What Is Third-Party Sign-In? How ‘Continue With’ Login Works

Third-party sign-in lets you access one website or app using an account managed by another identity provider. Instead of making a new password for every service, you might sign in through an external account provider. The method can be convenient, but you should understand what information is shared and how to revoke access.

The three participants in a typical login

• You: the person trying to sign in.
• The website or app: the service you want to use.
• The identity provider: a separate service that verifies your identity and sends an authorized sign-in result back to the first app.

The identity provider does not necessarily hand your password to the website. Modern implementations commonly use token-based protocols, but the exact data and permissions depend on the product and consent screen.

What happens when you tap Continue With

1. You choose the external sign-in option on the website.
2. The flow directs you to the identity provider or an authorized sign-in interface.
3. You authenticate, possibly with a passkey or second factor.
4. The identity provider returns an approved authentication result.
5. The original website creates or unlocks your account based on that result.

What personal information might be shared?

A website may receive your account identifier and basic profile details, such as a name or email address, depending on the flow. More extensive data—calendar, contacts or files—requires additional authorization in many systems. Always read the requested scope rather than assuming that a login request means unrestricted access.

How this differs from an authenticator app

A third-party identity provider confirms your identity to another service. An authenticator app can instead generate or approve a second factor for a login. These functions may coexist, but they are not identical.

Safety checklist before approving

1. Check that you are on the legitimate service and recognized identity-provider page; beware of phishing lookalikes.
2. Read the permissions and decline optional access you do not need.
3. Enable multifactor authentication on your primary identity account.
4. Use trusted personal devices and keep their software current.
5. Review the connected-app list periodically and revoke access you no longer need.

What if the provider account becomes unavailable?

You may lose a convenient way to sign in to connected websites. Where supported, add an alternate recovery method and keep your identity-provider recovery options current. Do not share one-time codes with someone contacting you unexpectedly.

FAQ

Does third-party sign-in mean the website can read my password?

In a correctly designed modern external sign-in flow, the relying website usually does not receive your password. Avoid entering credentials into suspicious copies of the provider’s login page.

Can I stop using an external login later?

Often you can unlink a connection and establish another sign-in method, but options vary. Confirm a replacement method works before removing the old one.

Is a sign-in button the same as permission to access photos?

No. Authentication and authorization are related but distinct. Some apps request extra permissions in addition to verifying identity.

Related security guidance

The FTC’s two-factor authentication guide explains additional account protection. See Wondelique’s third-party app permission checklist for privacy reviews.