I briefly looked at spotify and I found that they use 2 providers: Themselves and facebook. Ie I can log in to spotify with facebook. But then it asks me for my spotify account when I downloaded the player and want to start the stream. Does it force me to remember a new password? I don't think it's a good feature to force users remember a new password. Soundcloud and Mixcloud work by Facebook account only and we were discussing a similar solution of how to simplify adding a provider to your service ie use case "add OAuth 2.0 provider" where optionally you may also add yourself as an OAuth provider.

Please tell me if you have any ideas about this.


1 Answer 1


I have experience with two sites that allow users to log on with third-party credentials:

  • Trello allows users to log on with either a Google account or with a Trello account

  • Stack Overflow required an OpenID account, but let you use any OpenID provider you wanted.

Over time, we implemented our own OpenID provider for Stack Exchange.

The experience has been that allowing arbitrary third-party identity providers, like Stack Exchange does, was a mistake. Third party identity providers disappear. Users forget which one they used. All users must learn about the concept of third-party authentication and usability suffers.

The Trello experience, where only Google is allowed as a third-party authentication, was entirely positive. Even novice users understood it right away, and many of them told us that they were happy to be able to "use their Google account to log on to Trello."

My recommendation would be to stick to a small, finite set of third-party authentication--probably no more than Google and maybe Facebook if your site has social implications--but still let users create passwords on your site as an alternative.

  • I think the standard of Google, Twitter and Facebook is a good mix. Picking just one is sure to lose a lot of people, and picking just Facebook can scare off a lot of people that don'' care to share facebook details at all. Google has a high market penetration and the great thing about Twitter as an open ID is your Twitter info is public; I'm not giving you ANY personal information by using it.
    – Zelda
    Commented Nov 8, 2011 at 2:01
  • Thank you very much for the answer. In practice I've implemented "login with Facebook" and "login with Google" for my site where before I had many other providers then I found that only FB and Google are used so I made a multi-oauth 2.0 serverside implementation using GAE (python) and the experience is that it is quite different programmatically to handle a facebook user compared to a google user so even such a small multi-authentication got quite complex though still more manageble than twitter as well etc. Also adding yourself as a provider is very interesting. Thank you for answering! Commented Nov 19, 2011 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.