Can we update email or phone number for Social Login users (like Google/Facebook)?

Get Help
,
1

I’m using multiple authentication methods in my SPA application — including Google, Facebook, phone OTP, and email/password login — via Auth0.

I want to confirm whether it’s possible to update the email address or phone number for users who signed up using social login providers like Google or Facebook.

  • If we use the Management API to update their email or phone number, will the change persist?
  • Or will Auth0 overwrite these changes on the next login when it syncs again with the provider?

The goal is to allow users to change their contact info (email/phone) even if they originally signed up using social auth.

Is there an officially supported pattern for this?

3

Hi @ankititsignups, and thank you for your question!

By default, any changes you make to a social user’s root email or phone_number using the Management API will be overwritten on their next login.

This happens because Auth0’s default behavior is to sync the user’s profile with the social provider (Google, Facebook, etc.), which is considered the “source of truth” for that identity’s core attributes.

However, you can treat the social provider’s email as the login identifier and store the user’s preferred, editable contact information in the user_metadata field. This field is a secure place to store custom user attributes that Auth0 will never overwrite during a social login sync.

The flow should be something like this:

  1. A user signs up with Google, and their Auth0 profile is created with the root email of user@gmail.com.
  2. Inside your application’s “Profile Settings” page, the user decides to update their contact email to user@work.com or add a phone number.
  3. When they save their changes, your backend makes a PATCH request to the Auth0 Management API to update that user’s user_metadata.

Example API Call:
PATCH /api/v2/users/{id}
Request Body:

{
  "user_metadata": {
    "contact_email": "user@work.com",
    "contact_phone": "+15551234567"
  }
}
  1. On their next login with Google, Auth0 will sync their profile, but it will only refresh the root attributes. The user_metadata containing their chosen contact information will remain untouched.

Your Application’s Responsibility: Your SPA must then be configured to look for contact information in user_metadata first. When you need to display a user’s email or phone number.

I hope this helps!
Teodor.