I’m building an app with account linking across email and social providers

Got it — account linking across email and social providers is a common but surprisingly tricky auth problem.

I can help with things like:

• designing the account model
• deciding linking / merging rules
• handling duplicate emails
• secure OAuth / OIDC flow setup
• preventing account takeover
• UX for “sign in with Google / email / Apple, etc.”
• database schema and backend logic
• edge cases like email changes, deleted providers, unverified emails

A good starting point is to define your linking policy:

1) What counts as the same person?

Common approaches:

• Verified email match: link accounts when the provider gives a verified email that matches an existing account.
• Explicit user linking: user signs in with one method, then adds another in settings.
• Auto-link only after re-auth: if a social login returns a matching verified email, require the user to prove control of the existing account first.

2) Strong recommendation

Do not auto-merge purely on email unless:

• the email is verified by the provider, and
• you’ve considered provider trust level, and
• you have safeguards against takeover.

For example, some providers don’t always guarantee a stable, verified email.

3) Typical data model

You usually want:

• users table: your internal user
• identities table: one row per auth identity

Example:

• users
  • id
  • primary_email
  • created_at
• identities
  • id
  • user_id
  • provider (email, google, apple, github, etc.)
  • provider_subject (stable unique ID from provider)
  • email
  • email_verified
  • created_at

4) Linking flow options

• First login wins: create a user on first sign-in, later link explicitly.
• Email-based linking: if provider email matches existing verified email, attach identity.
• Settings-based linking: user logs in, then “Connect Google/Apple/GitHub” from account settings.

5) Security checks

• Require recent login before linking a new provider
• Verify the provider’s subject ID, not just email
• Never allow linking based on unverified email alone
• Log linking events and notify the user
• Provide account recovery independent of social provider access

If you want, I can help you with one of these next:

1. a secure account-linking flow,
2. a database schema,
3. backend pseudocode,
4. or rules for merging accounts safely.