I need account linking for email/password plus social login

You want one user account to support both:

• email + password login
• social login (Google, Apple, Facebook, etc.)

This is a common setup, and the key is to model users in a way that supports multiple auth identities per person.

Recommended approach

1) Keep a single users record

Store the actual person/account separately from login methods.

Example:

• users
  • id
  • email
  • name
  • created_at
  • ...

2) Add an auth_identities / linked_accounts table

Each login method gets its own row.

Example:

• auth_identities
  • id
  • user_id
  • provider (password, google, apple, facebook)
  • provider_user_id (sub / subject / id from provider)
  • email (optional)
  • password_hash (only for password auth, or store elsewhere)
  • created_at

A single user can have:

• one email/password identity
• one Google identity
• one Apple identity
• etc.

---

Linking flow

A) User signs up with email/password

1. Create users row
2. Create password auth identity linked to that user

B) User later signs in with Google

1. Verify Google token
2. Check whether provider_user_id already exists
3. If not, see whether the Google email matches an existing user
4. If the user is already authenticated and explicitly wants to link, attach the Google identity to that user
5. Prevent accidental merges without verification

---

Important security rule

Do not automatically link accounts only because emails match unless the email is:

• verified by the provider, and
• your app’s policy allows it

Better:

• if the user is logged in, they can click “Link Google account”
• if not logged in, ask them to authenticate first or confirm ownership

---

Typical user experience

Account settings page

Show:

• Email/password: linked
• Google: not linked → “Connect”
• Apple: linked → “Disconnect”

Linking steps

1. User logs into their existing account
2. Clicks “Connect Google”
3. Redirects to Google OAuth
4. On callback, you associate that Google identity with the current user

---

Data model example

users
- id
- email
- name
- email_verified
- created_at

auth_identities
- id
- user_id
- provider
- provider_user_id
- email
- password_hash
- created_at

Constraints:

• provider + provider_user_id must be unique
• optional: one password identity per user
• optional: one identity per provider per user

---

Edge cases to plan for

• User signs up with email/password using a@x.com, then later logs in with Google using the same email
• User has multiple social providers connected
• Provider changes email later
• User wants to unlink a provider
• User deletes their account

---

If you want, I can help with one of these next:

1. DB schema
2. API endpoints
3. OAuth linking flow
4. Firebase / Supabase / Auth0 implementation
5. Frontend UX for linking/unlinking

If you tell me your stack, I can give you an exact implementation.