Working with Social Authentication
1. Implementing Google Sign-In
| Aspect | Detail |
|---|---|
| Protocol | OIDC (preferred) or Google Identity Services SDK |
| Endpoint | https://accounts.google.com/.well-known/openid-configuration |
| Scopes | openid email profile |
| Subject ID | sub claim (stable, opaque) |
| One Tap | Auto-prompt sign-in via Google Identity Services |
2. Implementing Facebook Login
| Aspect | Detail |
|---|---|
| Protocol | OAuth 2.0 (proprietary userinfo via Graph API) |
| Endpoint | https://graph.facebook.com/me |
| Scopes | email public_profile |
| Token verification | POST debug_token endpoint |
3. Implementing GitHub OAuth
Example: GitHub OAuth code exchange
// Authorize: GET https://github.com/login/oauth/authorize?client_id=...&scope=user:email&state=...
// Callback receives ?code=...&state=...
const res = await fetch("https://github.com/login/oauth/access_token", {
method: "POST",
headers: { "Accept": "application/json", "Content-Type": "application/json" },
body: JSON.stringify({ client_id, client_secret, code, redirect_uri })
});
const { access_token } = await res.json();
const user = await fetch("https://api.github.com/user", {
headers: { "Authorization": `Bearer ${access_token}` }
}).then(r => r.json());
4. Implementing Twitter Authentication
| Aspect | Detail |
|---|---|
| Protocol | OAuth 2.0 + PKCE (v2 API) |
| Authorize | https://twitter.com/i/oauth2/authorize |
| Scopes | users.read tweet.read offline.access |
| Note | Email NOT included by default (requires elevated app) |
5. Implementing Apple Sign In
| Aspect | Detail |
|---|---|
| Protocol | OIDC |
| Endpoint | https://appleid.apple.com/.well-known/openid-configuration |
| Client secret | JWT signed with ES256 + Apple p8 key |
| Private email relay | User may share anonymized @privaterelay.appleid.com |
| Name returned | Only on FIRST authorization — must persist immediately |
| Required | If app offers any other social login (App Store rule) |
6. Implementing Microsoft Account Login
| Aspect | Detail |
|---|---|
| Protocol | OIDC via Microsoft Identity Platform (v2) |
| Tenant | common / consumers / organizations / {tenantId} |
| Endpoint | https://login.microsoftonline.com/{tenant}/v2.0/... |
| SDK | MSAL (browser, node, mobile) |
7. Handling Social Profile Data
| Field | Practice |
|---|---|
| External ID | Store as (provider, sub) unique key |
Trust only if email_verified=true | |
| Name / picture | Sync on each login (or first only) |
| Tokens | Encrypt at rest if storing access/refresh |
8. Linking Multiple Social Accounts
| Strategy | Detail |
|---|---|
| Email match | Auto-link if email_verified matches existing user |
| Manual link | User signed in → "Add Google account" |
| Data model | users (1) ←→ (N) identities (provider, external_id) |
| Conflicts | Detect & prompt user before merging |
9. Implementing Account Merging
| Step | Detail |
|---|---|
| Verify ownership | Both accounts authenticated in same session |
| Choose primary | Keep one user_id, migrate FKs from other |
| Audit | Log merge event + actor |
| Reversible? | No — confirm explicitly |
10. Handling Social Auth Errors
| Error | Handling |
|---|---|
| access_denied | User cancelled → return to login |
| invalid_request | Check redirect_uri exact match |
| consent_required (MS) | Re-prompt with prompt=consent |
| login_required | Trigger fresh login (no SSO session) |
| network | Retry with backoff |
11. Using Social Auth Libraries
| Library | Ecosystem |
|---|---|
| NextAuth.js / Auth.js | Next.js, multi-provider |
| Passport.js | Node — 500+ strategies |
| Spring Security OAuth2 Client | Java/Kotlin |
| Django allauth | Python |
| Auth0 / Clerk / Stytch | Hosted |