Provider setup
Open the Google or Discord sign-in settings page in Admin. Copy the exact callback URL displayed for your site.
Create the OAuth application with the provider and register that callback. Paste its client ID and secret into the matching Hot Spots settings page and enable it.
Discord uses identity and email permissions; a bot is not needed. Provider sign-in does not grant GM/admin roles or campaign membership.
Save settings, then test by linking your account under Account → Sign-in methods. Saving settings alone does not complete an OAuth sign-in.
Email and private settings
Admin → Email verification settings enables email sign-in. Admin → Email delivery → Configure sender and SMTP controls delivery for sign-in, recovery, invitations and acceptance notifications.
Request a sign-in or recovery link to test delivery. Check spam folders and ask the host about mail delivery if it does not arrive.
Settings changes require a recent administrator sign-in. Blank secret fields retain the saved secret; explicit removal disables the service.
Private settings are stored outside public/. Preserve config.php and the root auth-settings.php when uploading a release.