#4524 No way to add or switch to password login on an account created with SSO

Problem

An account created with GitHub, Google, or another SSO/OAuth provider has no way to set a password or switch to password login later. I found no option for this in the account settings, and signup itself offers no password option.

This blocks swamp auth login --no-browser, the only login path that works on a host without a desktop browser: it asks for a username and password, and an SSO-only account has no password.

The result on a headless host:

• The browser login can't finish there (see #1193: the callback goes to localhost on the machine that runs the CLI).
• --no-browser needs a password the account can't have.
• The only option left is an API key in SWAMP_API_KEY / SWAMP_API_KEY_FILE, which you must mint somewhere else first.

Proposed solution

Let a signed-in user add a password to an account that was created with SSO, from the account settings page, and then log in with either method. Optionally, allow removing the SSO link once a password is set.

Alternatives

• A working device-code flow for swamp auth login, as swamp auth server-login already has (also raised in #1193).
• swamp auth login --api-key <key> that saves the key, as proposed in #1193.

Both would fix the headless case, but neither lets a user choose password login for an account they already have.

Related

• #1193 (closed): headless login with an OIDC-only account. It notes that "I found no CLI or UI way to set a password on an OIDC account."