Setting password via updateUser does not add `email` provider to user identities

Open
#2,085 7 comments 16 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
go, javascript
Domain
authentication, backend

Research direction

Trace the updateUser({ password }) flow and the getUserIdentities and linkIdentity({ provider: 'email' }) entry points, then inspect how auth.identities is updated for OAuth users. Reproduce the Google sign-up and password-setting sequence, and verify that a subsequent identity lookup includes an email provider without breaking email/password login.

Written by the indexing model from the issue text.

Description

bug

Bug report

  • I confirm this is a bug with Supabase, not with my own application.
  • I confirm I have searched the Docs and GitHub Discussions.

Describe the bug

When a user signs up with an OAuth provider (e.g. Google) and later sets a password via

await supabase.auth.updateUser({ password: 'password' })

they can successfully log in with email/password, but the "email" provider is not added to the auth.identities table.

To Reproduce

  1. Sign up with Google (OAuth) using Supabase Auth.

  2. Call:

    await supabase.auth.updateUser({ password: 'password' })

  3. Inspect linked identities:

    const { data: identities } = await supabase.auth.getUserIdentities();

  4. Observe:

    • Email/password login works
    • No "email" entry appears in the list of linked identities

Expected behavior

After updateUser({ password }), the "email" provider should be automatically linked and visible in the auth.identities table, just as when using linkIdentity() for OAuth providers.

System information

  • OS: macOS
  • Browser: Chrome
  • Version of supabase-js: 2.50.3
  • Version of Node.js: 22.8.6

Additional context

When calling updateUser({ password }), either the auth.identities table should be updated with the "email" provider, or linkIdentity({ provider: 'email' }) should be supported for the email provider.

This issue highlights a gap in Supabase Auth’s identity-linking lifecycle. Manual linking exists for OAuth-to-OAuth, but there is no supported mechanism to link the email provider after setting a password. Common workarounds include manual SQL inserts into auth.identities or tracking password capability in a custom table. A built-in fix or supported API for linking an email identity would resolve this inconsistency.

Dominant language
Go
Stars
2.6k
Forks
764
Avg merge
5d 3h
Merged PRs (30d)
39

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from supabase/auth

All issues in supabase/auth

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.