> **Can't find what you're looking for?** Use `search_docs` on the docs MCP server at `https://www.openfort.io/api/mcp` to find what you need.
>
> **Have feedback?** Use `submit_feedback` on the same MCP server.

# Using a third-party auth provider

Openfort's signer solution enables user onboarding by integrating with backend solutions and authentication providers that support JWT-based authentication.

Use this when your users already exist somewhere else and you don't want to migrate them. Your provider stays the source of truth for identity; Openfort verifies the token it issues and links an embedded wallet to that user's identifier. If you'd rather have Openfort own login, use [social login](https://www.openfort.io/docs/configuration/social-login), [password auth](https://www.openfort.io/docs/configuration/password/security), or [wallet auth](https://www.openfort.io/docs/configuration/wallet-auth) instead.

:::warning
With third-party auth you build your own login UI. Openfort's built-in UI components, such as `OpenfortButton`, and the `uiConfig` settings in `OpenfortProvider` apply to Openfort-managed authentication only.
:::

## Prerequisites

* A provider enabled and configured in [Providers](https://dashboard.openfort.io/providers) in the dashboard.
* Your [publishable key](https://www.openfort.io/docs/configuration/api-keys) for the client, plus the Shield keys if the app issues embedded wallets.
* A way to read the current provider token on the client, such as Firebase's `getIdToken()`. The SDKs call it on demand through `getAccessToken`.

## Third-party auth platforms

With this approach, Openfort creates **embedded wallets** on the client and follows the necessary security steps to ensure the smart wallet remains non-custodial.

* **[PlayFab](https://www.openfort.io/docs/configuration/external-auth/playfab)**
* **[Firebase](https://www.openfort.io/docs/configuration/external-auth/firebase)**
* **[Better-Auth](https://www.openfort.io/docs/configuration/external-auth/better-auth)**
* **[Accelbyte](https://www.openfort.io/docs/configuration/external-auth/accelbyte)**
* **[Lootlocker](https://www.openfort.io/docs/configuration/external-auth/lootlocker)**
* **[Supabase](https://www.openfort.io/docs/configuration/external-auth/supabase)**

## Custom auth methods

Openfort offers two options to set up embedded signers with custom auth: one based on the [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC) standard, and a generic option that lets you bring your own auth server.

* **[Custom OIDC Token](https://www.openfort.io/docs/configuration/custom-auth/oidc-token)**
* **[Custom Auth Token](https://www.openfort.io/docs/configuration/custom-auth/auth-token)**

## What each provider needs

Every provider config carries an `enabled` flag and a `provider` value. The rest of the fields differ:

| Provider | `ThirdPartyOAuthProvider` value | Required configuration |
| --- | --- | --- |
| PlayFab | `PLAYFAB` | Title ID |
| Firebase | `FIREBASE` | Project ID |
| Better-Auth | `BETTER_AUTH` | Base URL of the Better Auth instance |
| Supabase | `SUPABASE` | Project URL and API key |
| AccelByte | `ACCELBYTE` | Base URL, client ID, and client secret |
| LootLocker | `LOOTLOCKER` | None beyond enabling it |
| Custom OIDC | `OIDC` | Audience (`aud`), plus a JWKS URL or a PEM-encoded public key |
| Custom auth | `CUSTOM` | Authentication URL, and optional headers to send with the verification request |

## Authenticate a user

In the client SDKs, pass `thirdPartyAuth` when you initialize Openfort, then call `getAccessToken` after your provider signs the user in and sign out of Openfort when your provider signs them out. See [Using your own authentication](https://www.openfort.io/docs/products/embedded-wallet/react/auth/third-party) for React, or [Third-party auth providers](https://www.openfort.io/docs/products/embedded-wallet/javascript/auth/external-auth) for the JavaScript SDK.

Server-side, the same exchange is three headers on an API call — the publishable key, the provider name, and the provider's token:

```bash
curl https://api.openfort.io/v1/... \
  -H "Authorization: Bearer pk_test_..." \
  -H "x-auth-provider: firebase" \
  -H "x-player-token: <provider-token>"
```

## Next steps

* [Authentication](https://www.openfort.io/docs/api-reference/authentication) — every credential type the API accepts, and how they combine.
* [Provider migration](https://www.openfort.io/docs/configuration/migration) — move existing users from one provider to another.
* [Recovery methods](https://www.openfort.io/docs/configuration/recovery-methods) — decide how the embedded wallet's recovery share is encrypted.