Custom auth providers

Appfarm supports third-party authentication by integrating with authentication providers using OAuth 2.0.

Using a custom auth provider allows you to manage users in an external directory such as Azure AD. To enable custom auth you must first complete any necessary setup with the provider, and then configure the provider in Appfarm Create.

For detailed walkthroughs on how to configure a number of different providers, see How to configure third-party authentication.


Follow these steps to correctly setup and configure a custom auth provider.

In your auth provider:

  • Create a new application. Please refer to your provider's documentation for details.

  • When creating an OAuth application, it will require at least one callback URL. Use

  • Make note of the Client ID and Client Secret provided when you create the OAuth application.

In Appfarm Create:

  • Add a new custom auth provider.

  • Enter the provided Client ID into Client ID.

  • Create a secret to store the Client Secret and select it from the Client Secret list.

  • Depending on what kind of provider you are using, fill in the Tenant ID or OpenID Discovery Endpoint.

  • Add the custom auth provider in a login configuration under Custom auth.

General settings



A descriptive reference used only in Appfarm Create.


The auth provider. The following options are available:

  • Google

  • Azure AD

  • Auth0

  • Custom

Client ID

The identifier of the application created in your auth provider. Usually this is a unique application used only to authenticate users for this Appfarm solution.

Client Secret

Tenant ID

Only for Azure AD and Auth0.

The unique identifier for your tenant. Appfarm needs this value to fetch the configuration for this auth provider. The format of this value differs depending on your provider.

Azure AD The identifier can be found inside the Azure Portal. The format is typically XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.

Auth0 The identifier used in Auth0 is the entire hostname ending with For example:

OpenID Discovery Endpoint

Only for Custom. The URL holding the configuration of your OpenID Connect Server. For example: https://HOST_NAME/.well-known/openid-configuration Important: The hostname is used together with Client ID to uniquely identify this provider. If you change the host, users that have already logged in with this provider must log in again to be able to use credentials returned by this provider.

Custom Scope

By default, the following scope will be requested:

  • openid

  • profile

  • email

Remove Default Scope

Remove openid, profile and email from scope. When selected, only scopes entered in Custom Scope will be used.

Appfarm account options


Auto Create Account

Initial Roles

Assign one or more roles when a new user is created.

Advanced options


Disable Same Browser Validation

Warning: This option should be used with caution and an understanding of the security implications.

For added security Appfarm checks that a callback from a third-party authentication provider is made by the same browser that initiated the login. By selecting this option, that check will be disabled. This might be desirable to improve the authentication user experience. If, for example, the login flow involves a magic link sent to the user's email address, the user may not open the link in the same browser that the login was initiated from. This will normally result in the login attempt failing. By disabling same browser validation, the login attempt in this case would succeed.

Auth Timeout

The amount of time a user can spend authenticating with the provider before returning to Appfarm.

Normally the default (15 minutes) will be more than sufficient. In some cases, for example when the authentication involves sending a link to email, this timeout may be too short.

The default is 900 seconds (15 minutes), and the maximum is 86400 seconds (24 hours).

Last updated