Amazon

note

To add Amazon as a social sign-in provider, you need a Amazon Developer account. Go to Amazon Developers to create one.

Ory Console

Follow these steps to add Amazon as a social sign-in provider for your project, using the Ory Console.

1. Go to Authentication → Social Sign-In in the Ory Console.
2. Enable the Enable OpenID Connect toggle, then click Add new OpenID Connect provider.
3. Click the Amazon logo to open the Configure Amazon screen. You may need to click Show more providers to see the full list of providers.
4. Copy the Redirect URI and save it for later use.
5. Follow the official steps to create a security profile.
6. Once you've created the security profile, click Show Client Secret and copy the Client ID and Client secret. Then paste them into the corresponding fields in the Ory Console's Configure Amazon screen.
7. In the Ory Console, click Save Configuration to enable Amazon as a social sign-in provider.
8. On Amazon Developers, click Save Changes.
9. On Amazon Developers, go to Settings > Security Profiles > [Your profile] > Web Settings .
10. Open the Amazon Security Profile Management screen, select the Web Settings tab, click Edit, and paste the redirect URI into the Allowed Return URLs field. Click Save.

note

These steps cover the basic configuration of a social sign-in provider integration. At this point, the user experience is incomplete. To complete the configuration and ensure a smooth and secure user experience, configure the scopes and data mapping as described in the next section.

Additional configuration

When adding a social sign-in provider, you can customize the integration by defining the OAuth scopes Ory requests from the provider and by setting up custom data mappings.

Scopes

In the Scopes field, you can define the OAuth (access) scopes that Ory requests from the sign-in provider. Defining access scopes enables you to interact with the provider's APIs on behalf of the user, or to access additional user data, which is exposed as claims for data mapping.

For a basic setup, follow these steps to add the profile access scope:

• In Ory Console's Configure Amazon screen, click Show advanced settings.
• In the Scopes field, enter 'profile' and click Add.

To learn more about the scopes available for Amazon, read the related documentation.

Data mapping

In the Data mapping field, you can map the data returned by the sign-in provider to traits as defined in the identity schema.

To define the mapping, create a Jsonnet code snippet. Read this document to learn more about Jsonnet data mapping.

In this sample Jsonnet snippet, the user's email, is mapped to email in the identity schema.

local claims = std.extVar('claims');
{
  identity: {
    traits: {
      // The email might be empty if the user hasn't granted permissions for the email scope.
      [if 'email' in claims then 'email' else null]: claims.email,
    },
  },
}

Ory CLI

Follow these steps to add Amazon as a social sign-in provider to your project using the Ory CLI: 3. Encode the Jsonnet snippet with Base64 or host it under an URL accessible to Ory Network.

cat your-data-mapping.jsonnet | base64

4. Download the Ory Identities config from your project and save it to a file:

   ## List all available workspaces
   ory list workspaces
   
   ## List all available projects
   ory list projects --workspace <workspace-id>
   
   ## Get config
   ory get identity-config --project <project-id> --workspace <workspace-id> --format yaml > identity-config.yaml

5. Add the social sign-in provider configuration to the downloaded config. Add the Jsonnet snippet with mappings as a Base64 string or provide an URL to the file.

   selfservice:
   methods:
     oidc:
       config:
         providers:
           - id: amazon # this is `<provider-id>` in the Authorization callback URL. DO NOT CHANGE IT ONCE SET!
             provider: amazon
             client_id: .... # Replace this with the OAuth2 Client ID provided by Amazon app
             client_secret: .... # Replace this with the OAuth2 Client Secret provided by Amazon app
             mapper_url: "base64://{YOUR_BASE64_ENCODED_JSONNET_HERE}"
             # Alternatively, use an URL like this example
             # mapper_url: https://storage.googleapis.com/example-example-prd/example-file
             scope:
               - profile
             pkce: "force"
       enabled: true

6. Update the Ory Identities configuration using the file you worked with:

   ory update identity-config --project <project-id> --workspace <workspace-id> --file identity-config.yaml

Troubleshooting

When you add a social sign-in provider, you can encounter common problems such as:

• Redirect URI mismatch
• Redirect loops during registration
• Domain verification issues

To troubleshoot those issues, read Social sign-in troubleshooting.