Use Kinde authentication to WordPress self-hosted site

WordPress includes built-in user authentication, but many teams want more than the default login form—social sign-in, enterprise SSO, passwordless flows, or a single identity layer shared across multiple products. Kinde handles authentication and user management for you, and you can bring that experience to a self-hosted WordPress site without custom code.

What you need

Link to this section

• A Kinde account with Admin or Engineer permissions (sign up for free)
• A self-hosted WordPress site with Administrator permissions

Quickstart

Link to this section

1. Create a Kinde application

Link to this section

1. Go to your Kinde dashboard and select Add application.

2. Enter a name (for example, “WordPress”), select Back-end web as the application type, and select Save.

3. Select Other back end as the SDK, and select Save.

4. Go to Details and copy the Domain (or Custom domain), Client ID and Client secret values.

5. In the Allowed callback URLs field, enter:

   • Callback URL: https://<your_wordpress_domain>/wp-admin/admin-ajax.php?action=openid-connect-authorize
   • Logout redirect URL: https://<your_wordpress_domain>

   Select Save.

6. Go to Authentication and select the authentication methods you want to use (Email + code is enabled by default).

   To keep password authentication with username and email like WordPress, do the following:

   • In Passwordless connections, disable Email + code
   • In Password connections, enable Email + password and Username

   

   Enable any other authentication methods you want to use for your WordPress site (for example, Google, Facebook, or Enterprise).

   Select Save.

2. Install the WordPress plugin

Link to this section

1. Sign in to your WordPress dashboard, go to Plugins and select Add New.

2. Search for OpenID Connect - Generic Client (by Jonathan Daggerhart) and select Install Now.

3. Once installed, select Activate.

   

3. Configure the plugin

Link to this section

1. In WordPress, go to Settings > OpenID Connect Client.

2. In the Quick setup section, enter your Kinde OpenID configuration URL and select Load Configuration.

   <YOUR_DOMAIN>/.well-known/openid-configuration

   Replace <YOUR_DOMAIN> with your custom domain (e.g., https://auth.yourbusiness.com) or your Kinde domain (e.g., https://your_business.kinde.com).

3. Enter the Client ID and Client Secret Key from your Kinde application.

4. Set the Scope to openid profile email.

5. If auto-configuration fails, manually enter the following details:

   • Login Endpoint URL: <YOUR_DOMAIN>/oauth2/auth
   • Userinfo Endpoint URL: <YOUR_DOMAIN>/oauth2/v2/user_profile
   • Token Validation Endpoint URL: <YOUR_DOMAIN>/oauth2/token
   • End Session Endpoint URL: <YOUR_DOMAIN>/logout
   • JWKS URI: <YOUR_DOMAIN>/.well-known/jwks
   • Issuer: <YOUR_DOMAIN>
   You can find all these endpoints by visiting the OpenID configuration URL (for example, <YOUR_DOMAIN>/.well-known/openid-configuration).

6. Enter the following details:

   • Identity Key: sub
   • Nickname Key: name
   • Email Formatting: {email}
   • Display Name Formatting: {given_name} {family_name}

7. Select Save Changes.

4. Test authentication

Link to this section

1. Sign out of your WordPress site and visit your login page (for example, https://<your_wordpress_domain>/wp-login.php).

2. Select the Login with OpenID Connect button. The Kinde hosted login page opens.

3. Sign in or sign up for a new account.

4. You are redirected to your WordPress dashboard.

5. In your Kinde dashboard, go to Users to confirm the new user was created.

6. Sign out of WordPress and sign in again with your Administrator account.

7. In your WordPress dashboard, go to Users > All Users. New users are assigned the Subscriber role by default.

   

Advanced configuration

Link to this section

Login type

Link to this section

• OpenID Connect button on login form: When enabled, a button appears on the default WordPress login screen. Users can sign in with Kinde or use the default WordPress login form.
• Auto Login - SSO: When enabled, users are redirected to the Kinde hosted login page, bypassing the default WordPress login screen.

Refresh tokens

Link to this section

Add the scope offline and check the Enable Refresh Token option to get a refresh token.

Kinde uses the offline scope instead of the offline_access scope defined by the OpenID Connect specification.

Export users from WordPress

Link to this section

1. In your WordPress dashboard, install and activate the Import and export users and customers plugin (by Codection).
2. Go to Tools > Import and export users and customers.
3. Select the Export tab and choose the roles you want to export (for example, Subscriber, Customer, or Administrator).
4. Select Download. The CSV file saves to your computer.

To import the exported users to Kinde, see Import users in bulk. Do not import passwords—WordPress uses a hashing format that Kinde does not support. Users are prompted to create a new password on their next sign-in. Let your users know in advance to avoid confusion.

Troubleshooting

Link to this section

ERROR (failed-user-creation)

Link to this section

When a user’s email already exists in WordPress, user creation fails with the following error:

ERROR (failed-user-creation): Failed user creation.

Enable the Link Existing Users option in Settings > OpenID Connect Client.