Sign in with Google and Sign in with Microsoft add two buttons to your Log in and Register pages. A visitor who uses one does not have to choose a password, so joining your site takes one click. The keys belong to your own Google or Microsoft app, so every site sets up its own, and the buttons only appear once you switch them on.
- Each provider takes about 10 minutes to set up and costs nothing.
- You create a free app in Google or Microsoft, then paste its Client ID and secret into Site Settings, Social Login.
- Google sign-ups skip the confirmation email. Microsoft sign-ups still confirm their email.
- A button appears only when its box is ticked and both keys are saved.
Start with Google. It has fewer settings than Microsoft, and you can add Microsoft later.
Social Login is being added to sites one at a time. If you cannot find Social Login under Site Settings in your admin, your site does not have it yet.
A client secret works like a password. Paste it only into your Social Login page and never share it.
What your visitors will see
Both buttons are one click, but they do not behave the same way, because Google checks a visitor's email address and Microsoft does not.
| Question | Microsoft | |
|---|---|---|
| Confirmation email? | No. Google has already checked the address. | Yes. The visitor confirms the address first. |
| Same email as an existing account? | Signs in to that account if it has confirmed the email. | Never signs in to it. The visitor signs in with their password first. |
| Password needed? | No. They can add one later with Forgot password. | No. They can add one later with Forgot password. |
Before you start
- Your site admin loginYou will switch the buttons on there.
- Your live site addressBoth providers need the address your visitors use, starting with https.
- A privacy policy pageGoogle can ask for a link to it.
- A Google accountOnly needed for the Google button.
- A Microsoft account that can use Microsoft EntraOnly needed for the Microsoft button. A free Azure account gives you one.
Step 1: Find your redirect URLs
Google and Microsoft each need to know the exact web address your site sends visitors back to after they sign in. Your site works this out for you and shows it on the Social Login page.
- Open Social LoginIn your admin, under SITE SETTINGS in the sidebar, click Social Login.
- Find the redirect URLEach provider has its own heading, with a redirect URL shown under it.
- Keep the tab openYou will copy the URL into Google or Microsoft, then come back to paste the keys.
Open your admin on the same address your visitors use, for example the www version. The redirect URL is built from the address in your browser bar. If your site opens on more than one address, add each address's redirect URL to Google or Microsoft.
https://www.yoursite.com/accounts/google/login/callback/ https://www.yoursite.com/accounts/microsoft/login/callback/
Step 2: Set up Google
Google steps
- Choose or create a projectName it after your site.
- Set up the app screenGoogle walks you through four short screens: App Information, Audience, Contact Information and Finish.
Show the details
App Information: enter your site name as the app name and choose a support email. Audience: choose External, because Internal only works for people inside your own Google Workspace account and would block your visitors. Contact Information: enter an email address Google can reach you on. Finish: tick the box to agree to Google's user data policy, then click Create. Later, add your site's domain and a link to your privacy policy if the Branding page has fields for them.
- Publish the appOn the Audience page, click Publish app so the status says In production.
Why this matters
An External app starts in Testing, and while the status says Testing, Google limits sign-in to a short list of test users. Basic email and profile access needs no Google review.
- Create the clientOpen Clients, click CREATE CLIENT and leave Application type as Web application.
Show the details
Type a Name that tells you which site this is, for example your site name. Only you see it, and visitors never do. If you use one project for several sites, make a separate client for each site.
- Add your redirect URLPaste your Google redirect URL under Authorized redirect URIs, then click Create.
Show the details
Leave Authorized JavaScript origins empty, and leave the box for an AI-powered agent unticked. Google can take from 5 minutes to a few hours to apply a new redirect URL.
- Copy the Client ID and Client secretGoogle shows the full secret only once, so copy it now.
If you lose the secret
Open the client, click Add Secret, and use the new secret. Then disable the old one.
- Paste both into Social LoginIn the Google section, tick the box, paste the Client ID and secret, then click Save.
- Test itOpen your Log in page in a private window and click Continue with Google.
Step 3: Set up Microsoft
Microsoft steps
- Start a new registrationGo to Identity, Applications, App registrations, then click New registration.
- Register the appName it after your site and choose the widest account type.
Show the details
Under Supported account types, choose Accounts in any organizational directory and personal Microsoft accounts. Leave Redirect URI empty for now and click Register.
- Copy the Application (client) IDIt is on the Overview page of your new app.
- Add your redirect URLUnder Manage, open Authentication, click Add a platform, then choose Web.
Show the details
Paste your Microsoft redirect URL into Redirect URI and click Configure.
- Create a client secretOpen Certificates & secrets, then Client secrets, then New client secret.
Show the details
Add a description and choose an expiry. Microsoft allows up to 24 months and recommends less than 12. Click Add.
- Copy the secret ValueCopy the Value column, not the Secret ID. Microsoft never shows it again.
- Paste both into Social LoginIn the Microsoft section, tick the box, paste the Application (client) ID and the secret Value, then click Save.
- Test itOpen your Log in page in a private window and click Continue with Microsoft.
Microsoft secrets expire. Put the expiry date in your calendar. When it passes, the Microsoft button stops working until you create a new secret and paste it in.
Check that it works
- Both buttons showOn the Log in page and the Register page.
- A new Google sign-up worksYou land on your dashboard and no confirmation email arrives.
- A new Microsoft sign-up sends the confirmation emailOpen the link in the same browser you signed up in.
- Signing out and back in worksUse the same button you signed up with.
How Djangify keeps accounts safe
- Signs in only when Google says the email is verified.
- Signs in to an existing account only if that account has confirmed the same email.
- Ignores an email that someone added to their account but never confirmed.
Microsoft
- Treats the email as unverified, so it sends the confirmation email.
- Never signs in to an existing account.
- Keeps the Microsoft link only if the email is confirmed in the same browser that signed up.
Common problems
The buttons do not show
Open Social Login and check three things: the box is ticked, the Client ID is filled in and the secret has been saved. A provider with a missing key stays hidden. Then reload your Log in page.
Google or Microsoft says the redirect URL does not match
The URL in Google or Microsoft must match the one on your Social Login page exactly, including https and the slash at the end. Copy it again, save it, and give Google a few minutes to apply it.
Google shows a banner about charges on my billing account
Signing in with Google is free. The banner is about your Google Cloud billing account and any other services you have on it, so you can ignore it for this setup.
The Microsoft button stopped working after months
The client secret has probably expired. Create a new client secret in Microsoft, copy its Value and paste it into Social Login.
I lost the client secret
For Google, open the client and click Add Secret. For Microsoft, create a new client secret, because it never shows the old Value again. Paste the new secret into Social Login and save.
A Microsoft visitor confirmed their email, then the Microsoft button stopped working
They probably opened the confirmation link in a different browser from the one they signed up in. The email is confirmed, but the Microsoft link is dropped on purpose. They can sign in with Forgot password instead.
Do these visitors have a password?
No, and they do not need one. If they want one, Forgot password sends them a link.
How do I switch a button off?
Untick its box in Social Login and click Save. Accounts that already exist keep working with email and password.
I am stuck on a screen in Google or Microsoft
Both change their screens often, so the names here may differ a little. Copy what you see into Claude or ChatGPT and ask which button to press next.