Voyti

User management, authentication & authorization

Social Auth

Social login is built on yiisoft/yii-auth-client's OAuth2 clients rather than a hand-rolled implementation. Voyti carries no OAuth2 protocol code, and no provider configuration, of its own - providers are configured entirely through that package's own params/DI, not through any Voyti-owned option. The redirect/callback flow is handled directly by the vendor's AuthAction PSR-15 middleware, wired in Voyti's config/di.php as the voyti/session-auth route action with Voyti's own success/cancel callbacks.

Configuring providers

Configure providers via a clients map under the yiisoft/yii-auth-client params key. Voyti configures each client's OAuth2 return URL for you automatically, keyed to match its own clients entry. Alternatively you can set a callback URL manually by adding an oauth2ReturnUrl key to that client's config - Voyti only fills it in when it's left unset.

// config/params.php
return [
    'yiisoft/yii-auth-client' => [
        'clients' => [
            'github' => [
                'class' => \Yiisoft\Yii\AuthClient\Client\GitHub::class,
                'clientId' => $_ENV['GITHUB_CLIENT_ID'],
                'clientSecret' => $_ENV['GITHUB_CLIENT_SECRET'],
            ],
            'google' => [
                'class' => \Yiisoft\Yii\AuthClient\Client\Google::class,
                'clientId' => $_ENV['GOOGLE_CLIENT_ID'],
                'clientSecret' => $_ENV['GOOGLE_CLIENT_SECRET'],
            ],
        ],
    ],
];

With yiisoft/config installed (the standard way to run a Yii3 app), this is all that's needed - the package's own config/di.php is merged in automatically once it's composer required. See yii-auth-client's own Quick Start guide for the full option set each client supports (custom scope via the scope key, extra auth-URL parameters, etc.).

Whatever key you pick also becomes part of the callback URL you'll need to register with the provider itself, as a full absolute URL: https://your-domain.tld/<prefix>/auth/<key>. Most providers' developer consoles require an exact match, so settle on your keys before registering each provider's OAuth app - changing a key later means updating that provider's redirect URI too.

Supported providers

Nine branded provider classes ship in yiisoft/yii-auth-client, each backed by its own Yiisoft\Yii\AuthClient\Client\* class (plus a generic Client\OpenIdConnect client - see below). Defaults (scope, endpoints) come entirely from the vendor client and its own DI wiring - see yii-auth-client's own docs for the full per-client option set.

Vendor class	Notes
`Client\Facebook`	The vendor client's default requested fields don't include email; same as GitHub, Voyti leaves it null rather than issuing a secondary Graph API call.
`Client\GitHub`	If `/user` doesn't include an email (private-email accounts), Voyti leaves `email` null rather than issuing a secondary request - the user supplies one manually during the registration-connect flow.
`Client\Google`	Standard `id`/`email`/`name` claims.
`Client\LinkedIn`	Identity comes from the OIDC-style `sub` claim rather than `id`.
`Client\Microsoft`	Hits the raw Microsoft Graph `/v1.0/me` endpoint (email under `mail`, name under `displayName`). Multi-tenant apps just add a `tenant` key to the `clients` entry - the client resolves its `authUrl`/`tokenUrl` placeholder against it internally.
`Client\TikTok`	Identity comes from `open_id` rather than `id`. Never returns email.
`Client\VKontakte`	Uses the newer VK ID endpoints (`id.vk.ru`) rather than the legacy `oauth.vk.com`/`api.vk.com` ones. The response has no username-like field at all - Voyti falls back to the email's local part.
`Client\X`	Response is unwrapped from its `data` envelope. Never returns email (X API v2 doesn't expose it without elevated access).
`Client\Yandex`	Email read from `default_email`.

How it works

With providers configured:

The login page shows social login buttons for configured providers.
settings/networks/ lists connected providers and renders connect buttons for the remaining configured providers.
New social identities redirect to the registration connect screen, where users can log in to an existing account or register a new one before the identity is linked.

When yiisoft/yii-auth-client isn't installed, every controller/view that touches social login (SessionController, SocialNetworkController, RegistrationController, and the login page's connect-button list) degrades gracefully: no providers are listed, and the voyti/session-auth route itself is never registered.

Generic self-hosted OpenID Connect identity providers aren't part of Voyti's built-in provider list. yii-auth-client ships a generic Client\OpenIdConnect class capable of real OIDC discovery and token validation - wiring one up is entirely the host application's own responsibility, configured the same way as any other client above.

← Configuration Console →