FusionAuth does not have a direct passthrough option to prevent storing user data from social login providers. However, there are several approaches to handle this:
Option 1: Use a Reconcile Lambda (Recommended for Social Login)For social login providers like Google, you can use a reconcile lambda to intentionally overwrite the user data with placeholder values before it's permanently stored:
function reconcile(user, registration, idToken) { // The idToken is the response from the tokeninfo endpoint // https://developers.google.com/identity/sign-in/web/backend-auth#calling-the-tokeninfo-endpoint user.firstName = "Purposely not set"; user.lastName = "Purposely not set"; user.fullName = "Purposely not set"; user.imageUrl = "http://www.notset.com"; }This ensures that personal data from the social provider is replaced immediately during the reconciliation process.
Option 2: Minimal Registration FormFor new user registrations (non-social), configure your registration form to collect only email and password, avoiding the collection of first/last name entirely.
Option 3: Use Webhooks to Clear DataImplement a user.create.complete webhook that listens for new user creation events, then use the FusionAuth User API to clear the personal data fields and move them to your profile service. Note that this approach means user data will briefly exist in FusionAuth before being cleared.
Option 4: Lambda with External Fetch (Advanced)You could use lambdas with fetch calls to move data to your profile service and set FusionAuth fields to null. However, this introduces latency due to network calls during authentication flows.
For Existing UsersIf you already have users with stored data, use the User API to programmatically clear the values for all existing users.
