Should I auto register users behind the scene when using social login button?

Question

I am building a service where I am allowing users to login using social buttons (for example, Facebook connect buttons). When a new user clicks on this social login button, I have two options:

1. Auto register a new user behind the scene and take him to the welcome new user page.
2. Take him to registration page and ask him if he would like to register with us.

There are pros and cons with both the approach with respect to usability. I am confused about which approach to take. With the first approach I might end up getting more registrations while with the second approach I would get more genuine users. Which option should I take?

Answer 1

Though there may not seem to be a big difference between the words "auto-login" and "auto-register", there's actually a very big difference in expectations. I've done work in this before and this can get into the weeds rather quickly, but it's best to understand things.

Background

Social or Third-Party Logins use a technology called OpenID or OAuth2. Stack Exchange uses this. Jeff Atwood wrote about it a few years ago.

It basically works like this:

If you want to understand more how it really works, I would recommend reading Jakob Jenkov's OAuth2 Tutorial.

Login vs. Register

If I "log-in" using a third-party login (i.e. Facebook, Twitter, OpenID), the expectation is that I won't have to create an account. One is created for me with my third-party login. Now I can always go into my profile settings and alter my password, email address and even disconnect my third-party login from my account, but I shouldn't have to then "create login." Pinterest does this.

Be aware though there are downsides to using social logins as your sole login method. A post over at Webmasters.SE outlines the downsides fairly well.

Some services though, for one reason or another, don't want to be dependent upon third-party providers for login authorization. So they tend to use a hybrid approach, using third-party logins as a 'jump-start' to their own account creation process. If you do this though, your CTA wording is very important. You aren't "logging in" with Facebook (or whatever login service). You're signing up with Facebook.

If a user "signs up" with Facebook, the site goes out to Facebook requests basic information about this user (name, email, whatever has been authorized) and pulls that back down and pre-fills the sign-up form with this data. Now the user just has to create / confirm a password and off they go. It is another login to remember, but some services feel social logins aren't worth it.

Answer 2

Definitely, definitely auto-register.

If I wanted to input my username, password, and email, I would've gone to the register page and input those fields.

Facebook login's basic permission gives you the ability to retrieve all the data you will ask for in the register page, as well as additional information you could use to fill out the user's profile (birthday, gender, etc.).

One thing that I have not seen yet is asking the user to create password if they want when they log in via social networks.

This step I believe is trivial. If the user ever forgets how he logged in, you allow him to either login via social network or with the combination of his email plus password.

One last thing is don't redirect to a "create password" page directly; show a small notification on the top of the page, asking the user to create a password IF he wants to create one.