Use case

Social login without registering OAuth apps

AscendKit's OAuth proxy lets you ship social login without registering your own OAuth apps for each provider. Shared OAuth credentials are brokered through the proxy, so Google, GitHub, and LinkedIn sign-in work immediately, and you can switch to your own provider apps later when you want full branding.

How it works

1. Enable a provider
Turn on Google, GitHub, or LinkedIn in the portal — no OAuth app registration required to start.
2. Ship social login
Drop in the social-button components; sign-in is brokered through the OAuth proxy using shared credentials.
3. Bring your own apps later
When you want fully branded consent screens, swap in your own provider credentials without changing your app code.

Why does registering OAuth apps slow teams down?

Because each provider is its own process, and two of them involve review. Shipping Google, GitHub, and LinkedIn login normally means three developer accounts, three app registrations, three sets of redirect URIs per environment, and — for Google and LinkedIn — a verification step that can take days or weeks.

The verification is the real blocker. Google requires app verification before an OAuth consent screen can be shown to users outside your organization, and unverified apps show a warning screen that visibly costs you signups. LinkedIn gates several scopes behind product access requests.

AscendKit's OAuth proxy uses shared credentials, so you can enable Google, GitHub, and LinkedIn immediately and register your own applications later without changing your integration code.

What each path costs before your first social signup works.
Step	Your own OAuth apps	AscendKit OAuth proxy
Developer accounts to create	One per provider	None
Redirect URIs to maintain	One per provider, per environment	None
Google verification	Required before public use	Not required
LinkedIn product access	Request and wait	Not required
Time to first working login	Days to weeks	Minutes
Consent screen shows	Your app name	AscendKit's

What is the trade-off of shared credentials?

The consent screen shows AscendKit's application name rather than yours. For an early product that is usually an acceptable trade for shipping weeks sooner; for an established brand it is not, and you should register your own.

There is a second consideration worth stating: shared credentials mean shared rate limits and a shared reputation with other AscendKit projects. That is fine at low volume and is a reason to move to your own credentials as you grow.

The migration path is deliberately boring. Register your own applications, add the credentials in the dashboard, and the proxy stops being used. No code change, and existing users keep their linked accounts because the identity mapping is by provider account ID rather than by which credentials fetched it.

Troubleshooting

Users see AscendKit's name on the Google consent screen

Cause: Expected with the OAuth proxy — the consent screen reflects whoever owns the OAuth application.

Fix: Register your own Google OAuth app and add the credentials in the dashboard. Existing linked accounts carry over.

A provider works in development but not production

Cause: Almost always a redirect URI mismatch, which only appears once you have moved to your own OAuth credentials.

Fix: Add the production callback URL to the provider's allowed redirect URIs. They must match exactly, including scheme and trailing slash.

FAQ

Do I have to create a Google or GitHub OAuth app to start?

No. The OAuth proxy uses shared credentials so social login works immediately. You can register your own apps later for branded consent screens.

Which providers are supported?

Google, GitHub, and LinkedIn are supported today, both through the OAuth proxy and with your own provider credentials.

Related guides

Add auth and email to Next.js — the wider setup that social login slots into.
Add magic link login — the provider you can combine with OAuth, unlike credentials.

Start with one API key

Auth, email, surveys, and journeys share one user record, so you ship this without stitching vendors together.

Start free