Next Auth with Google Provider: To confirm your identity, sign in with the same account you used originally

Question

I'm using T3 Stack and next auth to authenticate with google, currently using mysql DB,

but while trying to logging in I'm getting

To confirm your identity, sign in with the same account you used originally.

How can I resolve this?

Thanks.

Answer 1

This happens if you already sign-up with one provider (say Github) and then you try to sign-up with another provider (maybe Google this time) that uses same email. NextAuth intentionally does not support auto linking of accounts because of security concerns.

From the official doc: https://next-auth.js.org/faq

When an email address is associated with an OAuth account it does not necessarily mean that it has been verified as belonging to account holder — how email address verification is handled is not part of the OAuth specification and varies between providers (e.g. some do not verify first, some do verify first, others return metadata indicating the verification status).

With automatic account linking on sign in, this can be exploited by bad actors to hijack accounts by creating an OAuth account associated with the email address of another user.

If you want to get rid of this for testing purposes, you can simply remove the related user from the database (DO NOT DO THIS IN PRODUCTION THOUGH!).

Update:

As @KHB comment below; you may also use allowDangerousEmailAccountLinking setting to allow linking between identity providers.

Docs: https://authjs.dev/guides/providers/custom-provider