GraphQL / Headless login

The Social Login extension for Magento 2 lets customers sign in with Google, Facebook, and your other configured providers from a headless or PWA storefront through the GraphQL API. Accounts are created and linked exactly as they are in the standard storefront login.

This page is for developers integrating social login into a headless frontend. Before you start, configure the Headless callback URL in the GraphQL settings group.

How it works

The sign-in is a browser round-trip to the social provider, followed by a token exchange:

1. Your storefront queries mstSocialLoginProviders and renders a sign-in link for each returned provider using its authUrl.
2. The customer opens the authUrl and authenticates with the provider. The extension creates or links the Magento customer account server-side — no PHP login session is created for the storefront.
3. The extension redirects the browser back to your configured Headless callback URL, appending a one-time code: ?mst_social_nonce=<nonce>.
4. Your storefront reads the mst_social_nonce value from the URL and sends it to the mstSocialLogin mutation.
5. The mutation returns a Magento customer token. Use it as an Authorization: Bearer <token> header for subsequent customer requests.

note

The one-time code is single-use and expires after the Nonce lifetime configured in the admin (default 120 seconds). Exchange it as soon as your storefront loads the callback URL.

---

mstSocialLoginProviders query

Returns the social-login providers enabled for the current store. Returns an empty list when the extension is disabled.

{
  mstSocialLoginProviders {
    code
    label
    position
    authUrl
  }
}

Response fields

Field	Description	Type
code	Provider code, e.g. google, facebook.	String
label	Human-readable provider name for the button.	String
position	Sort position, ascending.	Int
authUrl	Server route the storefront opens to begin the provider sign-in in headless mode.	String

---

mstSocialLogin mutation

Exchanges the one-time code from the callback URL for a Magento customer token.

mutation {
  mstSocialLogin(input: { nonce: "<mst_social_nonce from the callback URL>" }) {
    token
    customer {
      firstname
      lastname
      email
    }
  }
}

Input

Parameter	Description	Type	Required
nonce	The one-time code delivered to the callback URL as ?mst_social_nonce=....	String	Yes

Response fields

Field	Description	Type
token	A Magento customer bearer token, usable as Authorization: Bearer <token>.	String
customer	The authenticated customer (standard GraphQL Customer type).	Customer

warning

A missing, invalid, or already-used code returns an input error such as "The social login session is invalid or has expired. Please sign in again." Restart the flow from the mstSocialLoginProviders query to obtain a fresh code.