Batoi supports signing in with external identity providers such as Google and Microsoft. These providers make login faster and reduce the number of passwords you manage — but they must be connected to a Batoi account in a controlled way.
If you already have a Batoi account with the same email address as your Google or Microsoft account, Batoi does not automatically merge the two the first time you use SSO. This is intentional, and this article explains how the linking works and what to do at each step.
Why Batoi Does Not Auto-Link by Email
An email address alone is not enough to safely merge identities. Before treating an external login as the same person, Batoi needs a confirmed link between your Batoi account and the external provider account.
Auto-linking purely on a matching email could associate an account incorrectly because of provider configuration, organizational tenant policy, recycled or reassigned addresses, or incomplete verification data. Requiring a deliberate connection protects your account from being joined to the wrong identity.
KEY PRINCIPLE
A matching email is a clue, not proof. Batoi only trusts an external login once you have signed in and explicitly connected the provider yourself.
What Happens When You Try SSO
When you attempt to sign in with Google or Microsoft, Batoi evaluates one of three situations:
Provider already linked SIGNS YOU IN
If your Google or Microsoft identity is already connected to your Batoi account, Batoi recognizes the provider account and signs you in immediately.
Email exists, provider not linked ACTION NEEDED
If your provider identity is not linked yet but the email already belongs to an active Batoi account, Batoi will not silently connect it. You will be asked to sign in with your Batoi password first, then connect the provider from your account settings.
No existing account NOT ALLOWED HERE
If no Batoi account exists for the email address, SSO login is not automatically permitted through the normal login page. New accounts via SSO are created only through approved signup or trial signup flows.
How to Connect Google or Microsoft to Your Existing Account
Linking takes less than a minute and only needs to be done once per provider:
What Batoi Stores
When a provider is connected, Batoi stores a provider identity link rather than relying on the email address alone. This link lets Batoi confirm that the same external account is returning on future logins.
| STORED ELEMENT | PURPOSE |
|---|---|
| Provider name | Identifies whether the login came from Google or Microsoft. |
| Stable subject identifier | The provider's permanent ID for the account — the primary key for recognizing the same user even if display details change. |
| Verified email address | The confirmed email associated with the external identity at the time of linking. |
| STORED ELEMENT | PURPOSE |
|---|---|
| Login metadata | Supporting details needed to recognize and validate the account on later sign-ins. |
Why this matters
because Batoi keys future logins on the stable subject identifier rather than the email address, a recycled or re-pointed email cannot quietly take over your account.
If You See an “Existing Account” Message
If Batoi tells you that an existing account already uses the email address, follow this path:
If you do not remember your Batoi password, use the password reset option for that email address. Once you regain access, connect the provider from your account settings as above.
Workspace Owner Notes
Workspace Owners should encourage users to connect providers from inside their signed-in Batoi account. This gives each user control over the link and avoids unsafe automatic account merges.
For security and auditability, Batoi treats first-time SSO for an existing email as a collision until the signed-in account owner explicitly connects the provider — ensuring every identity link is intentional and traceable.