# Logins with Google and Facebook

**URL:** https://meta.discourse.org/t/logins-with-google-and-facebook/53763
**Category:** Development
**Created:** [12월 4, 2016, 6:52오전 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763 "2016-12-04T06:52:41Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![adam\_beers](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [12월 4, 2016, 6:52오전 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/1 "2016-12-04T06:52:41Z")

</div>

If I allow Google and Facebook logins, how are those users created in the Discourse server using API calls?

---

<div class="post-metadata">

### Author: ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)
#### Post date: [12월 4, 2016, 12:49오후 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/2 "2016-12-04T12:49:21Z")

</div>

> <https://github.com/discourse/discourse/blob/main/app/controllers/users_controller.rb#L349>

---

<div class="post-metadata">

### Author: ![adam\_beers](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [12월 9, 2016, 6:29오후 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/3 "2016-12-09T18:29:35Z")

</div>

What happens if the user forgets their password? How does it work in this case you mentioned with Twitter?

---

<div class="post-metadata">

### Author: ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)
#### Post date: [12월 9, 2016, 6:34오후 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/4 "2016-12-09T18:34:02Z")

</div>

Can’t they just go to twitter and reset their password?

---

<div class="post-metadata">

### Author: ![adam\_beers](https://avatars.discourse-cdn.com/v4/letter/a/97f17d/32.png) [@adam\_beers](https://meta.discourse.org/u/adam_beers)
#### Post date: [12월 9, 2016, 6:37오후 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/5 "2016-12-09T18:37:49Z")

</div>

But then how is that linked with discourse? I’m not sure how the interaction between Twitter and Discourse works on that level, that’s why I’m asking. I assume it would be similar for a Google or Facebook login, but not sure how those work either.

If someone creates an account using their Google account. What password gets set in the Discourse database? If it doesn’t get set, then what gets set? How does Discourse know it’s a valid user?

---

<div class="post-metadata">

### Author: ![blake](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/blake/32/157322_2.png) [@blake](https://meta.discourse.org/u/blake)
#### Post date: [12월 9, 2016, 6:46오후 UTC](https://meta.discourse.org/t/logins-with-google-and-facebook/53763/6 "2016-12-09T18:46:37Z")

</div>

I suggest you do some reading up on how oauth works. This might help:

[https://hueniverse.com/oauth/guide/intro/](https://hueniverse.com/oauth/guide/intro/)

but there is probably something better out there.

Basically discourse doesn’t know or get access to your your twitter/google/facebook password. When you log in with twitter, twitter sends an auth token to discourse that says you authenticated and thats what it uses for authentication until you sign out.
