--- id: "customers/authentication-methods" title: "Authentication methods" description: "This page lists the fields each authentication provider needs, and what RevenueCat does with them. To learn how authentication works before you configure it, see Authentication." permalink: "/docs/customers/authentication-methods" slug: "authentication-methods" version: "current" original_source: "docs/customers/authentication-methods.mdx" --- > **AI agents:** This is the Markdown version of a RevenueCat documentation page. For the complete documentation index, see [llms.txt](https://www.revenuecat.com/docs/llms.txt). This page lists the fields each authentication provider needs, and what RevenueCat does with them. To learn how authentication works before you configure it, see [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication). :::info[Private beta] [Tell us about your use case](https://revenuecateventfeedback.typeform.com/to/bzxYhAjZ) to get early access and help us shape the feature. ::: ## Prerequisites - Be the project owner or an **Administrator**, the only roles that can [view or manage authentication methods](https://www.revenuecat.com/docs/projects/collaborators) - Create an application with your identity provider - Read [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication) for how the identity provider, the method, and the access token fit together ## Choose a provider RevenueCat supports four providers. Pick the one that matches the identity provider your app already uses. | Provider | Use it for | What you supply | | ------------------ | -------------------------------------------------------------------------------- | --------------------------------------------------- | | **OpenID Connect** | Auth0, Okta, or any provider that publishes an OpenID Connect discovery document | An issuer URL | | **Google ID** | Google sign-in | A Google OAuth client ID | | **Apple ID** | Sign in with Apple | The Apple apps in your App ID group | | **Firebase** | Firebase Authentication | A Firebase project ID, web API key, and auth domain | Every provider works the same way: your app gets an ID token from the provider, and RevenueCat verifies it. ## Add a method 1. Open your project and select **Auth**. 2. Select **+ Add method**. 3. Select your provider on the **Select a provider to get started** screen. ![The Select a provider screen in the Auth section, listing OpenID Connect, Google ID, Apple ID, and Firebase](https://www.revenuecat.com/docs_images/customers/auth_select_provider.png) 4. Complete the fields for your provider. Each provider has its own section below. 5. Select **Add method**. ## OpenID Connect RevenueCat reads your provider's configuration from the **Issuer URL** and uses it to verify every ID token. You give RevenueCat one URL. It discovers the rest. RevenueCat requests `/.well-known/openid-configuration`. That document must supply an `issuer` value and a `jwks_uri` value, both over HTTPS, and RevenueCat saves both with the method. At each login, RevenueCat loads the signing key named by the token's `kid` header and verifies the RS256 signature. It then checks the `iss` claim against the saved issuer, the `exp` claim, and the age of the `iat` claim. RevenueCat identifies the method by the token's `iss` claim, so two methods in one project can't share an issuer. The **Client Secret**, **Requested scopes**, and **Authorization parameters** fields apply only to the interactive login that [funnels](https://www.revenuecat.com/docs/tools/funnels/creating-funnels#authentication-steps) use. | Field | Required | What to enter | | -------------------------------- | -------- | ---------------------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. The name appears in the method list and in funnel steps. | | Issuer URL | Yes | The HTTPS URL of your provider. Do not include the discovery path. | | Client ID | No | The value that your provider puts in the `aud` claim. When you set it, RevenueCat requires a match. | | Client Secret | No | Needed only for the interactive login. | | Requested scopes | No | Extra OAuth scopes for the interactive login. RevenueCat always includes `openid`. | | App user ID claim | No | The claim that RevenueCat maps to the App User ID. Leave it empty to use `sub`. | | Authorization parameters | No | Static query parameters for the authorization URL. Leave it empty unless your provider requires one. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | :::warning[The App user ID claim applies only at first login] RevenueCat maps this claim when it creates the Customer. Existing Customers keep the App User ID that they already have. ::: ### Example issuer URLs - **Auth0**: use your tenant domain, for example `https://example.us.auth0.com`. See [Auth0 OpenID Connect Discovery](https://auth0.com/docs/get-started/applications/configure-applications-with-oidc-discovery). - **Okta**: use your authorization server URL. See [Okta OpenID Connect & OAuth 2.0](https://developer.okta.com/docs/reference/api/oidc/). Any other provider works the same way, as long as it publishes an OpenID Connect discovery document. ## Google ID | Field | Required | What to enter | | -------------------------------- | -------- | ------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Client ID | Yes | The Google OAuth client ID for your application. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | RevenueCat checks the `aud` claim of the Google ID token against this client ID. To find the value, see [Get your Google API client ID](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid). ## Apple ID An Apple ID method covers an Apple App ID group, not a single bundle ID. You select the Apple apps in your project that belong to the group, and RevenueCat reads their bundle IDs from your app settings. When you change a bundle ID in the app settings, the method uses the new value. There is nothing to update in the method. Apple scopes the identifier of a Customer to the App ID group, so one method must cover the whole group. Two methods over one group would split a single Apple account into two Customers. Your project needs at least one App Store or Mac App Store app before you can add this method. | Field | Required | What to enter | | -------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Name | Yes | A label for the method. | | App IDs in the group | Yes | **Every Apple app in this project**, or **Only the apps I select** and then the apps in your App ID group. Apps that share a bundle ID, such as an iOS app and its Mac App Store version, appear as one row. | | Primary App ID | No | The radio button next to the App ID that is primary in your Apple Developer account. It has no effect on native sign-in. When the group has one App ID, RevenueCat selects it for you. | | ID token iat freshness (seconds) | No | Under **Advanced settings**. How old an ID token can be when your app sends it. | RevenueCat checks the `aud` claim of the Apple ID token against the bundle ID of the app that sends it. That app must belong to the method. Each Apple app can belong to only one Apple ID method, and a method that covers every Apple app leaves no room for another one. To learn how Apple groups App IDs, see [Sign in with Apple](https://developer.apple.com/documentation/signinwithapple). ## Firebase | Field | Required | What to enter | | ----------- | -------- | ------------------------------------------------------------------------------------- | | Name | Yes | A label for the method. | | Project ID | Yes | The Firebase project ID, from **Project settings → General** in the Firebase console. | | Web API key | Yes | The web API key that the Firebase JS SDK uses. | | Auth domain | Yes | The Firebase auth domain, such as `my-project.firebaseapp.com`. | RevenueCat checks the `aud` claim of the Firebase ID token against the project ID. To find these values, see [Firebase project configuration](https://firebase.google.com/docs/projects/learn-more#config-files-objects). :::warning[Funnels need an authorized domain] Add the domain of your funnel to the authorized domains of your Firebase project. Firebase blocks sign-in from a domain that it does not list. ::: ## Next steps - [Authentication](https://www.revenuecat.com/docs/customers/customer-authentication) — how the identity provider, the method, and the access token fit together - [Authentication steps in funnels](https://www.revenuecat.com/docs/tools/funnels/creating-funnels#authentication-steps) — require a sign-in before checkout in a funnel