What happens under the hood
- 01User clicks a social provider button (Google, GitHub, etc.)
- 02OAuth redirect to the provider's consent screen
- 03Provider returns an authorization code to the auth callback
- 04Code is exchanged for tokens, user account is created or linked
- 05Session is established, JWT issued with provider claims
Key tradeoffs
✓ Fastest signup. No form fields, pre-populated profile data
✗ Users may forget which provider they used, causing duplicate accounts
✓ Identity is maintained by the provider. Less liability for you
✗ Provider outages affect your login page (Google going down = locked out users)
✓ Access token lets you call provider APIs (read GitHub repos, Google Drive, etc.)
✗ Limited provider selection in some regions (China blocks Google/Meta)
Try it live
→ Click 'Continue with Google' or 'Continue with Apple'. Ignore the email field. Typing there triggers magic link instead of social login.