# Diagnose: social button missing
## Symptom
Universal Login renders only username/password (or nothing) where a social button is expected.
## Likely causes
1. Connection not enabled for the application (most common). Connections are per-app opt-in.
2. Social connection missing its own keys: Google/GitHub/etc need a client id/secret in the connection settings; without them the connection stays inert.
3. Organization login: org logins only show connections enabled on the ORGANIZATION. App-level enablement is not enough.
4. Identifier-first flow: the button appears only after the user types an email whose domain routes to the social connection (home realm discovery). This is by design in identifier-first.
5. Display configuration: the new Universal Login shows social buttons based on enabled connections automatically; custom HTML can hide them.
## Confirm
- Application > Connections: is the social connection toggled on? If not, found it.
- Authentication > Social > the connection: are provider keys filled in and the connection enabled at tenant level?
- For orgs: Organizations > your org > Connections: enabled there?
- Tenant logs: a login attempt with `connection` set to the social connection failing means the app tried it but it is not enabled.
## Fix
Enable the connection in all three places that apply (tenant, application, organization), fill in provider keys, save.
## Verify
Incognito login page shows the button; complete a full social login and confirm the success event names the social connection.