Signing into Nodetonet just got faster and more secure. Alongside the classic email and password flow, you can now use Google, Discord or GitHub to create an account or log in — one click, no new password to remember, no extra email to verify.
TL;DR: hit the social button on the login page or register page, approve the provider's consent screen once, and you are in. Your existing proxies, tokens and credit balance are unaffected.
Why social login matters for a proxy panel
A proxy management panel holds real credentials — API tokens, device pairings, billing data. Weak or reused passwords are the single most common entry point for account compromise. Social login shifts authentication to providers that already enforce strong protections: Google Workspace's advanced phishing-resistant login, Discord's two-factor authentication, GitHub's device-confirmation flow. You benefit from their security investments without any extra configuration on your end.
It also removes a common friction point: developers and power-users who live in Discord and GitHub no longer need to context-switch to a password manager when they need to reach their mobile proxy panel or check a rotating proxy pool.
Which providers are available?
| Provider | Best for | What we request |
|---|---|---|
| Anyone with a Gmail or Google Workspace account | Name, verified email address | |
| Discord | Developers and community members (join us at discord.gg/nodetonet) | Username, verified email address |
| GitHub | Developers who keep everything in GitHub | Username, primary verified email address |
In every case we request only the minimum scope: a stable identifier and a verified email. We do not read your repositories, contacts, messages, calendar or any other data beyond identity.
How the flow works, step by step
- Open the login or register page and click one of the three social buttons.
- Your browser redirects to the provider's own login screen. You authenticate there — Nodetonet never sees your Google, Discord or GitHub password.
- The provider shows a consent screen listing exactly what we will read (name + email). You approve it once; subsequent logins skip this step.
- The provider sends a signed token back to Nodetonet. We verify the signature, extract your verified email and create or locate your account.
- Your session starts. If the email matches an existing Nodetonet account it is linked automatically (see below).
The entire handshake follows the OAuth 2.0 Authorization Code flow with a server-side state parameter that prevents CSRF attacks. Your session token is regenerated on every sign-in to prevent session-fixation.
Linking a social provider to an existing account
Already have a Nodetonet account registered with the same verified email address? When you sign in with a social provider, the platform detects the match and links the two automatically. Nothing else changes:
- All your mobile proxy device pairings, token groups and pool configurations remain exactly as they are.
- Your prepaid credit balance is untouched.
- Any existing API tokens and client credentials remain valid.
- You can still sign in with your email and password — social login is an addition, not a replacement.
This means resellers managing multiple sub-accounts can link their preferred provider and keep everything in one place without disrupting customers.
Password policy for social-login accounts
An account created purely through a social provider has no local password by default. There is nothing to steal in a credential dump. If you later want to add a password (for example, to log in from a device where social login is inconvenient), use the "Forgot password" flow — enter your email and set a new password. After that you can use either route.
Security details
Here is a plain-language summary of the protections in place:
- Zero-knowledge of provider credentials. The OAuth redirect happens entirely between your browser and the provider. Nodetonet only receives the final signed token — never your password, never a session cookie for the provider.
- CSRF-state validation. Every redirect includes a random
statevalue that we verify on return. A forged redirect cannot complete the handshake. - Session regeneration. Your Nodetonet session ID is replaced on every sign-in, preventing session fixation even if an old cookie was captured.
- Email verification enforced. We only accept a verified primary email from the provider. An unverified or secondary email cannot be used to hijack an existing account.
For a broader look at how Nodetonet protects proxy client credentials, see the guides on per-customer proxy auth and IP allow/deny lists.
Social login and the rest of Nodetonet's security model
Authentication is just one layer. Once you are inside the panel, Nodetonet gives you fine-grained tools to lock down who can use your proxies and how:
- IP allow/deny lists — restrict which IP addresses can connect to a proxy or tunnel at all, independent of login credentials.
- Per-client auth — issue separate username/password pairs to each customer so you can revoke one without touching others.
- API tokens vs personal tokens — understand which token to use for automation versus interactive sessions.
- Audit logs — see who used a tunnel or proxy, and when, for compliance and incident review.
Together these make a layered defence: social login reduces the risk of a stolen master password, and per-client controls limit the blast radius if any one credential is exposed.
What changes for new accounts created with social login?
The only practical difference is that a brand-new social-login account starts without a local password. Everything else — billing, HTTP tunnels, VPN access, geo-targeting, and reseller features — works identically to a classic email account. You can pair Android devices, create token groups and rotating pools, and manage upstream forwarding from the same panel you would with any other login method.
If your team uses shared Nodetonet accounts, consider linking a shared Google Workspace identity or Discord server bot-account so the login is not tied to one person's personal OAuth session. Reach out on Discord or at support@nodetonet.com if you need advice on team account setup.
Frequently asked questions
See the FAQ section below for answers to the most common questions about social login, account linking, and what happens if you lose access to your provider.
Get started
Social login is live right now — no configuration needed on your side. Create a new account with one click, or head to the login page if you already have one. Questions? Reach us at support@nodetonet.com or on Discord.