Django social authentication made simple

Django Social Auth

Django Social Auth is an easy to setup social authentication/authorization mechanism for Django projects.

Crafted using base code from django-twitter-oauth_ and django-openid-auth_, implements a common interface to define new authentication providers from third parties.

You can check this documentation on Read the Docs_ too.

.. contents:: Table of Contents


There’s a demo at Note: It lacks some backends support at the moment.


This application provides user registration and login using social sites credentials, some features are:

  • Registration and Login using social sites using the following providers at the moment:

    • Google OpenID_
    • Google OAuth_
    • Google OAuth2_
    • Yahoo OpenID_
    • OpenId_ like myOpenID_
    • Twitter OAuth_
    • Facebook OAuth_

Some contributions added support for:

* `LiveJournal OpenID`_
* `Orkut OAuth`_
* `Linkedin OAuth`_
* `Foursquare OAuth2`_
* `GitHub OAuth`_
* `Dropbox OAuth`_
* `Flickr OAuth`_
* `Vkontakte OAuth`_
* `MSN Live Connect OAuth2`_
* `Skyrock OAuth`_
* `Yahoo OAuth`_
* `Evernote OAuth`_
* ` OAuth`_
* `Odnoklassniki OAuth`_
* `Mixcloud OAuth2`_
  • Basic user data population and signaling, to allows custom fields values from providers response

  • Multiple social accounts association to single users

  • Custom User model override if needed (auth.User_ by default)

  • Extensible pipeline to handle authentication/association mechanism


Dependencies that must be meet to use the application:

  • OpenId_ support depends on python-openid_

  • OAuth_ support depends on python-oauth2_

  • Several backends demands application registration on their corresponding sites.


From pypi_::

$ pip install django-social-auth


$ easy_install django-social-auth

or clone from github_::

$ git clone git://

and add social_auth to PYTHONPATH::

$ export PYTHONPATH=$PYTHONPATH:$(pwd)/django-social-auth/


$ cd django-social-auth
$ sudo python install


  • Add social_auth to PYTHONPATH and installed applications::

    INSTALLED_APPS = ( … ‘social_auth’ )

  • Add desired authentication backends to Django’s AUTHENTICATIONBACKENDS setting::

    AUTHENTICATION_BACKENDS = ( ‘social_auth.backends.twitter.TwitterBackend’, ‘social_auth.backends.facebook.FacebookBackend’, ‘’, ‘’, ‘’, ‘’, ‘social_auth.backends.browserid.BrowserIDBackend’, ‘social_auth.backends.contrib.linkedin.LinkedinBackend’, ‘social_auth.backends.contrib.livejournal.LiveJournalBackend’, ‘social_auth.backends.contrib.orkut.OrkutBackend’, ‘social_auth.backends.contrib.foursquare.FoursquareBackend’, ‘social_auth.backends.contrib.github.GithubBackend’, ‘social_auth.backends.contrib.dropbox.DropboxBackend’, ‘’, ‘social_auth.backends.contrib.instagram.InstagramBackend’, ‘social_auth.backends.contrib.vkontakte.VKontakteBackend’, ‘social_auth.backends.contrib.skyrock.SkyrockBackend’, ‘’,
    ‘social_auth.backends.OpenIDBackend’, ‘social_auth.backends.contrib.bitbucket.BitbucketBackend’, ‘social_auth.backends.contrib.mixcloud.MixcloudBackend’, ‘’, ‘django.contrib.auth.backends.ModelBackend’, )

Take into account that backends must be defined in AUTHENTICATIONBACKENDS or Django won’t pick them when trying to authenticate the user.

Don’t miss django.contrib.auth.backends.ModelBackend if using django.auth user model or users won’t be able to login.

  • Setup needed OAuth keys (see OAuth_ section for details)::


  • Setup login URLs::

    LOGIN_URL = ‘/login-form/’ LOGIN_REDIRECT_URL = ‘/logged-in/’ LOGIN_ERROR_URL = ‘/login-error/’

Check Django documentation at Login URL_ and Login redirect URL_

If a custom redirect URL is needed that must be different to LOGIN_URL, define the setting::

SOCIAL_AUTH_LOGIN_REDIRECT_URL = '/another-login-url/'

A different URL could be defined for newly registered users::

SOCIAL_AUTH_NEW_USER_REDIRECT_URL = '/new-users-redirect-url/'

or for newly associated accounts::

SOCIAL_AUTH_NEW_ASSOCIATION_REDIRECT_URL = '/new-association-redirect-url/'

or for account disconnections::

SOCIAL_AUTH_DISCONNECT_REDIRECT_URL = '/account-disconnected-redirect-url/'

Users will be redirected to LOGIN_ERROR_URL in case of error or user cancellation on some backends. This URL can be override by this setting::

  • Configure authentication and association complete URL names to avoid possible clashes::

    SOCIAL_AUTH_COMPLETE_URL_NAME = ‘socialauth_complete’ SOCIAL_AUTH_ASSOCIATE_URL_NAME = ‘socialauth_associate_complete’

  • Add URLs entries::

    urlpatterns = patterns(”, … url(r”, include(‘social_auth.urls’)), … )

All django-social-auth URLs names have socialauth_ prefix.

  • Define context processors if needed::

    TEMPLATE_CONTEXT_PROCESSORS = ( … ‘social_auth.context_processors.social_auth_by_name_backends’, ‘social_auth.context_processors.social_auth_backends’, ‘social_auth.context_processors.social_auth_by_type_backends’, ‘social_auth.context_processors.social_auth_login_redirect’ )

    • social_auth_by_name_backends: Adds a social_auth dict where each key is a provider name and its value is a UserSocialAuth instance if user has associated an account with that provider, otherwise None.

    • social_auth_backends: Adds a social_auth dict with keys are associated, not_associated and backends. associated key is a list of UserSocialAuth instances associated with current user. not_associated is a list of providers names that the current user doesn’t have any association yet. backends holds the list of backend names supported.

    • social_auth_by_type_backends: Simiar to social_auth_backends but each value is grouped by backend type openid, oauth2 and oauth.

    • social_auth_login_redirect: For man in the middle redirects (ie authenticating via a login required decorator), a convenince query string can be added to your context for templates. On your login options page::

    allows for a continuous login. Useful if multiple login options are presented.

Check social_auth.context_processors for details.

Note: social_auth_backends and social_auth_by_type_backends don’t play nice together.

  • Sync database to create needed models::

    ./ syncdb

  • Not mandatory, but recommended::

    SOCIAL_AUTH_DEFAULT_USERNAME = ‘new_social_auth_user’


import random
SOCIAL_AUTH_DEFAULT_USERNAME = lambda: random.choice(['Darth Vader', 'Obi-Wan Kenobi', 'R2-D2', 'C-3PO', 'Yoda'])

in case your user layout needs to purify username on some weird way.

Final user name will have a random UUID-generated suffix in case it’s already taken. The UUID token max length can be changed with the setting::

  • Backends will store extra values from response by default, set this to False to avoid such behavior::


Also more extra values will be stored if defined, details about this setting are listed below on OpenId and OAuth sections.

  • The update_user_details pipeline processor will set certain fields on user objects, such as email. Set this to a list of fields you only want to set for newly created users:


Session expiration time is an special value, it’s recommended to define::


and use such setting name where expiration times are returned. View that completes login process will set session expiration time using this name if it’s present or expires by default. Expiration configuration can be disabled with setting::

  • It’s possible to override the used User model if needed::

    SOCIAL_AUTH_USER_MODEL = ‘myapp.CustomUser’

This class must have a custom Model Manager_ with a create_user method that resembles the one on auth.UserManager_.

Also, it’s highly recommended that this class define the following fields::

username   = CharField(...)
last_login = DateTimeField(blank=True)
is_active  = BooleanField(...)

and the method::


These are needed to ensure a better django-auth integration, in other case login_required_ won’t be usable. A warning is displayed if any of these are missing. By default auth.User_ is used.

Check example application for implementation details, but first, please take a look to User Profiles_, it might be what you were looking for.

It’s possible to disable user creations by django-social-auth with::


It is also possible to associate multiple user accounts with a single email address, set value as True to enable, otherwise set as False to disable. This behavior is disabled by default (False) unless specifically set::

  • You can send extra parameters on auth process by defining settings per provider, example to request Facebook to show Mobile authorization page, define::

    FACEBOOK_AUTH_EXTRA_ARGUMENTS = {‘display’: ‘touch’}

For other providers, just define settings in the form::

  <uppercase backend name>_AUTH_EXTRA_ARGUMENTS = {...}
  • Also, you can send extra parameters on request token process by defining settings per provider in the same way explained above but with this other suffix::


  • By default the application doesn’t make redirects to different domains, to disable this behavior::


  • Inactive users can be redirected to a different page if this setting is defined::


Defaults to LOGIN_ERROR_URL.

  • The application catches any exception and logs errors to logger or django.contrib.messagess application by default. But it’s possible to override the default behavior by defining a function to process the exceptions using this setting::

    SOCIAL_AUTH_PROCESS_EXCEPTIONS = ‘social_auth.utils.process_exceptions’

The function parameters will request holding the current request object, backend with the current backend and err which is the exception instance.

Recently this set of exceptions were introduce to describe the situations a bit more than the old ValueError usually raised::

AuthException           - Base exception class
AuthFailed              - Authentication failed for some reason
AuthCanceled            - Authentication was canceled by the user
AuthUnknownError        - An unknown error stoped the authentication
AuthTokenError          - Unauthorized or access token error, it was
                          invalid, impossible to authenticate or user
                          removed permissions to it.
AuthMissingParameter    - A needed parameter to continue the process was
                          missing, usually raised by the services that
                          need some POST data like myOpenID

These are a subclass of ValueError to keep backward compatibility.

Having tracebacks is really useful when debugging, for that purpose this setting was defined::


It’s default value is DEBUG, so you need to set it to False to avoid tracebacks when DEBUG = True.

  • When your project is behind a reverse proxy that uses HTTPS the redirect URIs can became with the wrong schema (http:// instead of https://), and might cause errors with the auth process, to force HTTPS in the final URIs define this setting::


  • The name of the last backend used to login is stored as a string in the session under the key social_auth_last_login_backend, the key can be customized by defining this setting::

    SOCIAL_AUTH_LAST_LOGIN = ‘social_auth_last_login_backend’

Some settings can be tweak by backend by adding the backend name prefix (all uppercase and replace - with _), here’s the supported settings so far::

  • The ORM models can be replaced by providing the name of an alternate module for the SOCIAL_AUTH_MODELS setting. The default is 'social_auth.db.django_models', which defines the Django ORM models that were originally defined to implement Social Auth’s storage. The app provides an example alternate based on MongoEngine_. You can use it by setting::

    SOCIAL_AUTH_MODELS = ‘social_auth.db.mongoengine_models’

Make sure you’ve followed the instructions for MongoEngine Django integration_, as you’re now utilizing that user model.

The MongoEngine_ backend was developed and tested with version 0.6.10 of MongoEngine_.

Alternate storage models implementations currently follow a tight pattern of models that behave near or identical to Django ORM models. It is currently not decoupled from this pattern by any abstraction layer. If you would like to implement your own alternate, please see the social_auth.db.django_models and social_auth.db.mongoengine_models modules for guidance.

Authentication Pipeline

The final process of the authentication workflow is handled by a operations pipeline where custom functions can be added or default items can be removed to provide a custom behavior.

The default pipeline mimics the user creation and basic data gathering from previous django-social-auth_ versions and a big set of settings (listed below) that were used to alter the default behavior are now deprecated in favor of pipeline overrides.

The default pipeline is composed by::

    # Find UserSocialAuth object by backend and backend uid. 
    # Fail if UserSocialAuth already exists but not associated with 
    # the current user in the pipeline. Otherwise set the current user
    # in the pipeline to be the user associated with UserSocialAuth
    # Try to find an existing user that has the email address provided
    # by the authentication backend. Fail if email addr. is not unique
    # If no user is found so far, generate a unique username based on 
    # configured settings
    # Depends on get_username. If no user is found so far, then create 
    # a new user based on the username returned by get_username
    # If new user is created, set the current user in the pipeline to be
    # the newly created user and set the is_new arg to be true and 
    # sends the socialauth_not_registered signal 
    # If no instance of UserSocialAuth is found so far (through social_auth_user)
    # create a new UserSocialAuth instance associated with the given user
    # Take the extra data given by backend and store them in the 
    # UserSocialAuth instance's extra_data field, updating existing values
    # Depends on an instance of UserSocialAuth to exist of course
    # Update fields on the user object based on details provided by the
    # authentication backend, skipping sensative fields such as username,
    # id, pk, (and other provided in SOCIAL_AUTH_PROTECTED_USER_FIELDS if a 
    # user is already registered)
    # Fires the pre_update signal before updating and socialauth_registered
    # signal if is_new flag is set (by create_user pipeline)

But it’s possible to override it by defining the setting SOCIAL_AUTH_PIPELINE, for example a pipeline that won’t create users, just accept already registered ones would look like this::


Each pipeline function will receive the following parameters: * Current social authentication backend * User ID given by authentication provider * User details given by authentication provider * is_new flag (initialized in False) * Any arguments passed to auth_complete backend method, default views pass this arguments:

  - current logged in user (if it's logged in, otherwise ``None``)
  - current request

Each pipeline entry must return a dict or None, any value in the dict will be used in the kwargs argument for the next pipeline entry.

The workflow will be cut if the exception social_auth.backends.exceptions.StopPipeline is raised at any point.

If any function returns something else beside a dict or None, the workflow will be cut and the value returned immediately, this is useful to return HttpReponse instances like HttpResponseRedirect.

Partial Pipeline

It’s possible to cut the pipeline process to return to the user asking for more data and resume the process later, to accomplish this add the entry social_auth.backends.pipeline.misc.save_status_to_session (or a similar implementation) to the pipeline setting before any entry that returns an HttpResponse instance::


When it’s time to resume the process just redirect the user to /complete/<backend>/ view. By default the pipeline will be resumed in the next entry after save_status_to_session but this can be modified by setting the following setting to the import path of the pipeline entry to resume processing::

SOCIAL_AUTH_PIPELINE_RESUME_ENTRY = 'social_auth.backends.pipeline.misc.save_status_to_session'

save_status_to_session saves needed data into user session, the key can be defined by SOCIAL_AUTH_PARTIAL_PIPELINE_KEY which default value is partial_pipeline::


Check the example application_ to check a basic usage.

Deprecated bits

The following settings are deprecated in favor of pipeline functions.

  • These settings should be avoided and override get_username pipeline entry with the desired behavior::


  • User creation setting should be avoided and remove the entry create_user from pipeline instead::


  • Automatic data update should be stopped by overriding update_user_details pipeline entry instead of using this setting::


  • Extra data retrieval from providers should be stopped by removing load_extra_data from pipeline instead of using this setting::


  • Automatic email association should be avoided by removing associate_by_email pipeline entry instead of using this setting::


  • Associate URLs are deprecated since the login ones can handle the case, this avoids issues where providers check the redirect URI and redirects to the configured value in the application. So, from now on a single entry point is recommended being::

    /<social auth path>/login/<backend>/

And to complete the process::

    /<social auth path>/complete/<backend>/

Usage example

Authentication process starts with socialauth_begin URL.

Template code example::

    <a href="{% url socialauth_begin 'twitter' %}">Enter using Twitter</a>
    <a href="{% url socialauth_begin 'facebook' %}">Enter using Facebook</a>

In the example above we assume that Twitter and Facebook authentication backends enabled, and following settings provided::

TWITTER_CONSUMER_KEY = 'real key here'
TWITTER_CONSUMER_SECRET = 'real secret here'
FACEBOOK_APP_ID = 'real id here'
FACEBOOK_API_SECRET = 'real secret here'


A pre_update signal is sent when user data is about to be updated with new values from authorization service provider, this apply to new users and already existent ones. This is useful to update custom user fields or User Profiles_, for example, to store user gender, location, etc. Example::

from social_auth.signals import pre_update
from social_auth.backends.facebook import FacebookBackend

def facebook_extra_values(sender, user, response, details, **kwargs):
    user.gender = response.get('gender')
    return True

pre_update.connect(facebook_extra_values, sender=FacebookBackend)

New data updating is made automatically but could be disabled and left only to signal handler if this setting value is set to True::


Take into account that when defining a custom User model and declaring signal handler in, the imports and handler definition must be made after the custom User model is defined or circular imports issues will be raised.

Also a new-user signal (socialauth_registered) is sent when new accounts are created::

from social_auth.signals import socialauth_registered

def new_users_handler(sender, user, response, details, **kwargs):
    user.is_new = True
    return False

socialauth_registered.connect(new_users_handler, sender=None)


Almost every service covered provide some kind of API that is protected with access_token or token pairs (like Twitter OAuth keys_). These tokens are gathered by the authentication mechanism and stored in UserSocialAuth.extra_data.

UserSocialAuth has a property named tokens to easilly access this useful values, it will return a dictionary containing the tokens values. A simple usage example::

>>> from pprint import pprint
>>> from social_auth.models import UserSocialAuth
>>> instance = UserSocialAuth.objects.filter(provider='twitter').get(...)
>>> pprint(instance.tokens)
{u'oauth_token': u'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',
 u'oauth_token_secret': u'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy'}
>>> instance = UserSocialAuth.objects.filter(provider='facebook').get(...)
>>> pprint(instance.tokens)
{u'access_token': u'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'}


OpenId ^^^^^^

OpenId_ support is simpler to implement than OAuth_. Google and Yahoo providers are supported by default, others are supported by POST method providing endpoint URL.

OpenId_ backends can store extra data in UserSocialAuth.extra_data field by defining a set of values names to retrieve from any of the used schemas, AttributeExchange and SimpleRegistration. As their keywords differ we need two settings.

Settings is per backend, so we have two possible values for each one. Name is dynamically checked using uppercase backend name as prefix::

<uppercase backend name>_SREG_EXTRA_DATA
<uppercase backend name>_AX_EXTRA_DATA


GOOGLE_AX_EXTRA_DATA = [(..., ...)]

Settings must be a list of tuples mapping value name in response and value alias used to store. A third value (boolean) is supported to, it’s purpose is to signal if the value should be discarded if it evaluates to False, this is to avoid replacing old (needed) values when they don’t form part of current response. If not present, then this check is avoided and the value will replace any data.

OAuth ^^^^^

OAuth_ communication demands a set of keys exchange to validate the client authenticity prior to user approbation. Twitter, Facebook and Orkut facilitates these keys by application registration, Google works the same, but provides the option for unregistered applications.

Check next sections for details.

OAuth_ backends also can store extra data in UserSocialAuth.extra_data field by defining a set of values names to retrieve from service response.

Settings is per backend and it’s name is dynamically checked using uppercase backend name as prefix::

<uppercase backend name>_EXTRA_DATA


FACEBOOK_EXTRA_DATA = [(..., ...)]

Settings must be a list of tuples mapping value name in response and value alias used to store. A third value (boolean) is supported to, it’s purpose is to signal if the value should be discarded if it evaluates to False, this is to avoid replacing old (needed) values when they don’t form part of current response. If not present, then this check is avoided and the value will replace any data.

Twitter ^^^^^^^

Twitter offers per application keys named Consumer Key and Consumer Secret. To enable Twitter these two keys are needed. Further documentation at Twitter development resources_:

  • Register a new application at Twitter App Creation_,

  • mark the “Yes, use Twitter for login” checkbox, and

  • fill Consumer Key and Consumer Secret values::


  • You need to specify an URL callback or the application will be marked as Client type instead of the Browser. Almost any dummy value will work if you plan some test.

Facebook ^^^^^^^^

Facebook works similar to Twitter but it’s simpler to setup and redirect URL is passed as a parameter when issuing an authorization. Further documentation at Facebook development resources_:

  • Register a new application at Facebook App Creation_, and

  • fill App Id and App Secret values in values::


  • Define FACEBOOK_EXTENDED_PERMISSIONS to get extra permissions from facebook. NOTE: to get users’ email addresses, you must request the ‘email’ permission::


Take into account that Facebook doesn’t return user email by default, this setting is needed if email is required::

  • Define FACEBOOK_PROFILE_EXTRA_PARAMS to pass extra parameters to when gathering the user profile data, like::


If you define a redirect URL in Facebook setup page, be sure to not define or http://localhost:8000 because it won’t work when testing. Instead I define and setup a mapping on /etc/hosts or use dnsmasq_.

If you need to perform authentication from Facebook Canvas application: - Create your canvas application at - In Facebook application settings specify your canvas URL (current default) - Setup your Django Social Auth settings like you usually do for Facebook authentication (FACEBOOK_APP_ID etc) - Launch via sudo ./ runserver for browser to be able to load it when Facebook calls canvas URL - Open your Facebook page via or better via - After that you will see this page in a right way and will able to connect to application and login automatically after connection

More info on the topic at Facebook Canvas Application Authentication_.

Orkut ^^^^^

Orkut offers per application keys named Consumer Key and Consumer Secret. To enable Orkut these two keys are needed.

Check Google support_ and Orkut API_ for details on getting your consumer_key and consumer_secret keys.

  • fill Consumer Key and Consumer Secret values::


  • add any needed extra data to::


  • configure extra scopes in::


Google OAuth ^^^^^^^^^^^^

Google provides Consumer Key and Consumer Secret keys to registered applications, but also allows unregistered application to use their authorization system with, but beware that this method will display a security banner to the user telling that the application is not trusted.

Check Google OAuth_ and make your choice.

  • fill Consumer Key and Consumer Secret values::


anonymous values will be used if not configured as described in their OAuth reference_

  • configure the display name to be used in the “grant permissions” dialog that Google will display to users in::


shows ‘Social Auth’ by default, but that might not suite your application.

  • setup any needed extra scope in::


Check which applications can be included in their Google Data Protocol Directory_

Google OAuth2 ^^^^^^^^^^^^^

Recently Google launched OAuth2 support following the definition at OAuth2 draft. It works in a similar way to plain OAuth mechanism, but developers must register an application and apply for a set of keys. Check Google OAuth2_ document for details.

Note: This support is experimental as Google implementation may change and OAuth2 is still a draft.

To enable OAuth2 support:

  • fill Client ID and Client Secret settings, these values can be obtained easily as described on OAuth2 Registering_ doc::


previous name GOOGLE_OAUTH2_CLIENT_KEY is supported for backward compatibility.

  • scopes are shared between OAuth mechanisms::


Check which applications can be included in their Google Data Protocol Directory_

LinkedIn ^^^^^^^^

LinkedIn setup is similar to any other OAuth service. To request extra fields using LinkedIn fields selectors_ just define the setting::


with the needed fields selectors, also define LINKEDIN_EXTRA_DATA properly, that way the values will be stored in UserSocialAuth.extra_data field.

By default id, first-name and last-name are requested and stored.

GitHub ^^^^^^

GitHub works similar to Facebook (OAuth).

  • Register a new application at GitHub Developers_, set your site domain as the callback URL or it might cause some troubles when associating accounts,

  • Fill App Id and App Secret values in the settings::


  • Also it’s possible to define extra permissions with::


Bitbucket ^^^^^^^^^

Bitbucket works similar to Twitter (OAuth).

  • Register a new application by emailing [email protected] with an application name and a bit of a description,

  • Fill Consumer Key and Consumer Secret values in the settings::


Dropbox ^^^^^^^

Dropbox uses OAuth v1.0 for authentication.

  • Register a new application at Dropbox Developers_, and

  • fill App Key and App Secret values in the settings::


Flickr ^^^^^^

Flickr uses OAuth v1.0 for authentication.

  • Register a new application at the Flickr App Garden_, and

  • fill Key and Secret values in the settings::


  • Flickr might show a messages saying “Oops! Flickr doesn’t recognise the permission set.”, if encountered with this error, just define this setting::

    FLICKR_AUTH_EXTRA_ARGUMENTS = {‘perms’:‘read’}

BrowserID ^^^^^^^^^

Support for BrowserID_ is possible by posting the assertion code to /complete/browserid/ URL.

The setup doesn’t need any setting, just the usual BrowserID_ javascript include in your document and the needed mechanism to trigger the POST to django-social-auth_.

Check the second “Use Case” for an implementation example.

Instagram ^^^^^^^^^

Instagram uses OAuth v2 for Authentication

  • Register a new application at the Instagram API_, and

  • fill Client Id and Client Secret values in the settings::


  • extra scopes can be defined by using::

    INSTAGRAM_AUTH_EXTRA_ARGUMENTS = {‘scope’: ‘likes comments relationships’}

.. note::

Instagram only allows one callback url so you'll have to change your to accomodate both ``/complete`` and ``/associate`` routes, for
example by having a single ``/associate`` url which takes
a ``?complete=true`` parameter for the cases when you want to complete
rather than associate.

Vkontakte ^^^^^^^^^

Vkontakte uses OAuth v2 for Authentication

  • Register a new application at the Vkontakte API_, and

  • fill App Id and Api Secret values in the settings::


  • Define VK_EXTRA_DATA to pass extra fields when gathering the user profile data, like::

    VK_EXTRA_DATA = [‘photo’,‘country’]

  • Also it’s possible to define extra permissions with::

    VK_EXTRA_SCOPE = […]

See the names of the privileges VKontakte_.

You can also use Vkontakte’s own OpenAPI to log in, but you need to provide a HTML template with JavaScript code to authenticate. See vkontakte.html in templates folder for details.

To support authentication for VKontakte applications see authentication for VKontakte applications_.

MSN Live Connect ^^^^^^^^^^^^^^^^

OAuth2 based Live Connect workflow, notice that it isn’t OAuth WRAP.

  • Register a new application at Live Connect Developer Center_, set your site domain as redirect domain,

  • Fill Client Id and Client Secret values in the settings::


  • Also it’s possible to define extra permissions with::


Defaults are “wl.basic” and “wl.emails”. Latter one is necessary to retrieve user email.

Skyrock ^^^^^^^

Skyrock offers per application keys named Consumer Key and Consumer Secret. To enable Skyrock these two keys are needed. Further documentation at Skyrock API Documentation_:

  • Register a new application at Skyrock App Creation_,

  • fill Consumer Key and Consumer Secret values::


Yahoo OAuth ^^^^^^^^^^^

OAuth 1.0 workflow, useful if you are planning to use Yahoo’s API.

  • Register a new application at Yahoo Developer Center_, set your app domain and configure scopes (they can’t be overriden by application).

  • Fill Consumer Key and Consumer Secret values in the settings::


Evernote OAuth ^^^^^^^^^^^^^^

Evernote OAuth 1.0 workflow.

  • Register a new application at Evernote API Key form_.

  • Fill Consumer Key and Consumer Secret values in the settings::


  • To test in the sandbox add to settings::


Yandex OAuth and OpenID ^^^^^^^^^^^^^^^^^^^^^^^

Yandex uses OAuth 2.0 workflow, fill and YANDEX_APP_ID and YANDEX_API_SECRET settings to log in.

Currently there are 2 backends for Yandex, one is Yaru to log in using service and another one is YandexOAuth that could use service API from settings. Use YANDEX_OAUTH2_API_URL to set up which service to use.

Tested with ‘’ for and ‘’ for Moi Krug.

Yandex also uses OpenID 2.0. You do not need to provide user’s name because Yandex will do it for you. OAuth ^^^^^^^^^^^^^ uses OAuth2 workflow, to use it fill in settings::

MAILRU_OAUTH2_CLIENT_SECRET = '' ^^^^^^^^^^^^^^^^ uses OAuth2 workflow, to use it fill in settings::


Mixcloud OAuth2 ^^^^^^^^^^^^^^^

The Mixcloud API_ offers support for authorization. To enable OAuth2 support:

  • Register a new application at Mixcloud Developers_

  • Add Mixcloud backend to AUTHENTICATION_BACKENDS in settings::

    AUTHENTICATION_BACKENDS = ( … ‘social_auth.backends.contrib.mixcloud.MixcloudBackend’, )

  • Fill Client Id and Client Secret values in the settings::


  • Similar to the other OAuth backends you can define::

    MIXCLOUD_EXTRA_DATA = [(‘username’, ‘username’), (‘name’, ‘name’), (‘pictures’, ‘pictures’), (‘url’, ‘url’)]

as a list of tuples (response name, alias) to store user profile data on the UserSocialAuth model.


To test the application just run::

./ test social_auth

This will run a bunch of tests, so far only login process is tested, more will come eventually.

User accounts on the different sites are needed to run tests, configure the credentials in the following way::

# twitter testing
TEST_TWITTER_USER = 'testing_account'
TEST_TWITTER_PASSWORD = 'password_for_testing_account'

# facebook testing
TEST_FACEBOOK_USER = 'testing_account'
TEST_FACEBOOK_PASSWORD = 'password_for_testing_account'

# google testing
TEST_GOOGLE_USER = '[email protected]'
TEST_GOOGLE_PASSWORD = 'password_for_testing_account'

There’s support for Selenium_ tests too on root contrib directory. To run install selenium::

$ pip install selenium

and create a copying and fill the needed account information. Then run::

cd contrib/tests

Use Cases

Some particular use cases are listed below.

  1. Use social auth just for account association (no login)::

    urlpatterns += patterns(”, url(r’^associate/(?P[^/]+)/$‘, associate, name=‘socialauth_associate_begin’), url(r’^associate/complete/(?P[^/]+)/$‘, associate_complete, name=‘socialauth_associate_complete’), url(r’^disconnect/(?P[^/]+)/$‘, disconnect, name=‘socialauth_disconnect’), url(r’^disconnect/(?P[^/]+)/(?P[^/]+)/$‘, disconnect, name=‘socialauth_disconnect_individual’), )

  2. Include a similar snippet in your page to make BrowserID_ work::



Mailing list ^^^^^^^^^^^^ Join to django-social-auth discussion list_ and bring any questions or suggestions that would improve this application. Convore_ discussion group is deprecated since the service is going to be shut down on April 1st.

South users ^^^^^^^^^^^ South_ users should add this rule to enable migrations::

    import south
    from south.modelsinspector import add_introspection_rules
    add_introspection_rules([], ["^social_auth\.fields\.JSONField"])

Custom User model ^^^^^^^^^^^^^^^^^ If defining a custom user model, do not import social_auth from any that would finally import from the that defines your User class or it will make your project fail with a recursive import because social_auth uses get_model() to retrieve your User.

Third party backends ^^^^^^^^^^^^^^^^^^^^ There’s an ongoing movement to create a list of third party backends on djangopackages.com_, so, if somebody doesn’t want it’s backend in the contrib directory but still wants to share, just split it in a separated package and link it there.

Python 2.7.2rev4, 2.7.3 and Facebook backend ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Seems that this bug described in StackOverflow_ hits users using django-social-auth_ with Python versions 2.7.2rev4 and 2.7.3 (so far) and Facebook backend. The bug report #315_ explains it a bit more and shows a workaround fit avoid it.


Maybe several, please create issues in github_


Attributions to whom deserves:

  • caioariede_ (Caio Ariede):

    • Improvements and Orkut support
  • krvss_ (Stas Kravets):

    • Initial configuration
    • LiveJournal support
    •, Odnoklassniki support
    • Yandex OpenID support
    • VKontakte OpenAPI support
  • jezdez_ (Jannis Leidel):

    • Improvements and documentation update
  • alfredo_ (Alfredo Ramirez)

    • Facebook and Doc improvements
  • mattucf_ (Matt Brown)

    • Twitter and OAuth improvements
  • Quard_ (Vadym Zakovinko)

    • LinkedIn support
  • micrypt_ (Seyi Ogunyemi)

    • OAuth2 migration
  • bedspax_

    • Foursquare support
  • revolunet_ (Julien Bouquillon)

    • GitHub support
  • danielgtaylor_ (Daniel G. Taylor)

    • Dropbox support
    • Flickr support
    • Provider name context processor
  • r4vi_ (Ravi Kotecha)

    • Instagram support
  • andrusha_ (Andrew Korzhuev)

    • MSN Live Connect support
    • Yahoo OAuth 1.0 support
  • niQo_ (Nicolas Quiénot)

    • support
  • hassek_ (Tomas Henriquez)

    • Evernote support
  • fmoga_ (Florian Moga)

    • Mixcloud support
  • estebistec_ (Steven Cummings)

    • Overrideable models feature


Base work is copyrighted by:

  • django-twitter-oauth::

    Original Copyright goes to Henrik Lied (henriklied) Code borrowed from

  • django-openid-auth::

    django-openid-auth - OpenID integration for django.contrib.auth Copyright © 2007 Simon Willison Copyright © 2008-2010 Canonical Ltd.

.. _Model Manager: .. _Login URL: .. _Login redirect URL: .. _AUTHENTICATION_BACKENDS: .. _auth.User: .. _auth.UserManager: .. _login_required: .. _User Profiles: .. _OpenId: .. _OAuth: .. _django-twitter-oauth: .. _django-openid-auth: .. _python-openid: .. _python-oauth2: .. _Twitter development resources: .. _Twitter App Creation: .. _dnsmasq: .. _Facebook development resources: .. _Facebook App Creation: .. _Google support: .. _Orkut API: .. _Google OpenID: .. _Google OAuth: .. _Google OAuth2: .. _OAuth2 Registering: .. _Google Data Protocol Directory: .. _OAuth2 draft: .. _OAuth reference: .. _Yahoo OpenID: .. _Twitter OAuth: .. _Facebook OAuth: .. _Linkedin OAuth: .. _Orkut OAuth: .. _myOpenID: .. _LiveJournal OpenID: .. _Foursquare OAuth2: .. _pypi: .. _github: .. _issues in github: .. _caioariede: .. _krvss: .. _jezdez: .. _alfredo: .. _mattucf: .. _Quard: .. _micrypt: .. _r4vi: .. _andrusha: .. _niQo: .. _South: .. _bedspax: .. _django-social-auth: .. _Convore: .. _Selenium: .. _LinkedIn fields selectors: .. _Read the Docs: .. _revolunet: .. _GitHub OAuth: .. _GitHub Developers: .. .. _Dropbox OAuth: .. _Dropbox Developers: .. _Flickr OAuth: .. _Flickr App Garden: .. _danielgtaylor: .. _example application: .. _BrowserID: .. _Instagram API: .. _django-social-auth discussion list: .. _Twitter OAuth keys: .. Vkontakte OAuth: .. names of the privileges VKontakte: .. _Vkontakte API: .. _MSN Live Connect OAuth2: .. _Live Connect Developer Center: .. _StackOverflow: .. _#315: .. _Skyrock OAuth: .. _Skyrock App Creation: .. _Skyrock API Documentation: .. _Yahoo OAuth: .. _Yahoo Developer Center: .. _Evernote API Key form: .. _hassek: .. OAuth: .. _Odnoklassniki OAuth: .. _authentication for VKontakte applications: .. _Facebook Canvas Application Authentication: .. _Mixcloud OAuth2: .. _Mixcloud API: .. _Mixcloud Developers: .. _fmoga: .. _MongoEngine: .. _MongoEngine Django integration: .. _estebistec: