Skip to main content

Configure OpenID Providers

To integrate zkLogin with your app, you need an OAuth client from at least one of the available providers. You will use the Client ID and redirect URI from those providers in your zkLogin project. For example, the following TypeScript code constructs a Google login URL for testing.

caution

When configuring OAuth clients, register the exact redirect URIs your app uses and avoid wildcard or open redirects in production, as these enable token interception. Use a separate OAuth client per environment (for example, local, Testnet, and Mainnet) so test credentials never reach production, and rotate client secrets periodically and whenever one might have been exposed. See Security Best Practices.

Domain allowlisting checklist​

Every time you deploy your app to a new frontend domain, you must update your OAuth provider configuration. If you skip this step, the provider rejects the authentication request and your users cannot sign in.

Complete the following for each new domain:

  1. Add the domain to authorized JavaScript origins. In your OAuth provider's console (for example, Google Cloud Console under APIs and Services > Credentials), add the new domain to the list of authorized JavaScript origins. Include both the root domain and any subdomains your app uses.
  2. Add all redirect URIs for the new domain. Add every redirect URI your app uses on the new domain. Include the full path (for example, https://newdomain.example.com/auth/callback). Do not use wildcard URIs in production (Security Best Practices).
  3. Wait for propagation. Some providers (notably Google) take a few minutes to propagate new origin and redirect URI entries. Test the sign-in flow on the new domain after adding the entries.
  4. Update your Enoki Portal configuration (if applicable). If you use the Enoki platform for managed salt or proof generation, add the new domain to your Enoki app configuration. The Enoki salt service only accepts JWTs from allowlisted client IDs and origins.
  5. Test the full authentication flow. Sign in through each configured provider on the new domain and verify that the JWT contains the expected iss, aud, and sub claims. Confirm that the derived zkLogin address matches the address produced on your existing domains.
tip

If you use separate OAuth clients per environment (recommended), repeat this checklist for each client. A redirect URI registered on your Testnet OAuth client does not carry over to your Mainnet client.

const REDIRECT_URI = '<YOUR_SITE_URL>';

const params = new URLSearchParams({
	// Configure client ID and redirect URI with an OpenID provider
	client_id: $CLIENT_ID,
	redirect_uri: $REDIRECT_URI,
	response_type: 'id_token',
	scope: 'openid',
	// See below for details about generation of the nonce
	nonce: nonce,
});

const loginURL = `https://accounts.google.com/o/oauth2/v2/auth?${params}`;

OpenID providers​

The following table lists the OpenID providers that can support zkLogin or are currently being reviewed to determine whether they can support zkLogin.

ProviderCan support?DevnetTestnetMainnet
FacebookYesYesYesYes
GoogleYesYesYesYes
TwitchYesYesYesYes
AppleYesYesYesYes
SlackYesYesNoNo
KakaoYesYesNoNo
MicrosoftYesYesNoNo
AWS (Tenant)*YesYesYesYes
Karrier OneYesYesYesYes
Credenza3YesYesYesYes
RedBullUnder reviewNoNoNo
AmazonUnder reviewNoNoNo
WeChatUnder reviewNoNoNo
Auth0Under reviewNoNoNo
OktaUnder reviewNoNoNo
  • Sui supports AWS (Tenant) but the provider is enabled per tenant. Contact us for more information.

Configuring an OpenID provider​

Select a tab for instruction on configuring the client ID ($CLIENT_ID in the previous example) and redirect URI ($REDIRECT_URI in the previous example) with the relevant provider.

  1. Navigate a browser to the Google Cloud dashboard. Either sign in or register for a Google Cloud account.

  2. Open APIs & Services > Credentials using the Google Cloud dashboard navigation.

    1

  3. On the Credentials page, select CREATE CREDENTIALS > OAuth client ID.

    2

  4. Set the Application type and Name of your application.

    3

  5. In the Authorized redirect URIs section, click the ADD URI button. Set the value for your redirect URI in the field. This should be the wallet or application frontend.

    4

  6. Click Create. If successful, Google Cloud displays the OAuth client created dialog with metadata, including your Client ID. Click OK to dismiss the dialog.

Your new OAuth client should now appear in the OAuth 2.0 Client IDs section of the Credentials page. Click the Client ID that appears next to the client to copy the value to your clipboard. Click the client name to access the redirect URI and other client data.