Account Linking & Provider Management
Let one user own a single account across multiple sign-in methods by linking and unlinking auth providers, handling collisions, and managing linked credentials safely.
Account Linking & Provider Management is a free Firebase Auth & Realtime Database Apps lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Firebase Auth & Realtime Database Apps learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The Multi-Provider Problem
The same person may sign in with email/password today and Google tomorrow. Without linking, Firebase could treat these as two separate accounts.
Account linking unifies multiple sign-in methods under one Firebase user (one uid).
How Linking Works
Linking attaches an additional credential to the currently signed-in user. The user keeps the same uid and data, but gains a new way to log in.
- Email/password can be linked to a social account
- Multiple social providers can coexist
Linking a Provider
Use linkWithPopup on the current user to add another provider interactively.
import { getAuth, GoogleAuthProvider, linkWithPopup } from 'firebase/auth';
const user = getAuth().currentUser;
await linkWithPopup(user, new GoogleAuthProvider());
console.log('Google linked to existing account');Linking a Credential Directly
When you already hold a credential (for example email/password the user just typed), use linkWithCredential.
import { EmailAuthProvider, linkWithCredential } from 'firebase/auth';
const cred = EmailAuthProvider.credential(email, password);
await linkWithCredential(getAuth().currentUser, cred);The Collision Error
If the new provider's email already belongs to a different account, Firebase throws auth/account-exists-with-different-credential. This is the key case you must handle.
Resolving a Collision
To resolve it: read the conflicting email, ask the user to sign in with the existing provider, then link the new credential onto that account.
import { fetchSignInMethodsForEmail } from 'firebase/auth';
const methods = await fetchSignInMethodsForEmail(auth, email);
// prompt user to sign in with methods[0], then link pendingCredInspecting Linked Providers
The user object exposes providerData, an array describing every linked provider. Use it to render a 'connected accounts' settings screen.
const user = getAuth().currentUser;
user.providerData.forEach(p => console.log(p.providerId));Unlinking a Provider
Let users disconnect a method with unlink, passing the provider ID. Always keep at least one sign-in method so the account stays accessible.
import { unlink } from 'firebase/auth';
await unlink(getAuth().currentUser, 'google.com');Guarding the Last Provider
Before unlinking, check that more than one provider remains. Removing the only method would orphan the user.
const user = getAuth().currentUser;
if (user.providerData.length <= 1) {
showError('You must keep at least one sign-in method.');
return;
}Reauthentication for Sensitive Changes
Linking or unlinking is a sensitive operation. If the user's session is old, Firebase may require recent login and throw auth/requires-recent-login. Reauthenticate before retrying.
import { reauthenticateWithPopup } from 'firebase/auth';
await reauthenticateWithPopup(user, new GoogleAuthProvider());Design Considerations
Plan your identity model up front:
- Treat email as the unifying key when possible
- Surface linked accounts in user settings
- Always handle the collision error gracefully
Quick Check
Test your understanding of account linking.
Recap
You can now unify identities across providers.
- Link with
linkWithPopuporlinkWithCredential - Handle
account-exists-with-different-credential - Inspect
providerDataand unlink safely - Always keep at least one provider
- Reauthenticate for sensitive changes
Frequently asked questions
Is the “Account Linking & Provider Management” lesson free?
Yes — the full text of “Account Linking & Provider Management” is free to read here on the web, and the Firebase Auth & Realtime Database Apps course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Firebase Auth & Realtime Database Apps course, upgrade to CoddyKit PRO.
What will I learn in “Account Linking & Provider Management”?
Let one user own a single account across multiple sign-in methods by linking and unlinking auth providers, handling collisions, and managing linked credentials safely. You practise Firebase Auth & Realtime Database Apps with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Firebase Auth & Realtime Database Apps?
No prior experience is required. Firebase Auth & Realtime Database Apps on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Account Linking & Provider Management” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Firebase Auth & Realtime Database Apps lesson?
Yes. Every Firebase Auth & Realtime Database Apps lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Phone Number Authentication
- Multi-Factor Authentication (MFA)
- Custom Claims & Security Rules
- Account Linking & Provider Management