Account linking is the process of connecting multiple sign-in identities to one account so a customer can use different methods to access that account.

A customer might register with a password and later choose a social sign-in. Without a deliberate linking process, the application may create a duplicate account or connect the new identity to the wrong person. Linking should preserve a clear relationship between the application account and each identity permitted to access it.

How account linking works

The application maintains its own account identifier and associates it with identifiers from supported sign-in providers. For OpenID Connect, the combination of issuer and subject identifies a user at a provider. An email address can be an account attribute, but it should not replace that stable association.

A typical customer-initiated flow has three stages:

1. The customer authenticates to the existing application account, with fresh verification when required by policy.
2. The customer authenticates through the additional provider and explicitly requests the link.
3. The application validates the new authentication, checks for conflicting associations and records the approved relationship.

The application should notify the customer when a new sign-in route is added. Audit records should show which identities were linked and when, without storing authentication secrets in the event log.

Why matching email addresses is risky

The same email text can appear in accounts with different verification histories or ownership assumptions. Addresses can also change or be reassigned. Automatically linking solely because two strings match can give an attacker a new route into an existing customer account.

For example, a retail customer adding social sign-in should prove control of the existing retail account as well as the new identity. A verified email claim can inform policy, but it does not resolve every question about who should be allowed to add an authentication method.

Linking, merging and recovery

Linking adds a sign-in relationship. Merging combines records from separate application accounts, potentially including purchase history and saved preferences. A service can support one without automatically performing the other.

Unlinking needs equal care. Before removing a provider, the application should ensure the customer retains an approved way to sign in or recover access. Otherwise a routine settings change can lock the customer out.

Business accounts introduce another boundary: linking an employee’s personal identity must not silently preserve access after that employee leaves a customer organization. Organization membership and its permissions need independent lifecycle controls.

Frequently asked questions

Is account linking the same as single sign-on?

No. Single sign-on lets an identity provider support access to applications. Account linking associates multiple sign-in identities with a particular application account.

Can matching email addresses safely trigger automatic linking?

Email matching alone is an insufficient general rule. A secure process considers provider trust, verified control of the accounts and the customer’s intent.

Does unlinking delete the customer’s account?

Usually it removes one sign-in association. Account deletion and record merging are separate operations, and the application should make their effects clear.

Related: Customer Identity · User Management · Identity Federation · Account Recovery · Account Takeover (ATO) · OpenID Connect (OIDC)