Authentication methods
Configure the identity providers that RevenueCat trusts for your Customers
This page lists the fields each authentication provider needs, and what RevenueCat does with them. To learn how authentication works before you configure it, see Authentication.
Tell us about your use case to get early access and help us shape the feature.
Prerequisites
- Be the project owner or an Administrator. No other role can view or manage authentication methods — see Collaboration for what each role can do.
- Create an application with your identity provider, unless you're using Email OTP or Magic Link.
- Read Authentication for how the identity provider, the method, and the access token fit together.
Choose a provider
RevenueCat supports seven providers. Pick the one that matches the identity provider your app already uses.
| Provider | Use it for | What you supply |
|---|---|---|
| OpenID Connect | Auth0, Okta, or any provider that publishes an OpenID Connect discovery document | An issuer URL |
| Google ID | Google sign-in | A Google OAuth client ID |
| Apple ID | Sign in with Apple | A Service ID for web, or a bundle ID for an app |
| Facebook Login | Facebook sign-in | A Facebook App ID |
| Firebase | Firebase Authentication | A Firebase project ID, web API key, and auth domain |
| Email OTP | A one-time code that RevenueCat emails to the Customer | Nothing — RevenueCat sends the email |
| Magic Link | A passwordless sign-in link that RevenueCat emails to the Customer | Nothing — RevenueCat sends the email |
Every provider but Email OTP and Magic Link works the same way: your app gets an ID token from the provider, and RevenueCat verifies it.
Add a method
-
Open your project and select Auth.
-
Select + Add method.
-
Select your provider on the Select a provider to get started screen.
-
Complete the fields for your provider. Each provider has its own section below.
-
Select Add method.
OpenID Connect
RevenueCat reads your provider's configuration from the Issuer URL and uses it to verify every ID token. You give RevenueCat one URL; it discovers the rest.
RevenueCat requests <Issuer URL>/.well-known/openid-configuration. That document must supply an issuer value and a jwks_uri value, both over HTTPS, and RevenueCat saves both with the method. At each login, RevenueCat loads the signing key named by the token's kid header, verifies the RS256 signature, then checks the iss claim against the saved issuer, the exp claim, and the age of the iat claim.
RevenueCat identifies the method by the token's iss claim, so two methods in one project can't share an issuer.
The Client Secret, Requested scopes, and Authorization parameters fields apply only to the interactive login that funnels use.
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. The name appears in the method list and in funnel steps. |
| Issuer URL | Yes | The HTTPS URL of your provider. Do not include the discovery path. |
| Client ID | No | The value that your provider puts in the aud claim. When you set it, RevenueCat requires a match. |
| Client Secret | No | Needed only for the interactive login. |
| Requested scopes | No | Extra OAuth scopes for the interactive login. RevenueCat always includes openid. |
| App user ID claim | No | The claim that RevenueCat maps to the App User ID. Leave it empty to use sub. |
| Authorization parameters | No | Static query parameters for the authorization URL. Leave it empty unless your provider requires one. |
| ID token iat freshness (seconds) | No | Under Advanced settings. How old an ID token can be when your app sends it. |
RevenueCat maps this claim when it creates the Customer. Existing Customers keep the App User ID that they already have.
Example issuer URLs
- Auth0: use your tenant domain, for example
https://example.us.auth0.com. See Auth0 OpenID Connect Discovery. - Okta: use your authorization server URL. See Okta OpenID Connect & OAuth 2.0.
Any other provider works the same way, as long as it publishes an OpenID Connect discovery document.
Google ID
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Client ID | Yes | The Google OAuth client ID for your application. |
| ID token iat freshness (seconds) | No | Under Advanced settings. How old an ID token can be when your app sends it. |
RevenueCat checks the aud claim of the Google ID token against this client ID. To find the value, see Get your Google API client ID.
Apple ID
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Bundle ID | Yes | Your Apple Service ID or bundle ID. |
| ID token iat freshness (seconds) | No | Under Advanced settings. How old an ID token can be when your app sends it. |
RevenueCat checks the aud claim of the Apple ID token against this value. Use the Service ID for web and the bundle ID for an app. To create a Service ID, see Sign in with Apple.
Facebook Login
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Facebook App ID | Yes | The app ID of your Facebook application. |
| App Secret | No | Needed only for classic Facebook Login. |
| ID token iat freshness (seconds) | No | Under Advanced settings. How old an ID token can be when your app sends it. |
RevenueCat checks the aud claim of the Facebook ID token against the app ID. To find both values, see Facebook Login.
Firebase
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Project ID | Yes | The Firebase project ID, from Project settings → General in the Firebase console. |
| Web API key | Yes | The web API key that the Firebase JS SDK uses. |
| Auth domain | Yes | The Firebase auth domain, such as my-project.firebaseapp.com. |
RevenueCat checks the aud claim of the Firebase ID token against the project ID. To find these values, see Firebase project configuration.
Add the domain of your funnel to the authorized domains of your Firebase project. Firebase blocks sign-in from a domain that it does not list.
Email OTP
RevenueCat sends the email, so there's no external application to configure. The Customer receives a one-time code by email.
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Sender name | No | The display name of the sender. It defaults to the name of your app, not the project. |
| Reply-to email | No | The address that receives replies. |
| Code Expiration (minutes) | No | How long the code stays valid. It defaults to 360 minutes, or 6 hours. |
RevenueCat always sends this email from a verified RevenueCat address.
Magic Link
RevenueCat sends the email, so there's no external application to configure. The Customer receives a passwordless sign-in link by email.
| Field | Required | What to enter |
|---|---|---|
| Name | Yes | A label for the method. |
| Sender name | No | The display name of the sender. It defaults to the name of your app, not the project. |
| Reply-to email | No | The address that receives replies. |
| Link Expiration (minutes) | No | How long the link stays valid. It defaults to 1440 minutes, or 1 day. |
RevenueCat always sends this email from a verified RevenueCat address.
Next steps
- Authentication — how the identity provider, the method, and the access token fit together.
- Authentication steps in funnels — require a sign-in before checkout in a funnel.