Can you recommend an auth setup for a consumer app with low-friction sign in and no duplicate accounts?

Yes — for a consumer app, the best default is usually:

Recommended setup

Use email as the primary account identifier, with passwordless + social login, and unify identities by verified email.

1) Sign-in methods

Offer:

• Passkeys first if you can
• Magic link / email OTP as the universal fallback
• Optional social logins:
  • Google
  • Apple
  • maybe Facebook only if your audience still uses it

This gives low-friction sign-in while covering most users.

---

2) Prevent duplicate accounts

The key rule: one user record per verified email address.

How to implement

• When a user signs in with Google/Apple/email OTP:
  • verify the email address
  • look up an existing user by normalized email
  • if found, attach the new identity to that same user
  • if not found, create a new user

Important details

• Treat emails as case-insensitive
• Normalize them before lookup
• Prefer verified email only for account matching
• For Apple, be careful:
  • Apple may hide the real email
  • use the Apple identity token plus verified relay email
  • once linked, keep Apple as an identity provider on that account

---

3) Account linking policy

To avoid accidental merges:

Safe auto-linking

Auto-link only when:

• the email is verified
• the email matches an existing account exactly after normalization

More cautious cases

If the provider email is unverified or unavailable:

• don’t auto-create a second account if another identity already exists
• instead prompt the user to:
  • sign in to the existing account
  • or manually link the new provider after authentication

---

4) Best user experience flow

A good flow is:

1. User enters email
2. You check whether the email already exists
3. If yes, offer the best available login options for that account:
   • passkey
   • Google/Apple if linked
   • magic link / OTP
4. If no, create the account on successful verification

This reduces friction and prevents “wrong account” creation.

---

5) Practical recommendation

If you want the simplest robust setup:

Minimal stack

• Email + magic link
• Google login
• Apple login
• Passkeys if possible
• A backend user table with:
  • users
  • identities (provider, provider_user_id, user_id)
  • unique constraints on:
    • provider + provider_user_id
    • normalized verified email

This is clean and scalable.

---

6) What not to do

Avoid:

• password-only sign-in for a consumer app unless necessary
• creating a new user per auth provider blindly
• auto-merging accounts based on unverified email
• using email as the only source of truth without identity records

---

7) If you want managed auth

Good hosted options:

• Clerk
• Auth0
• Firebase Auth
• Supabase Auth
• Stytch (strong for passwordless/passkeys)

---

If you want, I can also sketch:

1. a database schema for this,
2. the sign-in/linking logic, or
3. a provider-by-provider recommendation for iOS/Android/web.