Secured Application Step 4: Add a Provider, Carefully

Add one social login provider to your application using a maintained library rather than hand-rolling the flow. Then work through the unhappy paths deliberately: decline at the provider, an email that already exists with a password, and a provider error. Decide and document your account-linking policy, in particular whether you link by email and what you require before doing so. If you decide not to add social login at all, write down why, which is also a legitimate outcome of this step.