Umbral OAuth

"Sign in with Google" removes the single biggest signup drop-off: the password. Umbral OAuth drops social login in without the callback-URL-and-token-exchange boilerplate — register a provider, and the login route, the redirect dance, and account linking are handled. Credentials come from the environment, so a provider with no keys simply isn't registered: you can leave the wiring in place with nothing configured and it stays inert until you add the keys.

Install

cargo add umbral-oauth   # builds on umbral-auth

Wire it up

Read the keys from the environment and register each provider only when both halves are present.

use umbral::prelude::*;
use umbral_oauth::OAuthPlugin;
use umbral_oauth::providers::{GoogleProvider, GitHubProvider};

let app = App::builder()
    .database("default", pool)
    .plugin(
        OAuthPlugin::new("https://acme.dev")   // public origin for callbacks
            .login_redirect("/dashboard")
            .provider(GoogleProvider::new(google_id, google_secret))
            .provider(GitHubProvider::new(github_id, github_secret)),
    )
    .build()?;

Target: let an existing user connect GitHub

Beyond first-time login, a signed-in user can link a provider to their existing account, so they can use either path next time.

What you get

• Google and GitHub providers, callback flow handled
• Connect a provider to an already-signed-in account
• Credentials read from env — unconfigured providers just don't register
• Safe to leave wired with nothing set; inert until keys appear
• Builds on umbral-auth's user model and session