How to Set Up Social Login with VK for XFile Ultra

Members can sign in with VK. XFile Ultra uses VK ID (id.vk.ru) with PKCE — not the older oauth.vk.com-only flow.

You create a website application in the VK ID / VK developer console, register the trusted redirect URL, then paste App ID and Secure key into Mods → Social.

Before you start

1. Social Login is a Premium plugin. If the Social section shows a lock / “Premium plugin required”, buy Social Login on xfileultra.com, then refresh the license under Settings → Main → Site identity.

2. Turn on the master Social login switch (toggle.mrc) in Admin → Settings → Mods → Social.

3. Copy the read-only Redirect URI shown for that provider — you will paste it into the provider console exactly (https, host, path; no extra slash).

Password sign-in stays available when social login is on.

Where to find it in XFile Ultra

Admin → Settings → Mods → Social

1. Turn Social login on

2. Provider → VK

3. Turn VK social login on

4. Paste App ID and Secure key

5. Copy Redirect URI into VK as a trusted redirect URL

6. Save settings

7. Test on /login or /register

Fields in XFile Ultra

Field in admin	Setting key	From VK
VK social login	`toggle.social_vk`	Enable/disable
App ID	`vk_app_id`	Application ID
Secure key	`vk_app_secret`	Secure / protected key
Redirect URI	(read-only)	Trusted Redirect URI

Redirect URI shape:

https://YOUR-DOMAIN/api/auth/oauth/vk/callback

Scope used: email.

Step 1 — Create a VK ID / VK app

1. Open the VK ID business console: id.vk.ru / VK ID docs — create application

(You may also manage apps via VK for developers / Manage apps — use the same app’s ID and secure key.)

2. Create an application for a Website

3. Copy App ID (application id) and Secure key (защищённый ключ)

4. Set Base domain to your hostname (example: example.com)

5. Add Trusted Redirect URI / Доверенный redirect URL = the XFile Ultra Redirect URI exactly

6. Save

Step 2 — Paste into XFile Ultra and test

1. Admin → Settings → Mods → Social → Provider VK

2. Paste App ID + Secure key

3. Ensure master Social login and VK social login are on

4. Save settings

5. Private window → VK button → authorize → signed in

The product handles VK ID’s device_id on the callback automatically.

Common problems

Wrong Secure key

Must be the secure key from the same app as the App ID. Do not mix service token / other keys into this field.

redirect_uri / invalid redirect

Trusted redirect in VK must match admin exactly (https, host, path). Also confirm base domain covers your host.

Token exchange fails

Mixed keys, wrong redirect, or using a legacy app setup that is not VK ID–compatible. Prefer creating/configuring the app through the current VK ID console.

Email missing

User may not share email, or the app is not allowed to request email. Password registration remains available.

Button missing

Plugin locked, master off, provider off, or App ID / Secure key empty.