Weave Code
Filament Socialite Laravel Package
dutchcodingcompany/filament-socialite
Filament Socialite adds OAuth social login buttons to Filament panels, letting users sign in with providers like Google, GitHub, and Facebook via Laravel Socialite. It includes configurable providers, redirect handling, and simple integration with Filament authentication.
Add OAuth login through Laravel Socialite to Filament.
Frequently asked questions about Filament Socialite
- How do I install dutchcodingcompany/filament-socialite in a Laravel app?
- Install it with Composer using composer require dutchcodingcompany/filament-socialite, then register the plugin in your Filament panel provider and publish the config file. Add each provider's client ID and secret to config/services.php and register the callback URL in the provider's developer console. The package does not require schema changes unless you decide to store explicit provider and subject linkage for account reconciliation.
- Which Laravel and Filament versions does Filament Socialite support?
- Version support is defined in the package's composer.json, so check the declared Filament and Laravel constraints before installing. The 3.3.0 release is a minor, additive change and ships no dependency-constraint changes. Filament majors have historically reshuffled auth and page internals, so confirm your Filament major is covered by the package's CI matrix and smoke-test the login page after every Filament upgrade.
- How do I add Google, GitHub or Facebook login buttons to a Filament panel?
- After installing and registering the plugin, publish the config file and declare the providers you want in the provider list. Each provider needs a client ID and secret in config/services.php plus a callback URL registered in that provider's console. Credential exchange, scopes and provider coverage are delegated to Laravel Socialite and the wider SocialiteProviders ecosystem.
- Can I disable automatic user creation or customize how users are created?
- The package offers automatic user creation and account linking, which you should treat as a deliberate, reviewed configuration decision rather than a default. Applying role assignment, domain allowlisting or audit policy requires hooking into user creation through the package's events or actions, or overriding the behavior. Verify the exact extension point in the config and source before depending on it in production.
- Is auto-linking social accounts by email a security risk?
- Yes, auto-linking an OAuth identity to a pre-existing account by email is an account-takeover vector if the provider's email is unverified or your tenant's email domain is not enforced. This should be an explicit, reviewed policy rather than an out-of-the-box default. Pair it with domain allowlisting, canAccessPanel authorization checks and audit logging.
- Does Filament Socialite support multiple panels, non-default guards and multi-tenancy?
- The plugin registers redirect and callback routes on the panel and injects buttons into Filament's authentication pages, but multi-panel, non-default-guard and tenant-scoped login behavior must be validated for your setup. Version 3.3.0 redirects back to login when a provider request fails, so check whether that failure redirect preserves the intended panel and tenant context or falls back to a global login route. Test explicitly if you run more than one panel.
- How does the package extend the Filament login page, and will upgrades break it?
- It injects provider buttons into the login view, and whether that is done via a render hook or a full view override determines upgrade fragility, since an override is far more exposed to Filament changes. Filament majors have historically reshuffled auth and page internals, and 3.3.0 changes login-page behavior on provider failure, so this surface needs smoke-testing after each bump. Pin versions and review the changelog before upgrading Filament.
- Does it work behind a load balancer or with multiple domains?
- State handling is standard Laravel Socialite, so OAuth state is stored in the session. Behind a load balancer or across multiple domains you need sticky sessions or a shared session store, plus consistent cookie domain settings. Validate APP_URL and the callback URL for each domain before going live.
- What happens if a provider returns no email address?
- Some providers, such as GitHub with a private email and without the user:email scope, may not return an email address. Because the package relies on email for user creation and account linking, you should test that case and choose a fallback such as requesting the scope or rejecting the login. Avoid letting a missing email produce a partially created user.
- Is Filament Socialite actively maintained, or should I implement social login myself?
- The project has a modest footprint, around 222 stars and no listed dependents, which implies a real bus factor, but the 3.3.0 minor release is evidence of live maintenance. The implementation surface is small: two routes, a controller and a render hook, roughly 100 to 200 lines to reimplement if the package stalls. If SSO is a genuine product requirement the exit cost is low, but if it is a nice-to-have a custom implementation may be simpler to own.
Weaver
How can I help you explore Laravel packages today?