What causes "errors.social_account_not_used" in BookStackApp/BookStack?

Register first via /register/service/ (or the Register page) to create and link the account, then use social login

BookStackApp/BookStack · error · SocialSignInAccountNotUsed

errors.social_account_not_used

Error message

errors.social_account_not_used

What it means

SocialSignInAccountNotUsed exception thrown when a user completes social LOGIN (/login/service/<driver> callback) but no BookStack user is linked to that social account. Because login and registration are separate flows, BookStack cannot auto-create an account; it builds a message and, if registration is enabled (and auth method is not ldap/saml2), appends instructions to register instead.

Source

Thrown at app/Access/SocialAuthService.php:139

            session()->flash('error', trans('errors.social_account_existing', ['socialAccount' => $titleCaseDriver]));

            return redirect('/my-account/auth#social_accounts');
        }

        // When a user is logged in, A social account exists but the users do not match.
        if ($isLoggedIn && $socialAccount->user->id != $currentUser->id) {
            session()->flash('error', trans('errors.social_account_already_used_existing', ['socialAccount' => $titleCaseDriver]));

            return redirect('/my-account/auth#social_accounts');
        }

        // Otherwise let the user know this social account is not used by anyone.
        $message = trans('errors.social_account_not_used', ['socialAccount' => $titleCaseDriver]);
        if (setting('registration-enabled') && config('auth.method') !== 'ldap' && config('auth.method') !== 'saml2') {
            $message .= trans('errors.social_account_register_instructions', ['socialAccount' => $titleCaseDriver]);
        }

        throw new SocialSignInAccountNotUsed($message, '/login');
    }

    /**
     * Get the social driver manager used by this service.
     */
    public function drivers(): SocialDriverManager
    {
        return $this->driverManager;
    }

    /**
     * Fill and return a SocialAccount from the given driver name and SocialUser.
     */
    public function newSocialAccount(string $socialDriver, SocialUser $socialUser): SocialAccount
    {
        return new SocialAccount([
            'driver'    => $socialDriver,
            'driver_id' => $socialUser->getId(),

View on GitHub (pinned to 18f8469a1c)

Solutions

Register first via /register/service/<driver> (or the Register page) to create and link the account, then use social login
If registration is disabled, ask an admin to enable registration or create/attach the account for you
Double-check you clicked the correct provider button and that you're using the same social account you registered with
If the account should exist, verify the social_accounts table for the driver_id — it may be linked to a different user or a different provider account

Defensive patterns

Strategy: try-catch

Validate before calling

// Pre-check that the social account is linked before offering login
$linked = \BookStack\Access\SocialAccount::query()
    ->where('driver', '=', $driver)
    ->where('driver_id', '=', $socialUser->getId())
    ->exists();
if (!$linked && !(setting('registration-enabled') && !in_array(config('auth.method'), ['ldap', 'saml2']))) {
    return redirect('/login')->with('error', 'No account is linked to this social login. Please register first or contact an admin.');
}

Try / catch

use BookStack\Exceptions\SocialSignInAccountNotUsed;

try {
    $socialUser = $socialAuth->handleLoginCallback($driver);
} catch (SocialSignInAccountNotUsed $e) {
    return redirect('/login')->with('info', $e->getMessage()); // message already includes register instructions when applicable
}

Prevention

Provision/link accounts for new users before announcing SSO availability
Make the Register-with-X entry point discoverable when login-with-X fails for unlinked accounts
Check that registration is enabled if you rely on the built-in register hint in the error message
Remember social registration is disabled under ldap/saml2 auth methods — plan provisioning accordingly

When it happens

Trigger: User clicks a social login button (e.g. /login/service/google) for an IdP account that has never been registered/linked in this BookStack instance; handleLoginCallback finds no SocialAccount row for the returned driver_id and no matching flow to attach it.

Common situations: New employee uses company Google SSO login before an admin created/invited their account; user confuses the 'Login with X' button with 'Register with X'; registration disabled in BookStack so the extra register hint is omitted; auth method switched to ldap/saml2 making social registration unavailable.

Related errors

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/30c953449ed99468. Report an issue: GitHub.