Do I need OAuth for social login?

Usually, yes — if by “social login” you mean logging in with providers like Google, Facebook, Apple, GitHub, or Microsoft, OAuth 2.0 (often with OpenID Connect on top) is the standard approach.

Quick distinction

• OAuth 2.0: an authorization framework — lets your app get permission to access a user’s data from a provider.
• OpenID Connect (OIDC): authentication built on OAuth 2.0 — this is what you typically use for “Sign in with Google” style login.
• Social login: the product feature; under the hood it’s usually OIDC/OAuth.

Do you “need” it?

• If you want users to sign in with a third-party identity provider: yes, use OIDC/OAuth.
• If you just want username/password in your own app: no, you don’t need OAuth.
• If you mean “log in with an email magic link or passwordless code”: not OAuth either.

Common pattern

1. User clicks “Continue with Google”
2. Your app redirects them to Google’s auth page
3. Google returns an authorization code
4. Your backend exchanges it for tokens
5. You verify the ID token / user info and create a session in your app

Important note

For login, don’t use OAuth alone if you can avoid it — use OpenID Connect because OAuth by itself is for authorization, not identity.

If you want, I can also show:

• a simple social login flow diagram,
• the difference between OAuth and OIDC,
• or how to implement it in your stack.