How would you design consumer login for an Experience Cloud site with social sign-on?

An Auth. Provider for each social network, and an Apex class implementing Auth.RegistrationHandler behind them. The Auth. Provider handles the protocol exchange; the handler owns the identity decision, which is where the real design sits.

In createUser I decide how to match: if a contact already exists with that verified email, link the new user to it rather than creating a duplicate; otherwise create the contact under the right account and then the user, assigning the profile and permission sets. In updateUser I keep attributes current on subsequent logins. I would also decide up front whether the data model is person accounts or consumer contacts under a bucket account, and say plainly that a bucket account concentrates children under one parent — the account data skew pattern — so the choice has to be made against expected volume.

Then the site-level configuration, which is the step people forget: each Auth. Provider has to be enabled on that site's login and registration settings before it appears. Beyond that I would cover what happens when a social account's email changes, whether matching on email alone is acceptable to the security team, and what the fallback is when a social provider is unavailable.