MonoCloud for Startups
One identity layer for your customers, APIs, and agents
Start new thread

Your user signs in with Google today and Apple tomorrow. Is that one account or two?

by
•

I was thinking about this because it sounds like such a small product decision, but I don’t think it actually is.

Someone signs up with Google. Six months later they are on their iPhone and tap “Sign in with Apple.” Same person, different identity provider. And if they use Hide My Email, you may not even get the same email address.

So what should the product do?

Creating a new account feels wrong because now their history, billing, settings, or subscription can end up split across two profiles. But automatically linking accounts based on email also feels risky, because now you are assuming that matching email addresses are enough proof that both identities belong to the same person. And then Apple makes it even messier because the emails may not match at all.

I’m curious how people here think about this.

Do you treat each identity provider as a separate account unless the user explicitly links them? Do you auto-link in some cases? Do you have some other rule entirely?

And if you have dealt with this in a real product, what edge case caused the most trouble?

52 views

Add a comment

Replies

Best

This is one of those auth problems that looks simple until billing and account history get involved. I’d lean toward explicit linking.

 Same. I would lean toward explicit linking too, especially once billing or account history is attached.

I would rather make the user re-authenticate the existing account before linking than trust a matching email alone. It adds a little friction, but at least you are proving control over both identities instead of assuming they belong to the same person.

I’d definitely avoid silently creating a second profile. Seeing an empty dashboard after signing in with Apple when all your data is under Google would be incredibly confusing.

Maybe the account should be the primary object, while Google and Apple are simply authentication methods attached to it. That mental model feel cleaner.

two accounts by default. auto linking is a major security risk.

I think the safest UX is probably separate identities by default, with a simple Link Google Apple option inside account settings.

One edge case I’ve seen is people changing their email after signup. Email matching can become unreliable pretty quickly once that happens.

The billing angle is what makes this more than an authentication problem. Splitting a subscription between two profiles can turn a small UX issue into a support ticket.

A visible list of connected login methods could help a lot. Users could immediately see whether Google, Apple, or another provider is attached to their account.

I’d be especially careful with enterprise accounts. An accidental identity link there could have much bigger consequences than lolsing a few personal settings.