When using social sign in/up (google, github, etc.) and the email address is already in use (using password or otp) is there a way to avoid requiring the user to sign in to attached the social to that user. Think something along the lines of if the email is verified from the ODIC then just connect the account to the user.

That would not be secure because of similar issues like described in this older post: https://www.ory.sh/sign-in-with-user-impersonation-oauth2-openid-connect/ Essentially you cannot usually trust the social provider that the email is correctly verified: https://www.ory.sh/docs/kratos/social-signin/link-multiple-provider-account#security-considerations Also read up on the topic of abandoned company domains here: https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw