Guide · Federation
Sign in with Google, Microsoft & GitHub
Your users get three more doors. You configure nothing.
How it works
The hosted sign-in page at authfu.app shows Continue with Authfu (email), Google, Microsoft, and GitHub. When a user picks an outside provider, that provider proves who they are — and that is all it proves.
The provider vouches for the identity
Google, Microsoft, or GitHub authenticates the user on their own pages and hands Authfu a verified identity. Microsoft coverage includes both personal accounts and any organization’s Entra tenant.The authenticator check still applies
If the Authfu account has two-factor enabled, the user is bounced to their authenticator code next — “Google verified it’s you. Your authenticator finishes the sign-in — no shortcuts.” Federation replaces the email leg of sign-in, never the authenticator leg.Your app receives a normal Authfu session
The OIDC code flow back to your app is identical regardless of which door the user chose. You do not receive Google/Microsoft/GitHub tokens, and you never handle their scopes.
Account linking
A Google or GitHub identity whose verified email matches an existing Authfu account links to it automatically; Microsoft identities link by the same rule. An account protected by an authenticator can never be entered — or linked — without its code, whatever the upstream provider says.
To attach an identity whose email does not match, the user runs the connect ceremony: signed in, from Security → Connected sign-ins, they pass a step-up check and are sent to the provider to prove the identity, which is then linked by the provider’s subject ID — the email never decides. Disconnecting is always allowed, and magic-link sign-in always remains available.
Session lifetimes
Sessions created by federation alone live on the short trust tier (about 24 hours), the same as email-only sign-ins — identity was proven, presence was not. Sessions backed by an authenticator or passkey get the full lifetime. Users see a gentle nudge to enrol an authenticator, never a wall.
FAQ
Do I need my own Google/Microsoft/GitHub credentials? No. That is the point.
Can I turn the buttons off for my app? Not yet — per-app provider selection is on the roadmap. Tell us if you need it sooner.
What does the consent screen show? Authfu’s name and mark. Your app’s own name and logo appear on the Authfu sign-in page when users authenticate to your app.