The signup screen is the most important page on any marketplace. It is also the most ignored. Most teams pick a default authentication library, drop in a few buttons, and move on. We took a different view: the choices you make at signup set the tone for the whole relationship. This article explains how we designed authentication at ReReadz, why we chose social login alongside email, and what we learned about trust along the way.
Why authentication is a product problem, not a plumbing problem
It is easy to treat sign-up as a technical task. Pick a library, configure a provider, ship. But the signup flow is where you ask a stranger to trust you for the first time. Every field you ask for, every checkbox you require, every redirect you trigger sends a signal. The signal is either we respect your time or we are about to be a hassle.
For a community marketplace, that first signal compounds. Buyers who feel respected at signup are more likely to leave a review. Sellers who feel respected are more likely to list a second book. The lifetime value of a great signup flow is enormous, even though it never shows up in any single metric.
The options we considered
We mapped four credible approaches.
- Email and password only. Familiar, universal, but high friction. Forgotten passwords, confirmation emails landing in spam, and a real risk of users abandoning before completing the loop.
- Magic links. No passwords, but every login requires opening an email. Clean for occasional use, painful for power users.
- Social login only. Fastest, but excludes anyone uncomfortable handing data to a single identity provider. Also creates a dependency you cannot easily reverse.
- Hybrid. A range of social options as the default with email as an equally respected alternative.
We chose the hybrid approach. A row of social buttons gets the majority of users in within seconds. The email option keeps the door open for everyone else, and it carries equal visual weight so it does not feel like an afterthought.
The providers we chose, and why
We deliberately offer more than just Google. Readers come from very different corners of the internet, and forcing one identity on everyone is the opposite of community. Today ReReadz supports five social providers alongside email:
- Google for the broadest coverage and the smoothest mobile experience.
- Facebook because many of our most active book club organisers already run their groups there.
- LinkedIn for professional readers, charity managers and partners who prefer to keep their work identity separate from personal social accounts.
- X for readers and authors who live in the literary conversation happening there.
- Discord for the younger, community-native audience that already lives in shared servers around books, manga and reading challenges.
Each button uses the same minimal scopes and lands in the same onboarding flow. The choice is the user, the experience is consistent.
Designing for trust, not just speed
Speed is necessary but not sufficient. A signup that takes two seconds and feels creepy is worse than one that takes thirty seconds and feels respectful. Three principles guided our design.
Ask for as little as possible at signup. A name and an email. That is all we need to get started. Address, phone, payment details, all of these are collected at the point they are actually needed: when you make your first purchase, when you list your first book, when you receive your first payout. This both reduces drop-off and respects the user right to share data progressively.
Be honest about what social login shares. When a user taps a social button, we tell them clearly which fields we receive and what we use them for. No dark patterns, no hidden scopes, no quiet syncing of address books.
Give people a way back. If a user signs up with a social provider but later wants to set a password and use email, they can. If they want to delete their account, they can. The trust we ask for is reversible.
The role of social login
Used well, social login is one of the kindest design decisions you can make. It removes the password problem entirely. It eliminates email confirmation friction. On mobile, it turns a multi-step form into a single tap.
Used badly, it becomes a privacy risk and a customer support headache. We took several specific steps to use it well.
- Minimal scopes. We request only the fields we need. We do not ask for contacts, drive access or anything beyond basic profile information.
- A real choice of provider. Offering Google, Facebook, LinkedIn, X and Discord side by side means no single company sits between a reader and their account.
- No silent account creation. If a user already has an email account and tries to sign in with a social provider using the same address, we ask them to confirm before linking. Surprises in authentication erode trust faster than almost anything else.
What we learned about email signup
Email is not dead. A meaningful share of our users prefer it, and many of them are our most engaged sellers. They want a password they control, a confirmation they can audit and a clear separation from their social identities.
We designed our email flow with that audience in mind. Strong password requirements without infantilising the user. Clear confirmation emails that look like they come from a real company, not a transactional service. Recovery flows that work even if the original email is lost.
Trust signals beyond the signup screen
Authentication is the start of trust, not the whole of it. Once a user is in, the rest of the product has to keep delivering. We treat several other surfaces as trust signals.
Seller verification. Sellers can verify their identity once, get a visible badge and see their listings rank higher in trust-sensitive results. The badge is earned, not bought.
Transparent fees. The platform fee is shown clearly at the point of listing. Sellers know exactly what they will receive before they list a book.
Real reviews from real buyers. Reviews are tied to verified purchases and cannot be faked. Sellers can respond, but they cannot delete.
Human support on WhatsApp. When something goes wrong, you talk to a person, not a ticket queue.
Each of these reinforces the impression created at signup: this is a place that takes itself seriously and takes you seriously too.
What we would tell other product teams
If you are building anything that asks people to create an account, our advice is short.
- Treat signup as a product, not a settings screen.
- Offer a real range of social providers and email side by side, with equal respect.
- Ask for the minimum, then earn the right to ask for more.
- Be explicit about what you collect and why.
- Make every part of authentication reversible.
Do these five things and you will be ahead of most marketplaces, including some that have raised hundreds of millions of pounds.
People also ask
Which social logins does ReReadz support?
You can sign in with Google, Facebook, LinkedIn, X or Discord, or use a traditional email and password account. All options carry equal weight in the signup flow.
Is social login safe?
Yes, when implemented carefully. We request only basic profile information and never share your data with third parties beyond the providers you sign in with.
Can I switch from a social login to email later?
Yes. You can add a password to your account at any time and continue to use either method.
What does ReReadz do with my profile data?
We use your name and email to create your account and contact you about orders. That is all. We do not sell or share your data.