Connected accounts

The "Connected accounts" card in Security settings shows which third-party providers (Google, GitHub) you have linked as login methods. You can sign in with any combination of password, Google, or GitHub. Each provider sits next to a Connect or Disconnect button.

Connecting a provider

  1. Click Connect next to Google or GitHub.
  2. You are sent to the provider. Sign in there and authorize Clickport. You will see exactly what we ask for: your email and your name.
  3. You are returned to Clickport. The provider is now marked Connected.

From now on, the provider's "Continue with Google" or "Continue with GitHub" button on the login page also works for your account.

Disconnecting a provider

Click Disconnect next to a connected provider. The link between Clickport and the provider is removed. Nothing else changes: your account, sites, sessions, and analytics data stay exactly the same.

You cannot disconnect your only login method. If your account has just Google linked and no password, the Disconnect button shows an error: "Cannot disconnect your only login method. Set a password first." Use Set a password to add one, then come back.

Email matching

When you click Connect, the provider tells us your email. Three things can happen:

  • An account already exists with that email. The provider is linked to that account on the spot. No separate confirmation step. (We trust the provider's email verification: Google and GitHub both verify the email before issuing the OAuth token.)
  • No account exists yet, and you are signing up: a new Clickport account is created with that email. Your name comes from the provider profile.
  • An account exists, but with a different email: the provider link will not attach. Clickport identifies accounts by email, and we do not silently merge accounts. Sign in to your existing account first, then click Connect from Security settings.

Two-factor authentication and OAuth

If you have 2FA enabled, password sign-ins go through the 2FA prompt, but OAuth sign-ins do not. The OAuth provider has already authenticated you (and is responsible for its own MFA on its side). Adding a second factor on our side after Google has already verified you would be redundant.

This is by design and matches how most products handle OAuth + 2FA. If you want every sign-in to require 2FA, disconnect the OAuth providers from this card.

What we store about a connection

  • The provider name (google or github).
  • The provider's stable user ID, so we can match you on subsequent sign-ins even if you change your email at the provider.
  • The email the provider gave us at the time of linking.

We never store your provider password, your provider session, or any data beyond the small profile object the provider sends back. The OAuth code we exchange for an identity token is single-use and discarded after the exchange.

Disconnecting does not log you out of Google or GitHub. It only removes the link between that provider and your Clickport account. To revoke Clickport's access on the provider side too, visit your provider's app permissions page (Google: myaccount.google.com/permissions, GitHub: github.com/settings/applications).