Use Your Own OAuth Credentials

By default, social logins use Para’s OAuth credentials, so the provider’s consent screen shows Para’s app. You can register your own OAuth app with Google, Apple, X (Twitter), Discord, or Facebook instead. Your app then controls the consent screen, the branding, and the provider-side settings. Your credentials apply to every login with that provider on the API key: the Para Modal, custom UIs, and older SDK versions alike. Nothing changes in your app code.

This page covers the built-in providers. To add a provider Para doesn’t ship, such as your own SSO or another OAuth2 service, use Add custom provider on the same screen. See Custom OAuth and Custom OIDC.

Before you start

An OAuth app (client) registered with the provider, and admin access to edit its allowed redirect URIs.
A Para project and API key. Credentials are set per API key, so configure beta and production keys separately.

Apple and Facebook identify users per app. Apple issues user identifiers per developer team and Facebook per app. With your own credentials, the same Apple or Facebook account gets a different identifier than it had with Para’s credentials, so users who already signed in with Apple or Facebook may come back as new, empty accounts. The Developer Portal and the CLI both ask you to acknowledge this before saving. Google, X, and Discord aren’t affected.

1. Register Para’s redirect URIs with your provider

Add both redirect URIs for your provider to your OAuth app’s allowed redirect URIs. Para is moving sign-ins to the new callback, so logins can arrive on either one. Keep both registered.

Environment	Legacy login flow	Current login flow
Production	`https://api.getpara.com/auth/<provider>/callback`	`https://api.getpara.com/internal/v1/auth/oauth/<provider>/callback`
Beta	`https://api.beta.getpara.com/auth/<provider>/callback`	`https://api.beta.getpara.com/internal/v1/auth/oauth/<provider>/callback`

Replace <provider> with google, apple, twitter, discord, or facebook. For example, Google on production:

https://api.getpara.com/auth/google/callback
https://api.getpara.com/internal/v1/auth/oauth/google/callback

The Developer Portal and the CLI both show the exact URIs for your key when you add the connection.

2. Add your credentials

Developer Portal
Para CLI

Open Authentication

In the Developer Portal, select your project and API key, then open Authentication.

Expand the provider

Under Embedded Wallets, expand the provider’s row (Google, X, Apple, Discord, or Facebook) and click Use your own credentials.

Fill in the connection

Handle: a unique name for this connection, such as my-google. Lowercase letters, digits, - and _. It can’t be changed later, and a provider name like google is reserved.
Display name (internal): optional, shown only in the dashboard.
Client ID: from your OAuth app.
Apple only: your Apple Team ID and the Key ID of your Sign in with Apple private key.

The dialog also lists both redirect URIs to copy. For Apple or Facebook, check the acknowledgement box, then click Register connection.

Save the client secret

The Set Client Secret dialog opens next. Paste your client secret. For Apple, paste the full contents of the .p8 private key file. The secret is stored encrypted and never shown again; saving a new one replaces it.

Once saved, the provider’s row shows Using your own credentials. Make sure the provider is also turned on in the method list so its button appears.

Register the connection, then store its secret. Both commands act on the active API key, or pass a key ID as the last argument.

# Register your own Google credentials (prints the redirect URIs to register)
para keys config oauth add --provider GOOGLE --handle my-google --client-id <client-id>

# Store the client secret (prompted, input hidden)
para keys config oauth set-secret my-google

For Apple, also pass your Team ID and Key ID, acknowledge the identity change, and load the .p8 key from a file:

para keys config oauth add --provider APPLE --handle my-apple --client-id <services-id> \
  --apple-team-id <team-id> --apple-key-id <key-id> --acknowledge-identity-change

para keys config oauth set-secret my-apple --from-file AuthKey_XXXXXXXXXX.p8

Facebook also requires --acknowledge-identity-change. Other useful commands:

Command	What it does
`para keys config oauth list`	List the key’s connections
`para keys config oauth show <handle>`	Show a connection and whether its secret is set
`para keys config oauth update <handle> --client-id <id>`	Change the client ID or other settings
`para keys config oauth update <handle> --no-enabled`	Turn the connection off (`--enabled` turns it back on)
`para keys config oauth remove <handle> --yes`	Remove the connection and its stored secret

para keys config oauth verify runs a discovery check for OpenID Connect providers only; it doesn’t apply to the built-in providers.

Save the client secret right after you register the connection. A connection without a secret can’t complete sign-ins on current SDKs.

Switching back to Para’s credentials

Turn the connection off, or remove it, from the provider’s row in the Developer Portal (or with para keys config oauth update <handle> --no-enabled / remove). Logins with that provider then use Para’s credentials again. For Apple and Facebook, the identifier change applies in this direction too.

Troubleshooting

The provider says the redirect URI doesn't match

Register both redirect URIs from step 1, for the same environment as your API key: production keys use api.getpara.com, beta keys use api.beta.getpara.com. The URI must match exactly, including the provider slug (twitter for X).

Returning Apple or Facebook users get a new, empty account

Expected after switching credentials: those providers issue a different user identifier per app. See the warning under Before you start.

Next steps

Configure Authentication: choose and order login methods
Custom OIDC and Custom OAuth: add a provider Para doesn’t ship

Getting Started

Choose a Path

Project Setup

Go Live

How Para Works

Shared Guides

Migrations

Use Your Own OAuth Credentials

Before you start

1. Register Para’s redirect URIs with your provider

2. Add your credentials

Switching back to Para’s credentials

Troubleshooting

Next steps

​Before you start

​1. Register Para’s redirect URIs with your provider

​2. Add your credentials

​Switching back to Para’s credentials

​Troubleshooting

​Next steps

Before you start

1. Register Para’s redirect URIs with your provider

2. Add your credentials

Switching back to Para’s credentials

Troubleshooting

Next steps