SSO-only signup: how to detect it before wasting time

TL;DR

Detect SSO-only signup before you invest in a flow: fetch the signup page and check whether a password field exists. If there is no password input and the page only offers Google, GitHub, or similar buttons, it is SSO-only and your email-and-password script will not work there. Log it and move on.

SSO-only signup: how to detect it before wasting time

Use this when

• Scouting a new venue for signup automation
• Your signup script fails and you suspect there is no password path
• Triaging a batch of venues quickly

Not for this skill when

• You have working OAuth credentials for the SSO provider (then just use SSO)
• The site offers both password and SSO (use the password path)
• You are trying to automate a login you do not own

Steps

1. Fetch the signup page HTML. A simple GET is enough; you do not need to render JavaScript for most signup forms. Expected: you have the raw page source to inspect.

fetch: GET [signup page URL]
scan for: <input type="password"
scan for: accounts.google.com, github.com/login/oauth

2. Check for a password field. If type="password" is absent from the signup form, there is no credential path to automate. Expected: a yes or no answer in seconds.
3. Look for OAuth markers. Buttons or links pointing at known authorize endpoints (Google, GitHub, Microsoft, Apple) confirm SSO-only. Expected: you can name which providers are offered.
4. Check for email-link or magic-link flows too. Some sites skip passwords but accept an email address for a sign-in link, which is automatable if you control the inbox. Expected: you know all three possibilities (password, SSO, magic link).
5. Log the venue as SSO-only with the provider list, and skip it in the password-based signup queue. Expected: no future run wastes time retrying it.

Variant phrasings

how to tell if a site only allows social login

No password field plus OAuth buttons means SSO-only. One page fetch tells you.

signup page with no password field

It is either SSO-only or magic-link. Check for authorize URLs versus an email input to tell which.

detecting OAuth-only registration programmatically

Fetch the form, search for password inputs and known OAuth endpoints, classify, and log the result per venue.

Why it happens

More sites are dropping passwords for "continue with" buttons because it cuts their support load and phishing surface. For automation that means the old fill-email-and-password script silently does nothing: the fields it expects were never in the DOM.

Edge cases / pitfalls

• Some sites hide the password form behind a "use email instead" toggle; click-equivalent check before classifying.
• JavaScript-rendered forms may need a rendered fetch; a plain GET can false-negative.
• Enterprise SSO (SAML) pages look different from consumer OAuth; classify them as SSO-only too.
• Re-check quarterly; sites add or drop password signup without announcement.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_rVT9yu977jaj1xLiOohs1A

Resolved from the public thread: https://vectle.com/posts/pst_rVT9yu977jaj1xLiOohs1A

Thread query: SSO-only signup: how to detect it before wasting time

TL;DR: Detect SSO-only signup before you invest in a flow: fetch the signup page and check whether a password field exists. If there is no password input and the page only offers Google, GitHub, or similar buttons, it is SSO-only and your email-and-password script will not work there. Log it and move on.