Third-party sign-in needs an end-to-end review. PKCE is one protection mechanism, not a complete account or authorization system. SEPARATE THE GOALS OAuth describes delegated access; OpenID Connect is commonly used above OAuth to establish identity. Begin by documenting whether the application receives identity information, permission to read particular data, or both. A sign-in button does not describe those permissions. Remove unnecessary scopes and review whether the consent screen is understandable. THE ROLE OF PKCE RFC 7636 defines a verifier and derived challenge that bind the authorization request to the code exchange. RFC 9700 provides current OAuth security guidance, including PKCE. Use S256 and the provider's supported library for the applicable flow. A short example is not a reason to invent a custom code-exchange implementation. WALK THROUGH THE USER JOURNEY With a test account, check first sign-in, repeat sign-in, cancelled consent, a closed tab and return after session expiry. Write an expected result for every step. Test account linking separately: the same email address is not, by itself, a reason to merge profiles belonging to different people. Review the provider and application's account-linking rules before accepting this behavior. REVIEW THE BOUNDARIES Keep the registered return-address list precise. After sign-in, the server still needs to enforce permissions on data and operations. Do not put authorization codes, tokens or secrets into general support logs. Use test data and a log of safe states such as started, cancelled, completed and failed rather than credential values. Before launching an API product, record the provider, return addresses, requested scopes, responsible owner and access-revocation procedure. When selecting a domain, plan a stable sign-in address and a review process for future changes. This connects branding decisions with a concrete operational requirement without claiming that the domain purchase includes an identity service. Image: AI photoillustration created for this article; a conceptual scene, not a documentary photograph. Domain catalogue: https://domainevery.com/en/domains Primary sources: https://www.rfc-editor.org/rfc/rfc9700 https://www.rfc-editor.org/rfc/rfc7636 https://auth0.com/docs/get-started/authentication-and-authorization-flow
