How to Set Up Social Login with Twitter for XFile Ultra
Members can sign in with Twitter / X. XFile Ultra uses OAuth 2.0 with PKCE — not legacy OAuth 1.0 consumer keys.
You create an app in the X Developer Portal, enable OAuth 2.0 user authentication, register the callback, then paste OAuth 2 Client ID and OAuth 2 Client secret into Mods → Social.
Before you start
1. Social Login is a Premium plugin. If the Social section shows a lock / “Premium plugin required”, buy Social Login on xfileultra.com, then refresh the license under Settings → Main → Site identity.
2. Turn on the master Social login switch (toggle.mrc) in Admin → Settings → Mods → Social.
3. Copy the read-only Redirect URI shown for that provider — you will paste it into the provider console exactly (https, host, path; no extra slash).
Password sign-in stays available when social login is on.
Where to find it in XFile Ultra
Admin → Settings → Mods → Social
1. Turn Social login on
2. Provider → Twitter / X
3. Turn Twitter social login on
4. Paste OAuth 2 Client ID and OAuth 2 Client secret
5. Copy Redirect URI into the X portal
6. Save settings
7. Test on /login or /register
Fields in XFile Ultra
| Field in admin | Setting key | From X |
|---|---|---|
| Twitter social login | toggle.social_twitter |
Enable/disable |
| OAuth 2 Client ID | twitter_oauth_client_id |
Client ID |
| OAuth 2 Client secret | twitter_oauth_client_secret |
Client secret |
| Redirect URI | (read-only) | Callback URI / Redirect URL |
Redirect URI shape:
https://YOUR-DOMAIN/api/auth/oauth/twitter/callbackScopes used: users.read, users.email.
Do not paste API Key / API Key Secret (OAuth 1.0a) into these fields.
Step 1 — Create the X app and enable OAuth 2.0
1. Open the X Developer Portal and sign in
2. Create a Project and an App (if you do not have one)
3. Open the app → User authentication settings (or Settings → User authentication) → Set up / Edit
4. Turn on OAuth 2.0
5. App type: choose a confidential / Web style app that provides a Client secret (server-side). XFile Ultra exchanges the code with Basic auth + PKCE
6. Callback URI / Redirect URL: paste the admin Redirect URI exactly
7. Set a Website URL (your site home page) if required
8. Save
9. Open Keys and tokens and copy OAuth 2.0 Client ID and Client Secret
Official docs: X OAuth 2.0 overview.
Step 2 — Paste into XFile Ultra and test
1. Admin → Settings → Mods → Social → Provider Twitter / X
2. Paste OAuth 2 Client ID + Client secret
3. Ensure master Social login and Twitter social login are on
4. Save settings
5. Private window → Twitter / X button → authorize → signed in
Common problems
Old consumer key/secret pasted
Those are OAuth 1.0a. Create/enable OAuth 2.0 and use Client ID / Client Secret only.
Callback URL not approved / redirect mismatch
Callback in the portal must match admin exactly (including https and path). Max callback count and trailing-slash rules apply in the X portal.
unauthorized_client / token exchange fails
Wrong app type / regenerated credentials not updated in XFile Ultra, or Client ID and secret from different apps. Re-copy both from Keys and tokens.
Email not returned
App permissions / scopes must allow users.email, and the X account must have an email on file.
Button missing
Plugin locked, master off, provider off, or OAuth 2 credentials empty.