You don't use an external ID. You use an internal ID that you control, which fits the requirements of your design. External authenticators can then associate

You don't use an external ID. You use an internal ID that you control, which fits the requirements of your design. External authenticators can then associate to your internal account as you design. If the external authenticators can be 'renamed' you'll want to insist on a sidechannel (often email) and recovery process for that channel (or SMS is popular). Any data you collect can and will be used against your customers in the event of liquidation and/or oppressive governments in the jurisdictions your servers are hosted in: I recommend allowing 'email only' as an option for your users.