Guides

OAuth providers, OTP, Magic Link & CAPTCHA

Mudbase supports 30 OAuth/social login providers, plus OTP and Magic Link sign-in, all configured per project. Every provider works the same way — this page is the reference for each one, plus the two passwordless methods and CAPTCHA.

All of this is also configurable from Console → Auth Settings without touching the API directly; the request/response shapes below are what the console calls under the hood, and what you'd use if you're configuring auth from your own backend or CI instead of the console.

How it works

Every provider — OAuth, OTP, or Magic Link — is configured with the same endpoint:

HTTP
POST /api/auth/oauth/projects/{projectId}/providers/{provider}
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": true,
  "displayName": "Sign in with Google",
  "scope": ["profile", "email"],
  "clientId": "...",
  "clientSecret": "..."
}
POST /api/auth/oauth/projects/{projectId}/providers/{provider}
Authorization: Bearer {token}
Content-Type: application/json

{
  "enabled": true,
  "displayName": "Sign in with Google",
  "scope": ["profile", "email"],
  "clientId": "...",
  "clientSecret": "..."
}

clientId/clientSecret (or whatever fields a given provider needs — see each section below) are stored encrypted, scoped to your project. GET /api/auth/oauth/projects/{projectId}/providers/{provider} returns the config back with secrets stripped, so you can always confirm what's saved without re-entering it.

Once a provider is enabled, send end users to:

HTTP
GET /api/auth/oauth/{provider}/{projectId}?redirect_url=https://your-app.com/after-login
GET /api/auth/oauth/{provider}/{projectId}?redirect_url=https://your-app.com/after-login

Mudbase handles the provider's OAuth dance (including CSRF state verification) and redirects back to redirect_url with the session established. The callback URL you register with the provider itself is always the same, global URL for that provider — it does not include your project ID (Mudbase tracks project context internally, not through the callback path):

Text
https://api.mudbase.dev/api/auth/oauth/callback/{provider}
https://api.mudbase.dev/api/auth/oauth/callback/{provider}

Substitute {provider} for the exact slug from each section below (e.g. google, github, microsoft).

Google

Sign-in with Google is the highest-conversion social login for most consumer apps.

  1. Go to the Google Cloud Console credentials page (create a project first if you don't have one).
  2. Create Credentials → OAuth client ID. Application type: Web application.
  3. Under Authorized redirect URIs, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/google
  4. Save. Copy the Client ID and Client secret.
  5. If this is your first OAuth client in this Google Cloud project, you'll also need to configure the OAuth consent screen (app name, support email, scopes) — Google walks you through it before it lets you create the client ID.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Google",
  "scope": ["profile", "email"],
  "clientId": "xxxxx.apps.googleusercontent.com",
  "clientSecret": "GOCSPX-xxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Google",
  "scope": ["profile", "email"],
  "clientId": "xxxxx.apps.googleusercontent.com",
  "clientSecret": "GOCSPX-xxxxxxxxxxxxxxxxxxxxxxxx"
}

GitHub

Good default for developer tools, technical products, and internal apps.

  1. Go to GitHub → Settings → Developer settings → OAuth Apps → New OAuth App.
  2. Authorization callback URL: 
    https://api.mudbase.dev/api/auth/oauth/callback/github
  3. Register the app, then Generate a new client secret. GitHub shows the secret once — copy it immediately.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with GitHub",
  "scope": ["user:email"],
  "clientId": "Iv1.xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with GitHub",
  "scope": ["user:email"],
  "clientId": "Iv1.xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Facebook

  1. Go to Meta for Developers → My Apps → Create App → choose Consumer or Business use case.
  2. Add the Facebook Login product.
  3. In Facebook Login → Settings, add to Valid OAuth Redirect URIs: 
    https://api.mudbase.dev/api/auth/oauth/callback/facebook
  4. Under App Settings → Basic, copy the App ID and App Secret.
  5. To go live for real users (not just admins/testers), submit the app for App Review requesting the email permission.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase (note the field names — Facebook's own terms, App ID / App Secret):

JSON
{
  "enabled": true,
  "displayName": "Sign in with Facebook",
  "scope": ["email"],
  "clientId": "your-app-id",
  "clientSecret": "your-app-secret"
}
{
  "enabled": true,
  "displayName": "Sign in with Facebook",
  "scope": ["email"],
  "clientId": "your-app-id",
  "clientSecret": "your-app-secret"
}

Microsoft

Covers both personal Microsoft accounts and Entra ID (Azure AD) work/school accounts, depending on how you configure the app registration.

  1. Go to Microsoft Entra admin center → App registrations (or Azure Portal → App registrations) → New registration.
  2. Under Supported account types, pick the audience you want (personal accounts, a single org, or any org + personal — this affects who can sign in, not the OAuth mechanics below).
  3. Under Redirect URI, platform Web: 
    https://api.mudbase.dev/api/auth/oauth/callback/microsoft
  4. After registration, copy the Application (client) ID from the Overview page.
  5. Go to Certificates & secrets → New client secret, copy the Value immediately (it's hidden after you leave the page).

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Microsoft",
  "scope": ["user.read"],
  "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "clientSecret": "xxx~xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Microsoft",
  "scope": ["user.read"],
  "clientId": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "clientSecret": "xxx~xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Discord

Common for gaming, community, and creator products.

  1. Go to Discord Developer Portal → New Application.
  2. Open the OAuth2 tab → Redirects → add: 
    https://api.mudbase.dev/api/auth/oauth/callback/discord
  3. Copy the Client ID from the General Information page, and generate/copy the Client Secret from OAuth2 → General.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Discord",
  "scope": ["identify", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Discord",
  "scope": ["identify", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Apple ("Sign in with Apple")

The most involved of the major providers — Apple requires a Services ID (not just an App ID) and a private key rather than a client secret string.

  1. In Apple Developer → Certificates, Identifiers & Profiles, register an App ID if you don't already have one for your org (Identifiers → + → App IDs), with the Sign in with Apple capability turned on.
  2. Register a Services ID (Identifiers → + → Services IDs) — this is the identifier you'll actually use as clientId. Enable Sign in with Apple on it, and configure its domains/redirect URLs: 
    https://api.mudbase.dev/api/auth/oauth/callback/apple
  3. Under Keys, create a new key with Sign in with Apple enabled, associated with your App ID. Download the .p8 key file immediately — Apple only lets you download it once. Note the Key ID shown on the key's page.
  4. Note your Team ID (top-right of the Apple Developer account page, or Membership details).

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase — privateKey is the full contents of the downloaded .p8 file:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Apple",
  "scope": ["name", "email"],
  "clientId": "com.yourcompany.yourapp.service",
  "teamId": "XXXXXXXXXX",
  "keyId": "XXXXXXXXXX",
  "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
}
{
  "enabled": true,
  "displayName": "Sign in with Apple",
  "scope": ["name", "email"],
  "clientId": "com.yourcompany.yourapp.service",
  "teamId": "XXXXXXXXXX",
  "keyId": "XXXXXXXXXX",
  "privateKey": "-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
}

Slack

  1. Go to api.slack.com/apps → Create New App → From scratch.
  2. Under OAuth & Permissions, add to Redirect URLs: 
    https://api.mudbase.dev/api/auth/oauth/callback/slack
  3. Copy the Client ID and Client Secret from Basic Information → App Credentials.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Slack",
  "scope": ["identity.basic", "identity.email"],
  "clientId": "xxxxxxxxxxxx.xxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Slack",
  "scope": ["identity.basic", "identity.email"],
  "clientId": "xxxxxxxxxxxx.xxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

LinkedIn

  1. Go to LinkedIn Developers → My Apps → Create app.
  2. Under the Auth tab, add to Authorized redirect URLs for your app: 
    https://api.mudbase.dev/api/auth/oauth/callback/linkedin
  3. Request access to the Sign In with LinkedIn using OpenID Connect product (self-serve, usually instant approval).
  4. Copy the Client ID and Client Secret from the Auth tab.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with LinkedIn",
  "scope": ["r_liteprofile", "r_emailaddress"],
  "clientId": "xxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with LinkedIn",
  "scope": ["r_liteprofile", "r_emailaddress"],
  "clientId": "xxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxx"
}

Spotify

Useful for music/media apps that want to read a listener's profile.

  1. Go to Spotify Developer Dashboard → Create app.
  2. In the app's settings, add to Redirect URIs: 
    https://api.mudbase.dev/api/auth/oauth/callback/spotify
  3. Copy the Client ID and Client secret from the app's Basic Information page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Spotify",
  "scope": ["user-read-email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Spotify",
  "scope": ["user-read-email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Twitch

  1. Go to Twitch Developer Console → Applications → Register Your Application.
  2. OAuth Redirect URLs: 
    https://api.mudbase.dev/api/auth/oauth/callback/twitch
  3. Category: Website Integration. After creating, copy the Client ID, then New Secret to generate the Client Secret.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Twitch",
  "scope": ["user:read:email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Twitch",
  "scope": ["user:read:email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Twitter / X

OAuth 1.0a (not the OAuth2 flow every other provider on this page uses) — no state/CSRF param at all, since the request-token exchange itself is the protection.

  1. Go to the X Developer Portal → create a Project and App if you don't have one.
  2. In the app's User authentication settings, enable OAuth 1.0a and set the Callback URI: 
    https://api.mudbase.dev/api/auth/oauth/callback/twitter
  3. Under Keys and tokens, copy the API Key and API Key Secret — these map to consumerKey/consumerSecret below (X calls the app itself an "API Key", not a client ID).

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with X",
  "consumerKey": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "consumerSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with X",
  "consumerKey": "xxxxxxxxxxxxxxxxxxxxxxxxx",
  "consumerSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Shopify

For apps that let merchants sign in with their Shopify store.

  1. Go to the Shopify Partner Dashboard → Apps → Create app (choose a Custom app or Public app depending on distribution).
  2. Under App setup → URLs, add to Allowed redirection URL(s): 
    https://api.mudbase.dev/api/auth/oauth/callback/shopify
  3. Copy the Client ID and Client secret from the app's API credentials page.
  4. Note the merchant's shop domain (yourstore.myshopify.com) — Shopify's OAuth flow is scoped per-store, so shop identifies which store the sign-in is against.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Shopify",
  "scope": ["read_products", "read_orders"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "shop": "yourstore.myshopify.com"
}
{
  "enabled": true,
  "displayName": "Sign in with Shopify",
  "scope": ["read_products", "read_orders"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "shop": "yourstore.myshopify.com"
}

Dropbox

  1. Go to the Dropbox App Console → Create app → choose Scoped access.
  2. Under OAuth 2 → Redirect URIs, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/dropbox
  3. Copy the App key and App secret from the app's Settings tab.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase (Dropbox's "App key"/"App secret" map to clientId/clientSecret):

JSON
{
  "enabled": true,
  "displayName": "Sign in with Dropbox",
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Dropbox",
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxx"
}

Reddit

  1. Go to reddit.com/prefs/apps → create another app....
  2. App type: web app. redirect uri: 
    https://api.mudbase.dev/api/auth/oauth/callback/reddit
  3. After creating, the Client ID is the string under the app's name; click edit to reveal the secret.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Reddit",
  "scope": ["identity"],
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Reddit",
  "scope": ["identity"],
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

PayPal

Sign-in via PayPal's OpenID Connect, distinct from PayPal as a payment method.

  1. Go to the PayPal Developer Dashboard → Apps & Credentials → Create App.
  2. Under the app's Sign in with PayPal section, enable it and add to Return URL: 
    https://api.mudbase.dev/api/auth/oauth/callback/paypal
  3. Copy the Client ID and Secret. Toggle between the Sandbox and Live tabs to get test vs. real credentials — this is what sandbox below controls.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API.

Configure in Mudbase:

JSON
{
  "enabled": true,
  "displayName": "Sign in with PayPal",
  "scope": ["openid", "profile", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "sandbox": true
}
{
  "enabled": true,
  "displayName": "Sign in with PayPal",
  "scope": ["openid", "profile", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "sandbox": true
}

Zoom

  1. Go to the Zoom App Marketplace → Build App → choose OAuth app type.
  2. Under Redirect URL for OAuth, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/zoom
  3. Copy the Client ID and Client Secret from the app's Basic Information page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API — Zoom's authorization/token endpoints are fixed, Mudbase already knows them, you only need to supply credentials:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Zoom",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Zoom",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxx"
}

Bitbucket

  1. Go to your Bitbucket workspace → Settings → OAuth consumers (bitbucket.org/{workspace}/workspace/settings/oauth-consumers) → Add consumer.
  2. Callback URL: 
    https://api.mudbase.dev/api/auth/oauth/callback/bitbucket
  3. Grant the Account: Read and Email: Read permissions. Save, then copy the Key and Secret shown on the consumer's page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Bitbucket",
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Bitbucket",
  "clientId": "xxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Salesforce

  1. In your Salesforce org, go to Setup → App Manager → New Connected App.
  2. Enable OAuth Settings, and under Callback URL add: 
    https://api.mudbase.dev/api/auth/oauth/callback/salesforce
  3. Add the OAuth scopes you need (at minimum id and api). Save — Salesforce takes a few minutes to activate a new Connected App.
  4. Copy the Consumer Key and Consumer Secret from the app's Manage Consumer Details page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API (Salesforce's "Consumer Key"/"Consumer Secret" map to clientId/clientSecret):

JSON
{
  "enabled": true,
  "displayName": "Sign in with Salesforce",
  "scope": ["id", "api"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Salesforce",
  "scope": ["id", "api"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

LINE

Popular for consumer apps in Japan, Thailand, and Taiwan.

  1. Go to the LINE Developers Console → create a Provider, then a LINE Login channel under it.
  2. In the channel's LINE Login settings, add to Callback URL: 
    https://api.mudbase.dev/api/auth/oauth/callback/line
  3. Copy the Channel ID and Channel secret from the channel's Basic settings tab.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with LINE",
  "scope": ["profile", "openid", "email"],
  "channelId": "xxxxxxxxxx",
  "channelSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with LINE",
  "scope": ["profile", "openid", "email"],
  "channelId": "xxxxxxxxxx",
  "channelSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Strava

For fitness/activity apps that want to read a member's Strava profile.

  1. Go to strava.com/settings/api and create an API application (one per Strava account).
  2. Set the Authorization Callback Domain to api.mudbase.dev — Strava only accepts a bare domain here, not a full path. The actual callback Mudbase uses under that domain is: 
    https://api.mudbase.dev/api/auth/oauth/callback/strava
  3. Copy the Client ID and Client Secret from the app's settings page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Strava",
  "scope": ["read"],
  "clientId": "xxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Strava",
  "scope": ["read"],
  "clientId": "xxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Asana

  1. Go to app.asana.com/0/developer-console → + Create new app.
  2. Under OAuth, add to Redirect URL(s): 
    https://api.mudbase.dev/api/auth/oauth/callback/asana
  3. Copy the Client ID and Client Secret from the app's OAuth tab.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Asana",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Asana",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Trello

OAuth 1.0a, like Twitter/X — no state param, the request-token exchange is the CSRF protection.

  1. Go to trello.com/power-ups/admin → create a Power-Up (Trello's OAuth apps are managed as Power-Ups even if you're not building a board integration).
  2. Under the Power-Up's API Key tab, generate a key — this is your consumerKey. Click generate a new secret for consumerSecret.
  3. There's no separate callback-URL field to fill in for Trello — Trello sends the callback to whatever redirect URI the OAuth1 request itself specifies, which Mudbase sets to: 
    https://api.mudbase.dev/api/auth/oauth/callback/trello

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Trello",
  "scope": ["read", "write"],
  "consumerKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "consumerSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Trello",
  "scope": ["read", "write"],
  "consumerKey": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "consumerSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Okta

For enterprise apps authenticating against a customer's own Okta workforce or CIC directory. Configuration is org-specific — there's no universal Okta URL, since every customer has their own Okta domain.

  1. In your Okta org's admin console (https://{your-org}.okta.com/admin), go to Applications → Create App Integration → OIDC – OpenID Connect → Web Application.
  2. Under Sign-in redirect URIs, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/okta
  3. Copy the Client ID and Client secret from the app's General tab.
  4. Note your Okta domain (e.g. your-org.okta.com) and the audience (your Authorization Server's audience, typically api://default unless you've configured a custom one) — Okta's strategy needs both in addition to the credentials.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Okta",
  "scope": ["openid", "profile", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "domain": "your-org.okta.com",
  "audience": "api://default"
}
{
  "enabled": true,
  "displayName": "Sign in with Okta",
  "scope": ["openid", "profile", "email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "domain": "your-org.okta.com",
  "audience": "api://default"
}

Figma

  1. Go to figma.com/developers/apps → Create a new app.
  2. Add to Callback URLs: 
    https://api.mudbase.dev/api/auth/oauth/callback/figma
  3. Copy the Client ID and Client secret. Figma's authorization/token endpoints are fixed (figma.com/oauth and api.figma.com/v1/oauth/token) — Mudbase already defaults to them, so you generally don't need to supply authorizationURL/tokenURL yourself unless Figma changes them.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Figma",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Figma",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Gitea

For teams running their own self-hosted Gitea instance. There's no universal URL — everything below happens on your own instance's domain.

  1. On your Gitea instance, sign in and go to Settings → Applications → Manage OAuth2 Applications.
  2. Under Redirect URIs, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/gitea
  3. Copy the Client ID and generate a Client Secret — Gitea, like GitHub, shows the secret once.
  4. Note your instance's base URL (e.g. https://git.yourcompany.com) — this is required so Mudbase knows which Gitea instance to talk to.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Gitea",
  "scope": ["user:email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "url": "https://git.yourcompany.com"
}
{
  "enabled": true,
  "displayName": "Sign in with Gitea",
  "scope": ["user:email"],
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "url": "https://git.yourcompany.com"
}

Yandex

Common for apps targeting Russian-speaking users.

  1. Go to oauth.yandex.com/client/new and create a new OAuth app.
  2. Under Redirect URI, add: 
    https://api.mudbase.dev/api/auth/oauth/callback/yandex
  3. Copy the ID (Client ID) and Password (Client Secret) from the app's page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Yandex",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Yandex",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Yahoo

  1. Go to developer.yahoo.com/apps → Create an App.
  2. Under Redirect URI(s), add: 
    https://api.mudbase.dev/api/auth/oauth/callback/yahoo
  3. Request the OpenID Connect Permissions (profile/email). Copy the Client ID and Client Secret from the app's details page.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Yahoo",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Yahoo",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

VK

Popular for apps targeting users in Russia and the CIS.

  1. Go to vk.com/apps?act=manage → Create app → type Website.
  2. Under the app's Settings, set the Authorized redirect URI: 
    https://api.mudbase.dev/api/auth/oauth/callback/vk
  3. Copy the App ID (Client ID) and Secure key (Client Secret) from the Settings tab.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with VK",
  "scope": ["email"],
  "clientId": "xxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with VK",
  "scope": ["email"],
  "clientId": "xxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

Meetup

  1. Go to meetup.com/api/oauth/list → Create New OAuth Consumer.
  2. Set the Redirect URI: 
    https://api.mudbase.dev/api/auth/oauth/callback/meetup
  3. Copy the Client ID and Client Secret shown after creating the consumer.

Toggle this on and paste your credentials from Console → Auth Settings, or configure it directly with the API:

JSON
{
  "enabled": true,
  "displayName": "Sign in with Meetup",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}
{
  "enabled": true,
  "displayName": "Sign in with Meetup",
  "clientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "clientSecret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
}

OTP (one-time code) sign-in

Lets end users sign in with a one-time code sent by email or SMS instead of a password — no external provider account needed, Mudbase sends the code itself. Toggle it on from Console → Auth Settings, or directly:

HTTP
POST /api/auth/oauth/projects/{projectId}/providers/otp
Content-Type: application/json

{ "enabled": true, "displayName": "OTP" }
POST /api/auth/oauth/projects/{projectId}/providers/otp
Content-Type: application/json

{ "enabled": true, "displayName": "OTP" }

Once enabled, request and verify a code:

HTTP
POST /api/auth/otp/request
Content-Type: application/json

{ "projectId": "...", "identifier": "user@example.com" }
POST /api/auth/otp/request
Content-Type: application/json

{ "projectId": "...", "identifier": "user@example.com" }
HTTP
POST /api/auth/otp/verify
Content-Type: application/json

{ "projectId": "...", "identifier": "user@example.com", "code": "482913" }
POST /api/auth/otp/verify
Content-Type: application/json

{ "projectId": "...", "identifier": "user@example.com", "code": "482913" }

Codes are 6 digits, single-use, and expire after 5 minutes.

Magic Link sign-in

Same idea as OTP, but the user clicks a one-time link instead of typing a code — no password, no external provider.

HTTP
POST /api/auth/oauth/projects/{projectId}/providers/magic-link
Content-Type: application/json

{ "enabled": true, "displayName": "Magic Link" }
POST /api/auth/oauth/projects/{projectId}/providers/magic-link
Content-Type: application/json

{ "enabled": true, "displayName": "Magic Link" }
HTTP
POST /api/auth/magic-link/request
Content-Type: application/json

{ "projectId": "...", "email": "user@example.com" }
POST /api/auth/magic-link/request
Content-Type: application/json

{ "projectId": "...", "email": "user@example.com" }

The email contains a link back to your app; exchange the token it carries for a session:

HTTP
POST /api/auth/magic-link/verify
Content-Type: application/json

{ "projectId": "...", "token": "..." }
POST /api/auth/magic-link/verify
Content-Type: application/json

{ "projectId": "...", "token": "..." }

CAPTCHA

Challenges sign-up/sign-in with Google reCAPTCHA (v2 checkbox or v3 invisible score-based) before it's accepted. Unlike the providers above, this requires your own reCAPTCHA site key and secret key — Mudbase doesn't provide a shared one for your project's end users.

  1. Go to the reCAPTCHA admin console → + to register a new site.
  2. Pick reCAPTCHA v3 (recommended — invisible, scores each request 0–1) or v2 (visible "I'm not a robot" checkbox).
  3. Add the domain(s) your app's sign-up/sign-in pages run on.
  4. Copy the Site key and Secret key.

Configure from Console → Auth Settings → CAPTCHA, or directly:

HTTP
PATCH /api/projects/{orgId}/projects/{projectId}
Content-Type: application/json

{
  "auth": {
    "captcha": {
      "enabled": true,
      "version": "v3",
      "siteKey": "6Lc...",
      "secretKey": "6Lc...",
      "minScore": 0.5
    }
  }
}
PATCH /api/projects/{orgId}/projects/{projectId}
Content-Type: application/json

{
  "auth": {
    "captcha": {
      "enabled": true,
      "version": "v3",
      "siteKey": "6Lc...",
      "secretKey": "6Lc...",
      "minScore": 0.5
    }
  }
}

minScore only applies to v3 — requests scoring below it are rejected. secretKey is never returned by the API once saved; omit it from later updates to keep the existing one (only include it when you're actually changing it).