Manage sign-in providers
Master admins choose which sign-in options appear (Google, Microsoft, Apple, ChatGPT, passkeys, single sign-on), see what each one still needs, test its configuration and switch it on or off.
Overview
The Sign-in providers card in Settings is visible to master admins only. It lists every sign-in option in the order people see them on the sign-in page — Google, Microsoft, Apple, ChatGPT, Passkey, Single sign-on (SSO) and Email — and shows one of three states for each:
- Ready — switched on and fully configured. It appears on the sign-in page.
- Needs configuration — something is missing or failing. The card lists exactly what, by name (for example AUTH_MICROSOFT_CLIENT_SECRET (secret)). Values and secrets are never shown.
- Disabled — switched off. It does not appear anywhere, and its sign-in addresses answer "not found".
An option appears on the sign-in page only when it is switched on here and its configuration is complete and checked. Email and password is always on, so there is always a way back in.
Before you start
- You must be a master admin. See Master admin access.
- Credentials are set up by whoever runs the service: client IDs as service variables, secrets in Google Secret Manager. The step-by-step setup for each provider is in the project's deployment guide (DEPLOY_GCP.md).
- Passkeys also need their database table to be created once; until then the card shows that as the missing item.
Steps
Check a provider
- Open Settings from the sidebar and find Sign-in providers.
- Read the state and the list under the provider's name.
- Click Test configuration to re-check it now. For Microsoft, Apple, ChatGPT and SSO this fetches the provider's published sign-in settings; for Apple it also checks that the private key can be read; for passkeys it checks the database table.
Switch a provider on
- Make sure the state under its name says the configuration is complete.
- Click its switch. The switch cannot be turned on while anything is still missing.
- The option appears on the sign-in and sign-up pages within about 15 seconds.
Switch a provider off
- Click its switch and confirm.
- The button disappears from the sign-in page. People who used it can still sign in with another method that uses the same verified email.
Example
The team has added Microsoft credentials. The Microsoft row shows Configuration complete and checked. A master admin clicks Test configuration, sees Microsoft: configuration is valid., then turns the switch on. A minute later, a household member at priya@example.org signs in with Continue with Microsoft.
FAQs
Can other users see this card?
No. It is shown only to master admins, and the server checks master-admin access again on every request.
What does "Forced off by the AUTH_… _ENABLED=false variable" mean?
Someone set an emergency kill switch on the service. It overrides the switch here until it is removed from the service settings.
Why is ChatGPT "Needs configuration"?
"Sign in with ChatGPT" is offered by OpenAI to approved partners. It stays unavailable until OpenAI issues client credentials for Personal360 and they are added to the service.
What happens to accounts when I switch a provider off?
Nothing is deleted. Those people sign in another way, for example with email and password after a password reset, or another provider with the same verified email.
Troubleshooting
The switch is greyed out
The configuration is not complete. Fix the items listed under the provider, then click Test configuration.
"discovery failed" appears under a provider
Personal360 couldn't fetch the provider's published sign-in settings. Check the issuer address or tenant, wait a minute and click Test configuration again.
A single SSO domain shows a warning
One of several connected organisations couldn't be reached. The others keep working; people from that domain see a temporary error.