# Use OpenID Connect issuer and subject identifiers instead of email as primary keys

DevFeed: [Use OpenID Connect issuer and subject identifiers instead of email as primary keys](<https://devfeed.tech/articles/stop-using-email-as-a-primary-key-before-it-bites-you-16066.md>)

Original publisher: [Read original article](<https://workos.com/blog/stop-using-email-as-a-primary-key>)

Author: WorkOS

Published: 2026-08-06T00:02:33Z

Content type: tutorial

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [account takeover](<https://devfeed.tech/topics/account-takeover.md>)

Tags: [auth](<https://devfeed.tech/tags/auth.md>), [data](<https://devfeed.tech/tags/data.md>), [identity](<https://devfeed.tech/tags/identity.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [schema](<https://devfeed.tech/tags/schema.md>)

## AI overview

The article explains why email addresses are unsafe as identity keys because they can be reassigned or recycled. It recommends storing the OpenID Connect issuer and subject identifier pair as the stable key for provider logins, while retaining email as mutable profile data.

## Source excerpt

Email addresses get reassigned and recycled. If you key identity or link accounts on email, you built an account-takeover path yourself. Here's the fix.