Working with Social Authentication

1. Implementing Google Sign-In

AspectDetail
ProtocolOIDC (preferred) or Google Identity Services SDK
Endpointhttps://accounts.google.com/.well-known/openid-configuration
Scopesopenid email profile
Subject IDsub claim (stable, opaque)
One TapAuto-prompt sign-in via Google Identity Services

2. Implementing Facebook Login

AspectDetail
ProtocolOAuth 2.0 (proprietary userinfo via Graph API)
Endpointhttps://graph.facebook.com/me
Scopesemail public_profile
Token verificationPOST debug_token endpoint

3. Implementing GitHub OAuth

Example: GitHub OAuth code exchange

// Authorize: GET https://github.com/login/oauth/authorize?client_id=...&scope=user:email&state=...
// Callback receives ?code=...&state=...
const res = await fetch("https://github.com/login/oauth/access_token", {
  method: "POST",
  headers: { "Accept": "application/json", "Content-Type": "application/json" },
  body: JSON.stringify({ client_id, client_secret, code, redirect_uri })
});
const { access_token } = await res.json();
const user = await fetch("https://api.github.com/user", {
  headers: { "Authorization": `Bearer ${access_token}` }
}).then(r => r.json());

4. Implementing Twitter Authentication

AspectDetail
ProtocolOAuth 2.0 + PKCE (v2 API)
Authorizehttps://twitter.com/i/oauth2/authorize
Scopesusers.read tweet.read offline.access
NoteEmail NOT included by default (requires elevated app)

5. Implementing Apple Sign In

AspectDetail
ProtocolOIDC
Endpointhttps://appleid.apple.com/.well-known/openid-configuration
Client secretJWT signed with ES256 + Apple p8 key
Private email relayUser may share anonymized @privaterelay.appleid.com
Name returnedOnly on FIRST authorization — must persist immediately
RequiredIf app offers any other social login (App Store rule)

6. Implementing Microsoft Account Login

AspectDetail
ProtocolOIDC via Microsoft Identity Platform (v2)
Tenantcommon / consumers / organizations / {tenantId}
Endpointhttps://login.microsoftonline.com/{tenant}/v2.0/...
SDKMSAL (browser, node, mobile)

7. Handling Social Profile Data

FieldPractice
External IDStore as (provider, sub) unique key
EmailTrust only if email_verified=true
Name / pictureSync on each login (or first only)
TokensEncrypt at rest if storing access/refresh

8. Linking Multiple Social Accounts

StrategyDetail
Email matchAuto-link if email_verified matches existing user
Manual linkUser signed in → "Add Google account"
Data modelusers (1) ←→ (N) identities (provider, external_id)
ConflictsDetect & prompt user before merging

9. Implementing Account Merging

StepDetail
Verify ownershipBoth accounts authenticated in same session
Choose primaryKeep one user_id, migrate FKs from other
AuditLog merge event + actor
Reversible?No — confirm explicitly

10. Handling Social Auth Errors

ErrorHandling
access_deniedUser cancelled → return to login
invalid_requestCheck redirect_uri exact match
consent_required (MS)Re-prompt with prompt=consent
login_requiredTrigger fresh login (no SSO session)
networkRetry with backoff

11. Using Social Auth Libraries

LibraryEcosystem
NextAuth.js / Auth.jsNext.js, multi-provider
Passport.jsNode — 500+ strategies
Spring Security OAuth2 ClientJava/Kotlin
Django allauthPython
Auth0 / Clerk / StytchHosted