> ## Documentation Index > Fetch the complete documentation index at: https://docs.getpara.com/llms.txt > Use this file to discover all available pages before exploring further. # Use Your Own OAuth Credentials > Replace Para's OAuth app with your own for Google, Apple, X, Discord, or Facebook sign-in, so users see your app on the provider's consent screen. By default, social logins use **Para's OAuth credentials**, so the provider's consent screen shows Para's app. You can register your own OAuth app with **Google, Apple, X (Twitter), Discord, or Facebook** instead. Your app then controls the consent screen, the branding, and the provider-side settings. Your credentials apply to every login with that provider on the API key: the Para Modal, custom UIs, and older SDK versions alike. Nothing changes in your app code. > [!NOTE] > > This page covers the built-in providers. To add a provider Para doesn't ship, such as your own SSO or another OAuth2 service, use **Add custom provider** on the same screen. See [Custom OAuth](/v3/general/developer-portal-custom-oauth.md) and [Custom OIDC](/v3/general/developer-portal-custom-oidc.md). ## Before you start * An OAuth app (client) registered with the provider, and admin access to edit its allowed redirect URIs. * A Para project and API key. Credentials are set per API key, so configure beta and production keys separately. > [!WARNING] > > **Apple and Facebook identify users per app.** Apple issues user identifiers per developer team and Facebook per app. With your own credentials, the same Apple or Facebook account gets a different identifier than it had with Para's credentials, so users who already signed in with Apple or Facebook may come back as new, empty accounts. The Developer Portal and the CLI both ask you to acknowledge this before saving. Google, X, and Discord aren't affected. ## 1. Register Para's redirect URIs with your provider Add **both** redirect URIs for your provider to your OAuth app's allowed redirect URIs. Para is moving sign-ins to the new callback, so logins can arrive on either one. Keep both registered. | Environment | Legacy login flow | Current login flow | | - | - | - | | Production | `https://api.getpara.com/auth//callback` | `https://api.getpara.com/internal/v1/auth/oauth//callback` | | Beta | `https://api.beta.getpara.com/auth//callback` | `https://api.beta.getpara.com/internal/v1/auth/oauth//callback` | Replace `` with `google`, `apple`, `twitter`, `discord`, or `facebook`. For example, Google on production: ```text theme={null} https://api.getpara.com/auth/google/callback https://api.getpara.com/internal/v1/auth/oauth/google/callback ``` The Developer Portal and the CLI both show the exact URIs for your key when you add the connection. ## 2. Add your credentials **Developer Portal** **1. Open Authentication** In the [Developer Portal](https://developer.getpara.com), select your project and API key, then open **Authentication**. **2. Expand the provider** Under **Embedded Wallets**, expand the provider's row (Google, X, Apple, Discord, or Facebook) and click **Use your own credentials**. **3. Fill in the connection** * **Handle**: a unique name for this connection, such as `my-google`. Lowercase letters, digits, `-` and `_`. It can't be changed later, and a provider name like `google` is reserved. * **Display name (internal)**: optional, shown only in the dashboard. * **Client ID**: from your OAuth app. * **Apple only**: your **Apple Team ID** and the **Key ID** of your Sign in with Apple private key. The dialog also lists both redirect URIs to copy. For Apple or Facebook, check the acknowledgement box, then click **Register connection**. **4. Save the client secret** The **Set Client Secret** dialog opens next. Paste your client secret. For Apple, paste the full contents of the `.p8` private key file. The secret is stored encrypted and never shown again; saving a new one replaces it. Once saved, the provider's row shows **Using your own credentials**. Make sure the provider is also turned on in the method list so its button appears. **Para CLI** Register the connection, then store its secret. Both commands act on the active API key, or pass a key ID as the last argument. ```bash theme={null} # Register your own Google credentials (prints the redirect URIs to register) para keys config oauth add --provider GOOGLE --handle my-google --client-id # Store the client secret (prompted, input hidden) para keys config oauth set-secret my-google ``` For Apple, also pass your Team ID and Key ID, acknowledge the identity change, and load the `.p8` key from a file: ```bash theme={null} para keys config oauth add --provider APPLE --handle my-apple --client-id \ --apple-team-id --apple-key-id --acknowledge-identity-change para keys config oauth set-secret my-apple --from-file AuthKey_XXXXXXXXXX.p8 ``` Facebook also requires `--acknowledge-identity-change`. Other useful commands: | Command | What it does | | - | - | | `para keys config oauth list` | List the key's connections | | `para keys config oauth show ` | Show a connection and whether its secret is set | | `para keys config oauth update --client-id ` | Change the client ID or other settings | | `para keys config oauth update --no-enabled` | Turn the connection off (`--enabled` turns it back on) | | `para keys config oauth remove --yes` | Remove the connection and its stored secret | `para keys config oauth verify` runs a discovery check for OpenID Connect providers only; it doesn't apply to the built-in providers. > [!NOTE] > > Save the client secret right after you register the connection. A connection without a secret can't complete sign-ins on current SDKs. ## Switching back to Para's credentials Turn the connection off, or remove it, from the provider's row in the Developer Portal (or with `para keys config oauth update --no-enabled` / `remove`). Logins with that provider then use Para's credentials again. For Apple and Facebook, the identifier change applies in this direction too. ## Troubleshooting > **The provider says the redirect URI doesn't match** > > Register both redirect URIs from step 1, for the same environment as your API key: production keys use `api.getpara.com`, beta keys use `api.beta.getpara.com`. The URI must match exactly, including the provider slug (`twitter` for X). > **Returning Apple or Facebook users get a new, empty account** > > Expected after switching credentials: those providers issue a different user identifier per app. See the warning under [Before you start](#before-you-start). > **Sign-in fails right after adding the connection** > > Check that the connection shows no **Secret needed** badge. If it does, set the secret from the connection's menu or with `para keys config oauth set-secret `. ## Next steps * [Configure Authentication](/v3/react/guides/customization/developer-portal-authentication.md): choose and order login methods * [Custom OIDC](/v3/general/developer-portal-custom-oidc.md) and [Custom OAuth](/v3/general/developer-portal-custom-oauth.md): add a provider Para doesn't ship This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.