---
title: "Keep your own user ID · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id
updated: 2026-10-20
licence: "All rights reserved"
---

# Keep your own user ID

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)
- Rule: Give every person your own stable user ID and map each sign-in method to it. Never key records by an email address or a provider's user ID.
- How: Make a random ID, such as a UUID, at sign-up. Store each provider login as a row with the issuer and the subject, `iss` and `sub` in OpenID Connect. Make the pair unique, because a subject is only unique within its issuer. Point every other table at your own ID. Then a new email, a second login method or a new provider changes one table.
- Check: Search the schema for foreign keys to an email column or a provider subject. None exist. Change a test user's email, and every record stays linked.

Example:

```sql
CREATE TABLE identities (
  user_id uuid NOT NULL REFERENCES users (id) ON DELETE CASCADE,
  issuer text NOT NULL,
  subject text NOT NULL,
  PRIMARY KEY (issuer, subject)
);
```

```js
export async function userIdForLogin(db, { iss, sub }) {
  const row = await db.oneOrNone('SELECT user_id FROM identities WHERE issuer = $1 AND subject = $2', [iss, sub]);
  return row?.user_id ?? null;
}
```

```python
def user_id_for_login(db, iss: str, sub: str) -> str | None:
    row = db.execute("SELECT user_id FROM identities WHERE issuer = %s AND subject = %s", (iss, sub)).fetchone()
    return row[0] if row else None
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id`.

- Previous: [Decide whether a provider or a library runs sign-in](https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library)
- Next: [Offer passkeys first](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkeys-first)
- [Sign-in methods](https://agentwranglers.se/playbook/accounts/sign-in-methods)