Link Multiple Auth Providers to an Account

[sandbox-apps]

https://firebase.google.com/docs/auth/android/account-linking

[rodjoseph]

I think this would be great as well

[kiwicopple]

Hey @sandbox-apps - this is technically possible, as long as the user has the same email for all accounts (since this is the primary login mechanism).

For example

• user logs in with email 'test@email.com'
• user logs in with Facebook OAuth and their facebook account has the email 'test@email.com'

Both of these will return the same user uuid.

Is that what you're looking for?

[sandbox-apps]

Firebase has this setup where
Example:

1. I signed up via email/password then login on app
2. Go to my profile then link social for example facebook
3. Even though facebook has different email address it can be linked

Another example:

1. I signed up via email/password then login on app
2. Go to my profile then link social for example twitter
3. Even though twitter has no email address it can be linked (via uid and providerId) see here: Twitter OAuth signup fails if user has no email on their twitter account supabase#2853

Result:

1. I can sign in via email/password
2. I can sign in via facebook and it will not create another account because it is already connected to a user even though they different email address returned during OAuth
3. I can sign in via twitter and it will not create another account because it is already connected to a user even though twitter has no email address returned during OAuth

Things also that we can keep in mind that..

1. If a user signed up with email/password with an email of test@gmail.com, user can still create an separate account via facebook/twitter if this social has the same email.
2. Unless link or merge, then it will create new account.
3. You can only link account if there is a user that is currently logged in on app/system to determine where would you append the additional data

[sandbox-apps]

Further more you can unlink provider via providerId with the currentUser

Firebase.auth.currentUser!!.unlink(providerId)
        .addOnCompleteListener(this) { task ->
            if (task.isSuccessful) {
                // Auth provider unlinked from account
                // ...
            }
        }

[eMeRiKa13]

I would love to have the workflow you describe @sandbox-apps!

It seems the "perfect" way to manage auth with 3rd party providers.

[didavid61202]

Hey @sandbox-apps - this is technically possible, as long as the user has the same email for all accounts (since this is the primary login mechanism).

For example

• user logs in with email 'test@email.com'
• user logs in with Facebook OAuth and their facebook account has the email 'test@email.com'

Both of these will return the same user uuid.

Is that what you're looking for?

Hi @kiwicopple, thanks for all your teams great work in supabase, lovin' it!
Just want to mention that it would be great if we can link different provider to same account even if the email is different.
Sometimes user use different email for different providers.
And also able to unlink will be great if user want to have separated accounts event the email is the same.
Thanks :)

[firatoezcan]

For anyone wanting to support this, you'd need to propose to https://github.com/netlify/gotrue as that is where the logic behind users and providers live. I don't know if Supabase runs a fork of it, but this is where the request should be going to

[henningko]

Adding another use case here, besides multiple auth paths:
I want to store connections to 3rd party apps, e.g. a Twitter connection for retrieving a user's tweets. Else, I need to duplicate a lot of the OAuth logic and store it separately.

[diogoribeirodev]

Any updates on this

[kangmingtay]

Hi everyone, we currently don't have plans to support manual linking of accounts in the near future. Currently, gotrue only supports automatic linking of accounts based on the user's email.

[jdgamble555]

This could be done theoretically with a procedure and policies that updates the auth.users and auth.identities tables.

• You would basically delete the identity id in auth.identities, remove the provider in auth.users.raw_app_meta_data and auth.users.raw_user_meta_data.

Adding it would require logging out and back in with the provider assuming the email is the same. If you wanted to take that a step further, you could create another procedure with an http function that runs the full oAuth 2 protocol, then saves it manually. You could also theoretically add the missing option for signin with popup.

Of course, if someone does either of these two options, please share the code here.

J

[hf]

Hey everyone, we're aware of the need to customize the account linking logic and have some plans to make it happen via web hooks / triggers. However, this is not something we're going to be working on in the short term.

I'll be closing this issue as account linking is supported if the user has the same email in the social login providers.

[rlee1990]

I don't get the point of closing this and stating that account linking is suppoerted when its the same email but the point of this whole thread is to get support for when its NOT THE SAME EMAIL. Its a must have future in auth now and days. This should really be pushed up the priority list.