Account linking
Account linking associates identities from different sign-in providers with the same local user account or profile.
A person might register with one sign-in method and later use another. Linking lets the application recognize those identities as the same user instead of creating separate profiles. It gives the person another way into the existing account, so a mistaken link can expose that account to someone else.
Matching text does not prove account ownership
Okta documents account linking at the identity-provider level, including configurable matching rules. Auth0 warns that insecure linking can expose legitimate accounts and recommends authenticating both accounts before linking them.
Two profiles displaying the same email address are not enough information to approve an arbitrary link. The trusted provider, matching rules, and evidence of control matter. Avoid treating a familiar name as a stable identity identifier.
Linking differs from creating an account
Just-in-time provisioning can create a new local account during sign-in. Linking connects an identity to one that already exists. A configuration change can affect these behaviors differently.
Linking can also affect profile data. Auth0 keeps the primary account’s main properties and does not automatically merge metadata from the secondary account. Check which profile survives before treating linking as a way to merge customer records.