ReferenceSequence diagrams
Social IdP linking
Linking a Google/GitHub/etc. account to an existing password identity
Critical security check
If the OIDC email matches an existing identity's verified email, do not auto-link. The confirmation step prevents pre-linking attacks.
See Identity, Account linking for the full security rationale.