This article will guide you through setting up X with the Social Login extension for UsersWP using OAuth 2.0 Authorization Code Flow with PKCE. You will need an X account and access to the X Developer Console to create and configure an app.

Settings Overview

• Enable X – Check this option to enable sign-in and registration with X.
• X Client ID – Enter the OAuth 2.0 Client ID from the Keys and Tokens section of your app in the X Developer Console.
• X Client Secret – Enter the OAuth 2.0 Client Secret generated for your X app. Keep this value private and never expose it publicly.
• Let the User Enter the Username? – If enabled, users will be asked to choose a username. If disabled, UsersWP will automatically generate a username from the information returned by X.
• Let the User Enter Email? – If enabled, users will be asked to enter their email address. If disabled, UsersWP will use the email returned by X when one is available. Enabling this option is recommended if your X app does not return the user’s email address.

Setting Up X with Social Login

1. Go to the X Developer Console and sign in.
2. Create a new project and app, or select an existing app.
3. Open your app’s authentication settings and enable OAuth 2.0.
4. Select Web App, Automated App, or another confidential-client app type that provides a Client Secret.
5. Configure the app permissions required for social login.
6. Add the callback URL displayed under UsersWP > Social > X to the app’s allowed callback or redirect URLs. The URL must match exactly.
7. If requested by X, enter your website URL and complete the remaining app information.
8. Open the Keys and Tokens section and generate or copy the OAuth 2.0 Client ID and Client Secret.
9. In WordPress, navigate to UsersWP > Social > X.
10. Enter the OAuth 2.0 Client ID and Client Secret in the corresponding fields.
11. Check the Enable X option.
12. Click Save changes.
13. Open your login or registration page in a private browser window and test the X sign-in process.

Required OAuth 2.0 Scopes

The integration requests the following OAuth 2.0 scopes:

• tweet.read – Allows the app to read permitted post data.
• users.read – Allows the app to read the authenticated user’s profile.
• users.email – Requests access to the user’s email address when available and permitted.
• offline.access – Allows the app to receive a refresh token.