# Third-party accounts log into an account without verification

**URL:** <https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654>\
**Category:** Feature\
**Created:** [2014 年9 月 4 日 22:22 UTC](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654 "2014-09-04T22:22:47Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

作者： ![Lid](https://avatars.discourse-cdn.com/v4/letter/l/2bfe46/32.png) [@Lid](https://meta.discourse.org/u/Lid)\
发布日期： [2014 年9 月 4 日 22:54 UTC](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654/3 "2014-09-04T22:54:58Z")

</div>

It appears that twitter does not allow email retrieval to developer at all via oauth

> **[X Developer Platform](https://developer.twitter.com/)**
>
> Use the X API with an all-new Developer Console and consumption-based billing. No fixed monthly costs, no monthly caps.

f this link is still relevant I am not sure how discourse can associate the twitter account with an existing account email.

@stuartpb you a pointing out a possible weakness. Discourse should not rely on flowed oauth provider. (not saying that twitter is). If it is known that a common oauth provider does not verify email address Discourse can not rely on the email given by that provider.

But as it appear it is an hypothetical scenario.

also this is not going to solve this concern if the first verified user happened to be the user verified by a flowed oauth provider.

> Associating a new endpoint with an existing account should require verification from an already-authorized endpoint.

---

_[View the full topic](https://meta.discourse.org/t/third-party-accounts-log-into-an-account-without-verification/19654)._