Getting `OAuthAccountNotLinked` login error if using the same email for another OAuth provider

[jonidelv]

Question 💬

If I'm already signed in with Google and then (after logout) try to sign in with Twitter OAuth using an account with the same email, I get:

OAuthAccountNotLinked: If the email on the account is already linked, but not with this OAuth account

I don't understand the purpose of this, it will be great to login with multiple OAuth providers even if they have the same email, just link the same account/user with multiples providers.

How to reproduce ☕️

login with google OAuth provider, logout, then login using a different OAuth provider (Twitter) but with an account that has the same email as the first OAuth provider (google).

Contributing 🙌🏽

No, I am afraid I cannot help regarding this

[mohammed-bahumaish]

As mentioned in the FAQ

      Automatic account linking on sign in is not secure between arbitrary providers - with the exception of allowing users to sign in via an email addresses as a fallback (as they must verify their email address as part of the flow).
      
      When an email address is associated with an OAuth account it does not necessarily mean that it has been verified as belonging to account holder — how email address verification is handled is not part of the OAuth specification and varies between providers (e.g. some do not verify first, some do verify first, others return metadata indicating the verification status).

it's not secure, but you can make a fork and modify to your needs.
I have made a fork of next-auth to accept auto linking. I'm using only email and google sign in. so it's fine.

[balazsorban44]

As said above. We only link accounts while you are logged in with one of them for security reasons.