Social providers and account linking
The issuer supports configured GitHub, Google, Apple, X/Twitter, and Discord providers. Presence in source does not guarantee every deployment has valid credentials or exposes the provider in every flow.
User workflow
Sign in to Sigma, select the intended identity, and manage linked accounts in account settings. Complete the provider's own approval screen. Some linking flows require a fresh wallet proof for that exact provider; a session alone may not authorize linking a missing or different email.
Linking does not automatically upload an encrypted backup. Verify both cloud backup status and its recovery mapping before depending on a provider for restore. Provider evidence can also contribute to certificate eligibility; catalog presence does not mean issuance is active.
Operator configuration
| Provider | Server environment variables |
|---|---|
| GitHub | GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET |
NEXT_PUBLIC_GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET | |
| Apple | APPLE_CLIENT_ID, APPLE_CLIENT_SECRET |
| X/Twitter | X_CLIENT_ID, X_CLIENT_SECRET |
| Discord | DISCORD_CLIENT_ID, DISCORD_CLIENT_SECRET |
Register callbacks on your own issuer origin using Better Auth's /api/auth/callback/{providerId} convention. The X provider's internal ID is twitter; the credential variables use X_. Keep provider secrets server-side and use separate staging applications/callbacks.
The actual configuration is in lib/auth.ts and lib/auth-config.ts. Follow each provider's current dashboard requirements for allowed redirects, scopes, and key lifetime. Do not grant unrelated access merely to enable identity linking.
Linking policy
Implicit social signup is disabled unless the initiating flow explicitly requests signup. Account linking requires the configured verified-email and proof policy. Do not silently merge users by a user-editable profile email. Apple private-relay email is redacted from supported returned claims; do not depend on receiving it.
A provider login proves control of that provider account. It does not decrypt a backup, sign as a BAP identity, or transfer the external account's private keys. See social recovery and account security.