Alternative approaches:

1. Webhook filtering (recommended)
   Use the user.login.success webhook to check if the user is linked to an IdP, and reject the login by returning a non-200 response. This avoids storing API keys in lambdas, but adds an extra network call to each login.

2. Store link data in user.data
   Push IdP linking info into a custom user.data.links[] field so it’s accessible in most lambdas without needing an API call. You’ll need a process to keep this data current.

Since we can’t store API keys in code,

FYI, with the release of 1.64.0, you now can store secrets elsewhere and have lambdas retrieve them.

See the documentation for more details.

Alternative approaches:

1. Webhook filtering (recommended)
   Use the user.login.success webhook to check if the user is linked to an IdP, and reject the login by returning a non-200 response. This avoids storing API keys in lambdas, but adds an extra network call to each login.

2. Store link data in user.data
   Push IdP linking info into a custom user.data.links[] field so it’s accessible in most lambdas without needing an API call. You’ll need a process to keep this data current.