. Some layouts choose which login buttons to show.
Is the client secret safe in browser code? No. Store it only in the server-side plugin configuration and never place it in JavaScript, screenshots or tickets.
Always keep at least one tested local administrator recovery path. A provider outage or expired credential must not lock every administrator out.
