XenForo
Connect XenForo to RemyPass so members can choose a RemyPass sign-in option on the forum. RemyPass authenticates the member and returns their identity; XenForo links that identity to a forum account and manages the forum session.
This guide covers the RemyPass configuration and the contract the forum's connected-account provider must implement. It does not install a XenForo add-on or modify forum accounts. A compatible provider or custom add-on is required; confirm compatibility with your XenForo version before cutover.
Before you start
Have the following available:
- The XenForo version and the add-on or custom code that will handle the RemyPass connection
- The exact HTTPS callback URL generated or handled by that provider
- Access to RemyPass integration settings, with the member portal enabled
- A test member and a test forum account
- A decision on whether forum access requires a current membership
The provider must support the authorisation code flow, mandatory PKCE S256, a confidential client secret and a JSON profile endpoint. An OpenID Connect-only provider will not work with these endpoints. Compatibility with the built-in XenForo-to-XenForo provider is not assumed.
1. Register the forum in RemyPass
Open Integrations → Member single sign-on → Add connection. Name the connection, enter the forum provider's callback URL, choose the active-membership requirement, and save the client ID and one-time secret.
See Create and manage a connection for callback rules and credential lifecycle.
The callback is a URL on the forum, not the RemyPass member portal. Its path depends on your provider. Do not copy a callback from another provider without checking the handler.
2. Configure the XenForo provider
Use the endpoint URLs shown in the RemyPass connection settings. Default production values are:
| Provider setting | Value |
|---|---|
| Client ID | The ID generated by RemyPass |
| Client secret | The secret generated by RemyPass, stored server-side |
| Authorisation URL | https://api.remypass.com/api/v1/oauth/authorize |
| Token URL | https://api.remypass.com/api/v1/oauth/token |
| User-info URL | https://api.remypass.com/api/v1/oauth/userinfo |
| Revocation URL | https://api.remypass.com/api/v1/oauth/revoke |
| Response type | code |
| Grant type | authorization_code |
| PKCE | Enabled, S256 |
| Client authentication | HTTP Basic, or form-body credentials |
| Scopes | profile email membership |
| User-info method | GET with Authorization: Bearer <access_token> |
| Response format | Direct JSON, no data wrapper |
The provider must generate and validate state, retain the PKCE verifier in the initiating forum session, and send that verifier with the code exchange. Follow the OAuth flow guide for the complete request sequence.
3. Map member fields
| RemyPass field | Forum use |
|---|---|
sub | Permanent external identity linked to the XenForo user; id is an alias |
company_id | Confirm that the identity belongs to the expected organisation |
name | Display-name suggestion; retain the existing forum username when linking |
email | Contact information; not a permanent identity key |
member_id | Optional display member number |
membership_active | Whether a current effective active membership exists |
membership_type_ids | Optional input to forum-specific access or group rules |
There is no email_verified claim. Do not silently link an existing forum account solely because its email matches. Use an authenticated linking flow or a reviewed migration mapping. See Link existing forum accounts.
Group changes are implemented by the forum provider. RemyPass does not automatically change XenForo user groups, staff roles or permissions.
Link existing forum accounts
Preserve existing XenForo user IDs when linking RemyPass identities. Usernames, posts, private conversations and history remain attached to those forum accounts.
Choose one of these approaches:
- Member-confirmed linking: require the member to sign in to their existing forum account, then explicitly connect RemyPass
- Reviewed account mapping: have the forum team import approved links between XenForo user IDs and RemyPass
subvalues, scoped to the expected organisation
Resolve ambiguous matches, duplicate records and shared email addresses before importing links. Email and member_id can change and must not become the permanent external identity key. Provide administrator-assisted recovery for members who cannot access their existing forum account.
Members sign in to RemyPass using their portal password or an emailed sign-in link. Existing XenForo local credentials remain under the forum team's control; enabling OAuth does not remove them.
Back up the forum and identity mappings before enabling the connection. Test that linked members return to the same forum accounts and retain their history. Rotating a RemyPass secret invalidates OAuth grants but does not undo forum account links.
4. Test the connection
Once the provider is installed and configured, XenForo's documented test flow is Setup → Connected accounts → Test provider → Test. Confirm the returned member details. See the official XenForo connected accounts guide.
Then test the actual member-facing flow:
| Scenario | Expected result |
|---|---|
| Member with current membership | Returns to the intended forum account |
| Member using an emailed sign-in link | Returns through approval to the same callback |
| Existing RemyPass portal session | Approval appears without another password entry |
| Member declines approval | Callback receives access_denied; forum remains logged out |
| Inactive member account | Access denied |
| No qualifying membership, requirement enabled | Access denied |
| No qualifying membership, requirement disabled | Active member account can authorise |
| Expired or reused code | Exchange rejected; offer a new login attempt |
| Changed callback URL or incorrect verifier | Exchange or authorisation rejected |
| Disabled connection or rotated secret | Old credentials/grants stop working |
5. Define the forum session policy
Decide how XenForo should behave when membership ends after the user has logged in. The RemyPass profile endpoint checks eligibility while the ten-minute token remains valid. After that, the provider must start a new authorisation flow to obtain another token.
OAuth login alone does not continuously enforce membership status on an existing XenForo session, and RemyPass does not send a cross-site logout event. The forum team must implement the recheck and session-expiry behaviour required by the organisation.
Troubleshooting
| Symptom | Check |
|---|---|
| Callback rejected | Exact scheme, host, path, trailing slash and query string match the registered URL |
invalid_client | Correct connection credentials, enabled state and only one client-authentication method |
invalid_grant | Original verifier and callback, code age, whether the code was already exchanged |
invalid_scope | Remove openid, offline_access and other unsupported scopes |
| User information cannot be parsed | Read direct JSON and use sub or id; there is no nested data object |
| A duplicate forum account appears | Review the external-identity mapping and registration/linking rules |
| Expired member remains logged into XenForo | Review forum session policy; a previous OAuth success does not force logout |
For full error behaviour, see OAuth endpoints, scopes and errors.