Planned maintenance: Tue Dec 8, 11:30pm–12:30am ET (8:30–9:30pm PT / Wed 5:30–6:30am CET). Brief downtime possible (up to 15 minutes).

Status page
Skip to main content

How can we help?

Need help? Check out our documentation or contact support

Search

Set up X social sign-on

  • Updated

Create an X (Twitter) developer project and app, enable OAuth 1.0a user authentication with Bevy’s callback URLs, then send the API Key and API Key Secret to Bevy over a secure channel so members can sign in with X.

Bevy can show a Sign in with X button on your community login and signup pages (some surfaces still say Twitter). Members authenticate with X; Bevy then creates or signs in their community account.

Note: This page is for technical admins who create the X developer app. For which social providers you can enable, see Introduction to social sign-on. Enterprise workplace SSO (Okta, Auth0, SAML, and similar) is separate — see Introduction to single sign-on. Members who use enterprise SSO follow Sign-in with single sign-on (SSO).

Tip: This setup is for X login only. It is not the X (Twitter) ads pixel or conversion tracking. Community X Pixel ID lives on Third-party services. Sibling providers: Set up Google social sign-on, Set up LinkedIn social sign-on, Set up Facebook social sign-on.

Before you start

  • Access to the X Developer Portal for an account that can create or edit a project and app for your organization.
  • Your Bevy community hostname (and staging or onboarding hostnames if Bevy asks you to whitelist them).
  • A privacy policy URL and terms of service URL if the portal requires them before you can save user authentication settings.
  • A secure way to share the API Key and API Key Secret with Bevy (for example a password manager share or encrypted message — not email in plain text).

Note: X may still label screens, keys, or Help Center URLs as Twitter. Bevy’s callback path keeps the provider id twitter — use /accounts/twitter/login/callback/ even when the button says X.

Create an X developer project and app

  1. Open the X Developer Portal and complete any developer onboarding X requires for your account.
  2. Create a Project (or open an existing one). A clear name such as Bevy Social Sign On works well.
  3. Create an App inside that project. Name it so your team can recognize it later.
  4. When the portal shows keys for the new app, you can copy them now or find them later under Keys and tokens — Bevy needs the OAuth 1.0a API Key and API Key Secret (sometimes labeled Consumer Key / Consumer Secret).

Tip: X developer plans, product names, and portal labels change over time. You do not need a separate “Elevated” product for Bevy login. You do need an app that can open User authentication settings and enable OAuth 1.0a. If X blocks that until you finish onboarding or select a current access plan, complete X’s requirement first, then continue here.

Configure user authentication (OAuth 1.0a)

  1. Open the app’s Settings (or equivalent) and find User authentication settings. Choose Set up or Edit.
  2. Enable OAuth 1.0a. Bevy social sign-on uses OAuth 1.0a only — do not rely on OAuth 2.0 Client ID / Client Secret for this integration.
  3. Set App permissions to at least Read (read-only is enough for sign-in). You do not need Write or Direct Messages for Bevy login.
  4. For Type of App, choose the web / confidential option X offers for a website redirect flow (often labeled Web App, Automated App or Bot).
  5. In Website URL, enter your final Bevy community URL (for example https://<your-community-domain>/).
  6. Add any Terms of Service URL and Privacy Policy URL the form requires, then continue to the callback URLs below before you save.

Important: If you only enable OAuth 2.0, or you send Bevy the OAuth 2.0 Client ID and Client Secret instead of the OAuth 1.0a API Key pair, Bevy cannot complete X social sign-on.

Add Callback URI / Redirect URL

Still under User authentication settings, add Bevy’s X callback path to Callback URI / Redirect URL for each hostname Bevy asks you to cover. Match the path exactly, including the trailing slash:

Environment Callback URI / Redirect URL
Bevy test / staging sandbox https://<instance-id>-staging.bevylabs.com/accounts/twitter/login/callback/
Onboarding instance https://<instance-id>.bevylabs.com/accounts/twitter/login/callback/
Production community domain https://<your-community-domain>/accounts/twitter/login/callback/

<instance-id> is the same ID used in your *.bevylabs.com subdomain. If you are unsure what it is, ask your Bevy contact or Bevy Support. <your-community-domain> is the final hostname members use when the community is live.

Important: A missing trailing slash, the wrong provider path (for example /accounts/x/… or /accounts/oauth/…), or a URI that does not match the hostname members use will fail X’s redirect check. Save User authentication settings after you add each URI.

Tip: If Bevy only asks you to enable X on production first, start with the production callback URI. Add staging or onboarding rows when Bevy requests them.

Find your API Key and API Key Secret

  1. Open X Developer Portal — Projects & Apps and select the app you created.
  2. Open the Keys and tokens tab (or the key icon on the app).
  3. Copy the API Key and API Key Secret (Consumer Key / Consumer Secret). Regenerate the secret only if you must — then send Bevy the new values.

Note: Do not send Bevy the per-user Access Token and Access Token Secret for this setup, and do not send the OAuth 2.0 Client ID / Client Secret. Bevy configures the consumer API Key pair on the community side.

What to share with Bevy

Copy these values and send them over a secure channel to your Bevy onboarding contact or Bevy Support:

Item Required? What Bevy uses it for
API Key (Consumer Key) Required Identifies your X (Twitter) app.
API Key Secret (Consumer Secret) Required Authenticates the Bevy application to X. Share only over a secure channel.
Hostnames you whitelisted Recommended Confirm which environments (staging, onboarding, production) already have matching Callback URIs.

Important: Treat the API Key Secret like a password. Bevy configures X login on the community side — admins do not paste the secret into a public community settings screen.

After Bevy enables X

  • An X (or Twitter) button appears on the community login and signup pages (placement relative to the email form follows your community’s login settings).
  • Members authenticate at X, then return to Bevy on /accounts/twitter/login/callback/.
  • Password resets for an X sign-in path belong in the member’s X account — not on Bevy’s Reset password page.

Note: If login fails after enablement, confirm OAuth 1.0a is on, the Callback URI matches exactly (including the trailing slash), and Bevy has the current API Key pair — not OAuth 2.0 credentials. Then contact Bevy Support before changing other portal settings.