# PDR 002: Use federated sign-in without first-party passwords

- HTML version: https://robbiepalmer.me/projects/recipe-site/pdrs/002-federated-sign-in-without-first-party-passwords
- Project: Recipe Site
- Status: Accepted
- Opened: 2026-05-25
- Decided: 2026-05-25

## Context

Recipe Site was moving from a public collection to personal recipe boxes,
household membership, and private cooking state. Those features needed user
accounts, but password registration would add forms, verification, resets,
recovery, credential storage, and breach support before the product had proved
that people wanted authenticated features.

The first audience was friends and household members who already used Google.
Technical friends and likely early Cooklang contributors already used GitHub.
Both providers could supply verified identity without making Recipe Site the
holder of a new password database.

## Decision

Use federated sign-in as the initial account workflow. Lead with Google for the
general household audience and offer GitHub as a secondary route for technical
users. A new user creates an account through the same provider action that a
returning user uses to sign in, with no separate registration form.

Do not offer first-party email and password accounts. Recipe Site will not own
password storage, password resets, or account recovery for the initial product.
Magic links, passkeys, Apple sign-in, and other providers remain possible later
when a user need justifies their support and recovery cost.

Adding another sign-in method must not silently create a second account for an
existing person. The account-linking flow must show which provider identities
belong to the same Recipe Site account and require a verified, authenticated
linking action.

## Consequences

Most intended users can sign in without creating another password. Recipe Site
depends on external identity providers and must explain what happens when a
provider is unavailable or an account loses access.

People without Google or GitHub cannot create an account under this policy.
Public recipes remain readable without signing in, so the account boundary does
not also become a reading paywall or registration wall.

## Evaluation

The policy is working when a new user can enter the authenticated product
through one provider action, return to the same Recipe Site account, and link a
second provider without duplicating their recipes or household memberships.
Support evidence should determine whether another method is needed.

## Migration note

This record extracts the sign-in policy first recorded in ADR 003 and then
implemented for Google and GitHub in ADRs 007 and 008. It preserves the
original date and Accepted status. The migration changes the record structure,
not the supported sign-in methods.

## Related records

- Project: [Recipe Site](https://robbiepalmer.me/projects/recipe-site.md)
- Implemented by ADR: [ADR 003: Better Auth](https://robbiepalmer.me/projects/recipe-site/adrs/003-better-auth.md)
- Implemented by ADR: [ADR 007: Google OIDC Login](https://robbiepalmer.me/projects/recipe-site/adrs/007-google-oidc-login.md)
- Implemented by ADR: [ADR 008: GitHub OAuth Login](https://robbiepalmer.me/projects/recipe-site/adrs/008-github-oauth-login.md)

---

Markdown index of this site: https://robbiepalmer.me/llms.txt