--- id: "customers/authentication-methods" title: "Authentication methods" description: "This page lists the fields each authentication provider needs, and what RevenueCat does with them. To learn how authentication works before you configure it, see Authentication." permalink: "/docs/customers/authentication-methods" slug: "authentication-methods" version: "current" original_source: "docs/customers/authentication-methods.mdx" --- > **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt). This page lists the fields each authentication provider needs, and what RevenueCat does with them. To learn how authentication works before you configure it, see [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication). :::info[Private beta] [Tell us about your use case](https://revenuecateventfeedback.typeform.com/to/bzxYhAjZ) to get early access and help us shape the feature. ::: ## Prerequisites - Be the project owner or an **Administrator**. No other role can view or manage authentication methods — see [Collaboration](https://www.revenuecat.com/docs/projects/collaborators) for what each role can do. - Create an application with your identity provider, unless you're using Email OTP or Magic Link. - Read [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication) for how the identity provider, the method, and the access token fit together. ## Choose a provider RevenueCat supports seven providers. Pick the one that matches the identity provider your app already uses. | Provider | Use it for | What you supply | | ------------------ | -------------------------------------------------------------------------------- | --------------------------------------------------- | | **OpenID Connect** | Auth0, Okta, or any provider that publishes an OpenID Connect discovery document | An issuer URL | | **Google ID** | Google sign-in | A Google OAuth client ID | | **Apple ID** | Sign in with Apple | A Service ID for web, or a bundle ID for an app | | **Facebook Login** | Facebook sign-in | A Facebook App ID | | **Firebase** | Firebase Authentication | A Firebase project ID, web API key, and auth domain | | **Email OTP** | A one-time code that RevenueCat emails to the Customer | Nothing — RevenueCat sends the email | | **Magic Link** | A passwordless sign-in link that RevenueCat emails to the Customer | Nothing — RevenueCat sends the email | Every provider but Email OTP and Magic Link works the same way: your app gets an ID token from the provider, and RevenueCat verifies it. ## Add a method 1. Open your project and select **Auth**. 2. Select **+ Add method**. 3. Select your provider on the **Select a provider to get started** screen. ![The Select a provider screen in the Auth section, showing all seven authentication providers](https://www.revenuecat.com/docs_images/customers/auth_select_provider.png) 4. Complete the fields for your provider. Each provider has its own section below. 5. Select **Add method**. ## OpenID Connect RevenueCat reads your provider's configuration from the **Issuer URL** and uses it to verify every ID token. You give RevenueCat one URL; it discovers the rest. RevenueCat requests `/.well-known/openid-configuration`. That document must supply an `issuer` value and a `jwks_uri` value, both over HTTPS, and RevenueCat saves both with the method. At each login, RevenueCat loads the signing key named by the token's `kid` header, verifies the RS256 signature, then checks the `iss` claim against the saved issuer, the `exp` claim, and the age of the `iat` claim. RevenueCat identifies the method by the token's `iss` claim, so two methods in one project can't share an issuer. The **Client Secret**, **Requested scopes**, and **Authorization parameters** fields apply only to the interactive login that [funnels](https://www.revenuecat.com/docs/tools/funnels/creating-funnels#authentication-steps) use. | Field | Required | What to enter | | -------------------------------- | -------- | ---------------------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. The name appears in the method list and in funnel steps. | | Issuer URL | Yes | The HTTPS URL of your provider. Do not include the discovery path. | | Client ID | No | The value that your provider puts in the `aud` claim. When you set it, RevenueCat requires a match. | | Client Secret | No | Needed only for the interactive login. | | Requested scopes | No | Extra OAuth scopes for the interactive login. RevenueCat always includes `openid`. | | App user ID claim | No | The claim that RevenueCat maps to the App User ID. Leave it empty to use `sub`. | | Authorization parameters | No | Static query parameters for the authorization URL. Leave it empty unless your provider requires one. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | :::warning[The App user ID claim applies only at first login] RevenueCat maps this claim when it creates the Customer. Existing Customers keep the App User ID that they already have. ::: ### Example issuer URLs - **Auth0**: use your tenant domain, for example `https://example.us.auth0.com`. See [Auth0 OpenID Connect Discovery](https://auth0.com/docs/get-started/applications/configure-applications-with-oidc-discovery). - **Okta**: use your authorization server URL. See [Okta OpenID Connect & OAuth 2.0](https://developer.okta.com/docs/reference/api/oidc/). Any other provider works the same way, as long as it publishes an OpenID Connect discovery document. ## Google ID | Field | Required | What to enter | | -------------------------------- | -------- | ------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Client ID | Yes | The Google OAuth client ID for your application. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | RevenueCat checks the `aud` claim of the Google ID token against this client ID. To find the value, see [Get your Google API client ID](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid). ## Apple ID | Field | Required | What to enter | | -------------------------------- | -------- | ------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Bundle ID | Yes | Your Apple Service ID or bundle ID. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | RevenueCat checks the `aud` claim of the Apple ID token against this value. Use the Service ID for web and the bundle ID for an app. To create a Service ID, see [Sign in with Apple](https://developer.apple.com/documentation/signinwithapple). ## Facebook Login | Field | Required | What to enter | | -------------------------------- | -------- | ------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Facebook App ID | Yes | The app ID of your Facebook application. | | App Secret | No | Needed only for classic Facebook Login. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | RevenueCat checks the `aud` claim of the Facebook ID token against the app ID. To find both values, see [Facebook Login](https://developers.facebook.com/docs/facebook-login/). ## Firebase | Field | Required | What to enter | | ----------- | -------- | ------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Project ID | Yes | The Firebase project ID, from **Project settings → General** in the Firebase console. | | Web API key | Yes | The web API key that the Firebase JS SDK uses. | | Auth domain | Yes | The Firebase auth domain, such as `my-project.firebaseapp.com`. | RevenueCat checks the `aud` claim of the Firebase ID token against the project ID. To find these values, see [Firebase project configuration](https://firebase.google.com/docs/projects/learn-more#config-files-objects). :::warning[Funnels need an authorized domain] Add the domain of your funnel to the authorized domains of your Firebase project. Firebase blocks sign-in from a domain that it does not list. ::: ## Email OTP RevenueCat sends the email, so there's no external application to configure. The Customer receives a one-time code by email. | Field | Required | What to enter | | ------------------------- | -------- | ------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Sender name | No | The display name of the sender. It defaults to the name of your app, not the project. | | Reply-to email | No | The address that receives replies. | | Code Expiration (minutes) | No | How long the code stays valid. It defaults to 360 minutes, or 6 hours. | RevenueCat always sends this email from a verified RevenueCat address. ## Magic Link RevenueCat sends the email, so there's no external application to configure. The Customer receives a passwordless sign-in link by email. | Field | Required | What to enter | | ------------------------- | -------- | ------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Sender name | No | The display name of the sender. It defaults to the name of your app, not the project. | | Reply-to email | No | The address that receives replies. | | Link Expiration (minutes) | No | How long the link stays valid. It defaults to 1440 minutes, or 1 day. | RevenueCat always sends this email from a verified RevenueCat address. ## Next steps - [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication) — how the identity provider, the method, and the access token fit together. - [Authentication steps in funnels](https://www.revenuecat.com/docs/tools/funnels/creating-funnels#authentication-steps) — require a sign-in before checkout in a funnel.