Identity provider (IdP)
The system that actually holds the accounts and vouches for who a user is, so your app can trust its answer instead of storing passwords.
See it
What it is
An identity provider owns the accounts and answers one question for everyone else: 'is this really them?' Your app becomes a relying party (OIDC) or service provider (SAML) and trusts a signed answer instead of storing passwords, running MFA, and handling password resets itself. Google, Microsoft Entra ID, Okta, Auth0, Clerk, and WorkOS are all playing this role, as is your own auth service if you built one.
Reach for an external IdP when the credentials are not really yours to hold: enterprise customers whose IT department must control offboarding, consumer apps that want 'Continue with Google', or any team that would rather not be the one who leaks a password table. The tradeoff is that login availability and login UX now belong to somebody else.
Gotcha: the IdP's subject id is the only stable handle you get, and even that is only stable per issuer. Email addresses change, get reassigned, and arrive unverified from some providers, so treat email as a mutable attribute. But a vendor name is not a key either: 'Google' or 'Okta' can cover several issuers and tenants, and an OIDC sub is only unique inside one issuer. Key the identity on iss + sub, plus whatever connection or tenant context the provider requires. Enterprise buyers will also expect more than one IdP per tenant, so do not hardcode a single one.
Ask AI for it
Wire this app to an external identity provider over OIDC: register the app as a relying party, redirect to the provider for login, validate the returned ID token (issuer, audience, expiry, signature via JWKS), and create or look up a local user keyed by the issuer claim plus the subject claim (iss + sub), not by email and not by a vendor name, carrying connection or tenant context alongside them where the provider needs it. Keep a provider_accounts table with a unique constraint on that pair so one user can have several identities, and support configuring a different IdP per organization.