> ## Documentation Index
> Fetch the complete documentation index at: https://stytch.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth overview

> Identity providers (IdPs), like Google, Apple, and GitHub, maintain user identity information and offer authentication services to developers and applications, so called relying parties.

<img src="https://mintcdn.com/stytch-34ca0595/jCmOQoXV28mXNOhP/images/consumer/from-old-docs/oauth-diagram-light.svg?fit=max&auto=format&n=jCmOQoXV28mXNOhP&q=85&s=b823527aef27dcc2371545db21311a74" alt="OAuth consent start screen" width="1463" height="612" data-path="images/consumer/from-old-docs/oauth-diagram-light.svg" />

This lets your users use a Single Sign-On (SSO) to login to your app without going through the extra step of creating an identity directly with your app.

In addition to offering identity management, IdPs often expose extensive functionality in their platform via API, e.g. reading and creating Google Calendar events or creating repos within GitHub. When you use Stytch OAuth, we automatically initiate a session with the IdP and return the necessary tokens to build on top of the provider's API.

## Identity provider details

Even though OAuth is a standard, IdPs can sometimes vary in data models and nomenclature within their own implementations. Stytch normalizes values and behavior as much as possible to ensure that you have a smooth integration with whichever providers you use.

The list below lists each OAuth provider we support and lets you know which values you should expect to see returned for each provider and the default session length. "—" indicates that the value is not applicable to the provider in question.

| Provider        | `access_token` | `refresh_token` | `jwt`      | Session length |
| --------------- | -------------- | --------------- | ---------- | -------------- |
| Google          | Returned       | Returned        | Returned\* | 1 hour         |
| Amazon          | Returned       | Returned        | —          | 24 hours       |
| Apple           | Returned       | Returned        | —          | Until revoked  |
| Bitbucket       | Returned       | Returned        | —          | 2 hours        |
| Coinbase        | Returned       | Returned        | —          | 2 hours        |
| Discord         | Returned       | Returned        | —          | 7 days         |
| Facebook (Meta) | Returned       | —               | —          | 2 months       |
| GitHub          | Returned       | —               | —          | Until revoked  |
| GitLab          | Returned       | Returned        | —          | 2 hours        |
| LinkedIn        | Returned       | Returned        | —          | 60 days        |
| Microsoft       | Returned       | Returned\*      | —          | 60-90 minutes  |
| Salesforce      | Returned       | —               | —          | Until revoked  |
| Slack           | Returned       | —               | —          | Until revoked  |
| Twitch          | Returned       | Returned        | —          | 60 days        |
| Yahoo           | Returned       | Returned        | Returned   | 1 hour         |

<AccordionGroup>
  <Accordion title="Google">
    Google offers two pathways for a user to authenticate, a traditional OAuth flow with a consent pane, or via Google One Tap. If a user enters through the Google One Tap flow, you will only receive a `jwt` and no `access_token` or `refresh_token`; you will not be able to leverage Google's API.

    **Default Scopes**

    * `open_id`
    * `email`
    * `profile`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/google)
    * [Gmail API documentation](https://developers.google.com/gmail/api/reference/rest)
  </Accordion>

  <Accordion title="Amazon">
    Log in with Amazon lets users log in with their Amazon customer accounts and offers data like name, email address, and zip code to build a more personalized experience.

    **Default Scopes**

    * `profile`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/amazon)
    * [Amazon API documentation](https://developer.amazon.com/docs/login-with-amazon/customer-profile.html)
  </Accordion>

  <Accordion title="Apple">
    Allow your users to log in with their Apple accounts. Apple does not offer any additional scopes. Note that Apple allows users to obfuscate their email address, and you may receive an email address like `h79gps7k78@privaterelay.appleid.com`. See the Resources section below to learn more.

    **Default Scopes**

    * `name`
    * `email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/apple)
    * [Apple API documentation](https://developer.apple.com/documentation/sign_in_with_apple)
  </Accordion>

  <Accordion title="Bitbucket">
    Log in with Bitbucket let's you build exciting tools on top of Atlassian's Bitbucket source control product.

    **Default Scopes**

    * `account`
    * `email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/bitbucket)
    * [Bitbucket API documentation](https://developer.atlassian.com/cloud/bitbucket/rest/intro/)
  </Accordion>

  <Accordion title="Coinbase">
    Log in with Coinbase let's users easily and securely sign in to your app and lets you integrate Coinbase supported cryptocurrencies into your applications.

    **Default Scopes**

    * `account`
    * `email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/coinbase)
    * [Coinbase API documentation](https://docs.cloud.coinbase.com/sign-in-with-coinbase/docs/permissions-scopes)
  </Accordion>

  <Accordion title="Discord">
    Discord OAuth login allows users to log into your app with their Discord account.

    **Default Scopes**

    * `identify`
    * `email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/discord)
    * [Discord API documentation](https://discord.com/developers/docs/topics/oauth2#shared-resources-oauth2-scopes)
  </Accordion>

  <Accordion title="Facebook">
    Facebook OAuth login allows users to log into your app with their Facebook account.

    **Default Scopes**

    * `public_profile`
    * `email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/facebook)
    * [Facebook API documentation](https://developers.facebook.com/docs/graph-api/overview)
  </Accordion>

  <Accordion title="GitHub">
    GitHub OAuth login allows users to log into your app with their GitHub account.

    **Default Scopes**

    * `user:email`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/github)
    * [GitHub API documentation](https://docs.github.com/en/developers/overview/about-githubs-apis)
  </Accordion>

  <Accordion title="GitLab">
    GitLab OAuth login allows users to log into your app with their GitLab account.

    **Default Scopes**

    * `open_id`
    * `email`
    * `profile`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/gitlab)
    * [GitLab API documentation](https://docs.gitlab.com/ee/api/)
  </Accordion>

  <Accordion title="LinkedIn">
    LinkedIn OAuth login allows users to log into your app with their LinkedIn account.

    **Default Scopes**

    * `r_liteprofile`
    * `r_emailaddress`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/linkedin)
    * [LinkedIn API documentation](https://learn.microsoft.com/en-us/linkedin/consumer/integrations/self-serve/share-on-linkedin?context=linkedin%2Fconsumer%2Fcontext)
  </Accordion>

  <Accordion title="Microsoft">
    Log in with Microsoft helps your users sign in easily with their corporate or person Microsoft accounts and lets you leverage Microsoft's Graph API.

    **Default Scopes**

    * `open_id`
    * `email`
    * `profile`

    **Resources**

    * [Stytch API reference](/api-reference/consumer/api/oauth/start/microsoft)
    * [Microsoft API documentation](https://docs.microsoft.com/en-us/graph/)
  </Accordion>

  <Accordion title="Salesforce">
    Log in with Salesforce let's your users log in with their Salesforce accounts.

    **Default Scopes**

    * `id`
    * `openid`
  </Accordion>

  <Accordion title="Slack">
    Log in with Slack let's your users log in with their Slack accounts.

    **Default Scopes**

    * `openid`
    * `email`
    * `profile`
  </Accordion>

  <Accordion title="Twitch">
    Log in with Twitch let's your users log in with their Twitch accounts.

    **Default Scopes**

    * `account`
    * `email`
  </Accordion>

  <Accordion title="Yahoo">
    Log in with Yahoo let's your users log in with their Yahoo accounts.

    **Default Scopes**

    * `account`
    * `email`
    * `profile`
  </Accordion>
</AccordionGroup>