So first, automatic account linking is a dangerous from a security point of view (happy to explain why if you want). But if you still want to do it, then you have a few options: - If the same email is used to sign up with google, and then they use email / password sign up, you could show an error to the user saying that they had already used this email to sign up via google and to use that (this is what we do on our site) - If you want to link accounts, you would need to maintain a separate table on your end that maps supertokens' userIds to your userId (many supertokens' IDs can map to the same, your userId). Then you would need to insert into this table based on the users email (post sign up), and also override all the thirdpartyemailpassword recipe functions to use your mapping when returning the userId. You can do both of these by using the override feature we have. It may be a little complicated to figure it out, but I can provide examples of how to do what you want.

Yeah, that would be great thank you

Also isn't that what most companies do, log into the same account with the same email, it links them?

Yea. A lot of them do that. But it’s a bad idea cause let’s say you provide 3 ways to login. If any of those 3 ways get compromised for a user (like if u have sign in with google and their google account is Compromised), then the attacker can gain access to that user’s account even if they didn’t use that method to sign up

Hmm yeah, I can see the problem with that, but we only offer "Google" and "Email and Password", and most people use gmail for their emails anyway, I see the risk involved, but It is a risk we are willing to take, could you provide any examples on how to do this please?

Sure. I’ll make an example tomorrow 🙂 (it’s 3:30 am here)

Yeah, thank you 🙂

@User , I have created an example app that has account linking: https://github.com/supertokens/supertokens-auth-react/tree/account-linking-example/examples/with-account-linking using our override feature. It's work in progress (docs and explanation for it are left), but it is working! Should be completely done by monday evening.

Thank you 🙂

You will want to see this: https://github.com/supertokens/supertokens-auth-react/blob/account-linking-example/examples/with-account-linking/api/override.js

That file has all the customised logic.

Ah ok

Will write docs explaining how it works in the next 2 days.

Yeah sounds great, thank you

Hi everyone, is anyone using Supertokens to auth mobile users, even if through a web based login page? Is there any docs for that? We have Flutter apps

Hey @snipebin we don’t have support for mobile yet. Our mobile SDKs for session management are outdated and need updating. Until then, I’m afraid that you won’t be able to use us for mobile.

@rp thanks, is there an ETA for mobile app support?

@snipebin flutter can be updated in 2-3 weeks time

@User i have added comments / explanation to the demo app: https://github.com/supertokens/supertokens-auth-react/tree/master/examples/with-account-linking

Thank you this is perfect

Hi, I'm looking at the Blitz.js example [1] and I'm wondering how can I get the user id on the server from the session? Specifically, the `getCurrentUser`[2] query in the example doesn't seem to be connected with Supertokens. How can I adapt it to return the authenticated user? [1] https://github.com/supertokens/supertokens-auth-react/tree/master/examples/with-blitz [2] https://github.com/supertokens/supertokens-auth-react/blob/master/examples/with-blitz/app/users/queries/getCurrentUser.ts

@User you can see how getting info from session works in NextJS’ API here: https://github.com/supertokens/next.js/blob/canary/examples/with-supertokens/pages/api/user.js

And perhaps use that to work with blitz? I’m not entirely sure how to wire it all up with blitz just yet.

That's awesome - is that currently scheduled in the roadmap? And if not, can I hit you up to get it prioritized when we need it?

Not currently scheduled, but yes you can reach out and we can try to accommodate

Hi, is there a configuration option for setting password reset token validity time? I can only see options for access and refresh tokens.

@Zoomeez there isn’t such a config option at the moment. Is there a problem with the default one?

@User we would like to send out an invitation link where the account is already created and the user only needs to enter a new password. We tried this by sending a password reset link, but we would like for this link to be active longer

Ahh I see. Makes sense

You could create an issue about it on our GitHub and we will add this