Never key your users on email

OAuth with Google · lesson 4 of 9 · 4 min read

The design decision that is painful to reverse once you have real users.

Open this lesson in the learning hub

Key points

  • Google’s sub claim is a stable, permanent id for that user. It never changes.
  • Email addresses do change, and a released address can be reassigned by a Workspace admin.
  • If your users table is keyed on email, a change silently creates a second account or hands over an old one.
  • Store sub as the identity key and treat email as mutable profile data.
  • Also check email_verified - an unverified email must never be used to match an existing account.

Key on sub. Email is display data that can be reassigned to someone else.

The Google exchange, step by step The errors you will actually hit

This is a reading copy. The full lesson — with the visual explainer, the interactive lab and a Run button for the code — lives in the OAuth with Google course, and every lesson in it is listed on the OAuth with Google contents page.