I am just not sure which app has the source of truth. You are using Dicourse as identity provider that means each user by default should have a discourse account… But you also want users to access your app without relying to discourse, would that means discourse account is not required to access your app?. If that is true then probably what you need to do is develop to support auth with a third party apps, and then depending on the source of credentials(either discouese or 3rd party app) you set the logic of your app…