Authentication
How TotalApp recognizes you across sign-in methods — which providers link automatically to your existing account, and which stay separate on purpose.
Overview
You can sign in to TotalApp with an email and password, or with a third-party provider like Google, GitHub, GitLab, Bitbucket, or LinkedIn. Behind the scenes, TotalApp needs to decide whether a sign-in belongs to an account you already have, or whether it should create a brand-new one.
To make that decision safely, TotalApp uses a concept called a canonical user ID — the same idea used by many major platforms (for example, Render.com describes an almost identical pattern in its own documentation). In plain terms: if you already have an account under the email you@example.com — whether you created it with a password or by signing in with Google — and you later sign in with GitHub using that same, verified email address, TotalApp links you to your existing account instead of creating a duplicate one. You keep the same tenant membership, the same role, and the same data — no matter which provider you used that day.
Providers that link automatically by verified email
The following sign-in methods are treated as the same identity whenever the provider confirms the email address is verified:
Signing in with Google links to your existing account if the email matches and Google reports it as verified.
GitHub
Signing in with GitHub links to your existing account if the email matches and GitHub reports it as verified.
GitLab
Signing in with GitLab links to your existing account if the email matches and GitLab reports it as verified.
Bitbucket
Signing in with Bitbucket links to your existing account if the email matches and Bitbucket reports it as verified.
Signing in with LinkedIn links to your existing account if the email matches and LinkedIn reports it as verified.
This means you can move freely between these five sign-in methods — sign in with Google today, GitHub tomorrow, LinkedIn next week — and always land in the same account, with the same tenant and role, as long as the email address matches and the provider marks it as verified.
jane@company.com. Next month, on a new laptop, you sign in with GitHub — and your GitHub account also uses the verified email jane@company.com. TotalApp recognizes this as you, and signs you straight into your existing account, tenant, and role. No new account is created, and nothing needs to be re-invited or reassigned.
Integrations that stay separate on purpose
Not every connected provider is merged into your personal login by email. Two integrations are always kept as their own, separate connection — even if the email happens to match one of your other logins:
| Integration | Why it stays separate |
|---|---|
| Shopify | Shopify represents a shop (store) identity, not a personal login. The email on file for a Shopify store is the store owner's contact email, which could coincidentally match a completely different person's TotalApp account. Because of this, Shopify sign-in is always kept as its own independent integration and is never merged into another account by email. |
| Slack | Connecting Slack to TotalApp requests workspace-level permissions (the ability to post messages and interact with channels on your workspace's behalf) — this is different from a simple "Sign in with Slack" identity check. Because it grants access to an entire workspace, Slack always requires its own explicit authorization from you and is never silently merged into another login by email. |
Why TotalApp only merges on a verified email
Linking accounts by email is only ever done when the sign-in provider itself confirms that the email address has been verified — meaning the provider has already checked that the person signing in actually controls that inbox.
This check matters for a simple reason: on some services, a person can type in any email address without ever proving they own it. If TotalApp linked accounts based on an unverified email, someone could type in your email address on a provider that doesn't check ownership, and potentially gain access to your tenant membership or role simply by claiming your address — without ever receiving a confirmation link or proving they control your inbox.
By strictly requiring the provider's own verified-email flag before linking, TotalApp ensures that only the real owner of an email address — who has already proven that ownership to the identity provider — can be linked into an existing account.