Buyer questions
How to migrate from one identity provider to another
A step-by-step plan for moving users, password hashes, sessions and integrations between identity providers without forcing everyone to reset.
The short answer
An identity migration has four parts: users and their credentials, active sessions, application integrations, and machine clients. If the old provider can export password hashes in a format the new one accepts, users can move without resetting; otherwise migrate lazily, verifying each password against the old system at the user's next sign-in. Because OpenID Connect is a standard, switching application integrations is mostly configuration.
Sources last reviewed .
Plan
- Inventory: users, tenants, roles, credentials (and hash algorithm), MFA enrolments, external IdP connections, OAuth clients and redirect URIs, machine clients.
- Decide the credential path: bulk hash import, lazy migration on next sign-in, or a reset campaign as a last resort.
- Preserve stable user identifiers, or keep a mapping table, so downstream systems keyed on sub do not break.
- Run both providers in parallel; route a pilot tenant first.
- Cut over application integrations by changing issuer, client ID and secret; discovery documents do the rest for compliant libraries.
- Expire old sessions and refresh tokens deliberately rather than leaving them valid at the old provider.
- Rotate machine credentials last, with overlap.
What usually goes wrong
- MFA enrolments cannot be exported (TOTP secrets may be; passkeys are bound to the old relying party ID if the domain changes).
- Downstream systems stored the old provider's sub.
- Email verification state is lost, re-triggering verification for everyone.
In Authreads
How this applies to Authreads
If you are considering moving to Authreads, contact us with your current provider and hash format; supported import paths are confirmed per case rather than promised in general.
Authreads is a multi-tenant identity platform in beta. Capability status is maintained on /roadmap as Available, In progress or Planned.
Keep reading
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.