{"record":{"id":"39ee61097cea78aa","repo":"nextauthjs/next-auth","slug":"another-account-already-exists-with-the-same-e-mai","errorCode":null,"errorMessage":"Another account already exists with the same e-mail address","messagePattern":"Another account already exists with the same e-mail address","errorType":"exception","errorClass":"AccountNotLinked","httpStatus":null,"severity":"error","filePath":"packages/core/src/lib/actions/callback/handle-login.ts","lineNumber":192,"sourceCode":"        await linkAccount({ ...account, userId: user.id })\n        await events.linkAccount?.({ user, account, profile })\n\n        // As they are already signed in, we don't need to do anything after linking them\n        const currentAccount: AdapterAccount = { ...account, userId: user.id }\n        return { session, user, isNewUser, account: currentAccount }\n      }\n\n      // If the user is not signed in and it looks like a new account then we\n      // check there also isn't an user account already associated with the same\n      // email address as the one in the request.\n      const userByEmail = profile.email\n        ? await getUserByEmail(profile.email)\n        : null\n      if (userByEmail) {\n        // We don't trust user-provided email addresses, so we don't want to link accounts\n        // if the email address associated with the new account is already associated with\n        // an existing account.\n        throw new AccountNotLinked(\n          \"Another account already exists with the same e-mail address\",\n          { provider: account.provider }\n        )\n      } else {\n        // If the current user is not logged in and the profile isn't linked to any user\n        // accounts (by email or provider account id)...\n        //\n        // If no account matching the same [provider].id or .email exists, we can\n        // create a new account for the user, link it to the OAuth account and\n        // create a new session for them so they are signed in with it.\n        user = await createUser({ ...profile })\n      }\n      await events.createUser?.({ user })\n\n      await linkAccount({ ...account, userId: user.id })\n      await events.linkAccount?.({ user, account, profile })\n\n      session = useJwtSession","sourceCodeStart":174,"sourceCodeEnd":210,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/lib/actions/callback/handle-login.ts#L174-L210","documentation":"An AccountNotLinked error thrown during sign-in when the user is not signed in, no existing user matches the provider account, but the profile's email already belongs to an existing user. Auth.js does not trust user-supplied emails, so it refuses to auto-link, throwing at handle-login.ts:192.","triggerScenarios":"First-time OAuth sign-in where the OAuth profile email equals the email of an already-registered user (e.g. registered via email/magic link earlier), with allowDangerousEmailAccountLinking disabled and no account row linking them.","commonSituations":"User registered by email link previously and later tries to sign in with Google using the same address; providers (like some enterprise IdPs) where emails are not verified; shared/role inboxes (support@company.com) used by multiple login methods.","solutions":["Set allowDangerousEmailAccountLinking: true on the provider if you verify emails yourself and accept the risk.","Have the user first sign in with the original method, then link the OAuth account from the account settings.","Manually insert the account row linking the provider account to the existing user (or expose a link-account flow).","Ensure the provider returns email_verified so verified-email linking can be considered where supported."],"exampleFix":"// before\nGitHub({ clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET })\n// after\nGitHub({ clientId: process.env.GITHUB_ID, clientSecret: process.env.GITHUB_SECRET, allowDangerousEmailAccountLinking: true })","handlingStrategy":"try-catch","validationCode":"// Pre-check in your sign-in page:\nconst userByEmail = await adapter.getUserByEmail(profile.email)\nif (userByEmail && !allowDangerousEmailAccountLinking) {\n  // show 'account exists — sign in with your original method to link'\n}","typeGuard":null,"tryCatchPattern":"try {\n  await signIn('google')\n} catch (e) {\n  if (e instanceof AccountNotLinked) {\n    // prompt user to sign in with the original method and link there\n  }\n}","preventionTips":["Enable allowDangerousEmailAccountLinking only when the provider verifies emails and you accept the risk.","Prefer an explicit 'link account' flow while the user is authenticated.","Avoid shared inboxes as registered emails.","Return email_verified from custom providers when the IdP verifies addresses."],"tags":["oauth","account-linking","email","authjs"],"backgroundTag":"account-not-linked","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}