Store social login implementation plan¶
Status: planned — no login configuration changed Updated: 2026-09-19
Outcome¶
Customers can use Google, Apple or Facebook to sign in to their existing WooCommerce account, retain their cart and see only their own orders. WooCommerce/MariaDB remains the account and order system of record. Staff access and company inventory approval remain separate. Native email/password and guest checkout stay available.
Approach and cost¶
Use a maintained WordPress integration, not a new identity database or homegrown OAuth implementation. Nextend Free is the current candidate for Google/Facebook with supported shortcode placement; compatibility, account linking and checkout continuity must be verified. Apple and automatic Woo integration are paid features in Nextend. Compare maintained free alternatives for Apple before proposing expenditure; do not assume a second self-hosted identity service is cheaper once upkeep is counted. No plugin or developer subscription is purchased by this plan.
Apple readiness includes developer membership review, a primary App ID, associated Services ID, key and relay-email configuration. Google and Meta require company-managed app configuration, consent/policy requirements and authorized test accounts. Exact callback paths are outputs of integration selection, not guessed in advance.
Assigned work¶
Kanboard is authoritative for task state. All six tasks are assigned to Angel as the department default triage owner, in Backlog. Engineering tasks are intended for delegated implementation when started; assignment does not mean a worker is running. Due 2026-10-19 is the SOP-017 default review date, not a promised launch.
| Task | Department | Dependencies |
|---|---|---|
| #266 Validate the store social-login integration and free-first cost decision | Engineering | None |
| #267 Prepare owner-managed Google, Meta and Apple customer-login applications | Administration | #266 |
| #268 Connect and test Google customer login in the isolated Woo store | Engineering | #266, #267 |
| #269 Connect and test Facebook customer login in the isolated Woo store | Engineering | #266, #267 |
| #270 Connect and test Apple customer login after readiness and cost decision | Engineering | #266, #267 |
| #271 Verify and release customer social login with recovery and operating SOP | Engineering | #268, #269, #270 |
Security and customer acceptance¶
- Use provider subject IDs; never grant staff or B2B access from an email/domain match. Existing-account linking requires authenticated proof and tested handling of verified/missing email. Apple relay identities must not silently create or merge the wrong account.
- Verify state/nonce, replay protection, exact redirect allowlists, secure cookies and safe post-login return URLs in the maintained integration. Redact tokens from logs.
- Preserve the dev gate and default network denial; approve only necessary token/identity exchange traffic. Test Apple callback behavior through that gate. Keep production ERP, payment, postage and mail isolation intact.
- Test new/repeat users, existing accounts, multiple providers, consent cancellation, missing email, expired credentials, unlinking, account recovery and deletion. Never allow unlinking the last usable login without recovery.
- Test iPhone/Safari and Android/Chrome plus desktop, accessible buttons, quantity-priced cart continuity, guest checkout, order ownership and no duplicate ERP orders.
- Release each provider only after independent acceptance; keep failed/unconfigured providers hidden. Rollback disables the integration without deleting users, identities or orders. All-three delivery remains open if Apple or Facebook is deferred.
Operations and dependencies¶
Account owners supply developer-console approvals and any cost decision; Engineering prepares exact settings and secure credential references. Record key rotation/expiry monitoring, outage response, plugin updates, backup/restore and privacy/deletion in a repeatable SOP during implementation. Follow SOP-017 for task close-out, SOP-020 for credentials and SOP-030 for customer retention. No live launch date is set.
References checked 2026-09-19¶
- Nextend provider and integration pricing
- Nextend supported placement
- Apple web sign-in prerequisites
Related: store-customer-experience · embeddedera-store
2026-10-31 — Angel asked for Google, Apple and Microsoft; free options checked¶
- Nextend free: Google, Facebook, X only. Apple and Microsoft need Pro (€49 + VAT, one-time; the page names Apple but not Microsoft explicitly).
- PixelHunter Social Login v0.4.4: free, Google + Microsoft personal accounts, WooCommerce-only, asks for the password before linking an existing email (matches our linking rule). <10 installs, one developer.
- WebPlatform Social Login: free, lists Google, Microsoft, Apple, Facebook, LinkedIn. 10+ installs, no reviews, links existing users by verified email with no password step (breaks our rule unless it can be turned off).
- Super Socializer: closed on WordPress.org 2026-06-18 for a security issue — do not use.
- Apple always needs the Apple Developer Program ($99/yr) whatever the plugin.