Social Login for Shopware 6

Customers sign in without a password, with a single-use link by email and soon with Google or Facebook too

Social Login

A forgotten password is one of the familiar moments where a customer drops out of the checkout. Social Login puts 'Send me a login link' on the login page and in the checkout: the customer enters their email address and receives a single-use link that signs them straight in. It works right after installation, without a Google or Meta app; Google and Facebook sign-in follow in the next versions.

Free · before 1.0, on Bitbucket

What the plugin does

  • 'Send me a login link' on the login page and in the checkout login block; works right away, without a Google or Meta app
  • Single-use links: 256-bit random, stored only as a hash, valid for 15 minutes by default; a new link invalidates the previous one
  • No account enumeration: every address gets the same answer, and requests are limited per address and per IP
  • Safe from mail scanners: opening the link does not sign anyone in yet, the customer confirms with a button
  • Per sales channel on or off and with its own validity; link pages are never indexed or cached
  • Editable mail template in Shopware, with your sales channel's header and footer, in Dutch, English and German
  • Google and Facebook sign-in follow in the next versions

Free and open source under the MIT licence, with no registration and no licence key. This family is still before version 1.0: the plugin is on Bitbucket and comes to Packagist once 1.0 is out. Security and compatibility fixes until at least December 2032.

Works with the rest of the range

Plugins of the range detect each other and connect automatically when they are installed together, for example newsletter sign-ups from the launch page or encyclopedia pages as a dimension in Analytics. Each plugin also works on its own; nothing is gated behind buying another one.

Requirements

  • Shopware: 6.7
  • PHP: 8.2+

Support

Through the issues of the Bitbucket repository; security reports as described in the repository's SECURITY.md.

Data and privacy

For each login link sent, the plugin stores only a hash of the token, the customer ID, the sales channel and the expiry time (and when the link was used) — no IP address, no user agent and no copy of the email address. Expired links are cleaned up automatically, and all of a customer's links are deleted together with the customer. Against abuse, Shopware keeps a short-lived counter per address and IP in its cache. The mail goes out through your own shop's mail settings; no third party is involved.

Quality

PHPStan level 8, PHPUnit and PHP-CS-Fixer as quality gates per repository. Documentation, changelogs and snippets in Dutch, English and German. No advertisements or upgrade prompts inside the Shopware Administration.

The other families in the range

Curious what is possible?

One conversation is usually enough to tell whether it fits. A reply within 24 hours, and no middlemen.

  • A reply within 24 hours, always personal
  • Half an hour on the phone gets you the order of magnitude
  • A first conversation without obligation
  • Including software originally built by someone else