[Bug]: User Registers Without External ID Attached - Breaks All Subsequent Logins on Device

[ShaheerKhawajikzai]

What happened?

Platform: Android (Redmi 12)
Mode: Testing
OneSignal SDK: OneSignalSDK.DotNet v5.2.2

When a user with external ID "1" logs in, OneSignal successfully registers the user in the dashboard and creates a push notification subscription, but fails to attach the external ID "1" to both the user record and the subscription record - leaving them orphaned without any external ID link.

If external ID "1" logs in on a device, the device enters a corrupted state where no other user can successfully log in with their external ID on that device. All subsequent external IDs fail to attach properly. The only solution is to uninstall and reinstall the app entirely.

When attempting to manually assign external ID "1" through the OneSignal dashboard, the system displays a "blocked" status, confirming that external ID "1" is in a corrupted or restricted state at the platform level.

Historical Context:
Prior to this issue being discovered, external ID "1" had accumulated approximately 12-15 subscriptions in the OneSignal dashboard. In an attempt to resolve what appeared to be a subscription conflict, all 12-15 subscriptions associated with external ID "1" were manually deleted from the OneSignal dashboard.

Screenshots/Visual Evidence
Screenshot 1: "Blocked" Status
Description: Shows the "blocked" status message when attempting to manually assign external ID "1" through the OneSignal dashboard.

Screenshot 2: Dashboard BEFORE Login (External ID "1")

Screenshot 3: Dashboard AFTER Login (External ID "1")

`// App initialization
OneSignal.Initialize(appId);

// Request permission
await OneSignal.Notifications.RequestPermissionAsync(true);

// Login user
OneSignal.Login(currentUser.Id.ToString());`

If iam missing something, please do let me know.

Steps to reproduce?

1.Install the app on Android device (Redmi 12)
2.Launch the app
3.App requests notification permission - user accepts
4.User logs in with external ID "1" (User ID: 1)

What did you expect to happen?

1.User Registration: User should be registered in the OneSignal dashboard
2.External ID Assignment: The external ID should be attached to the user record
3.Subscription Creation: A push notification subscription should be created for the device
4.External ID Linking: The external ID should be linked to the subscription
5.Notification Functionality: User should be able to receive targeted push notifications sent to external ID
6.Multi-User Support: After logout, other users (with external IDs "2", "3", etc.) should be able to log in on the same device without any issues
7.No Device Corruption: The device should remain in a healthy state, allowing seamless switching between different user accounts

OneSignal Android SDK version

OneSignalSDK.DotNet v5.2.2

Android version

14

Specific Android models

Android (Redmi 12)

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[jinliu9508]

Hi @ShaheerKhawajikzai, thanks for the detailed report and reproduction steps!

We were able to reproduce this and the root cause is the specific External ID value being used. Per our Users documentation, certain placeholder values are not allowed as External IDs, and "1" is one of the restricted values (0, 1, -1, NA, NULL, etc.). When OneSignal.Login("1") is called, the backend rejects that value, and in this version of the SDK the failed login leaves the local SDK state in a bad state where subsequent operations don’t proceed correctly.

We will work on improving the SDK behavior so that if an External ID is rejected, the SDK cleanly exits the bad state—either by failing the Login call or by resetting correctly after a Logout. This will prevent the device from getting stuck even if an invalid External ID is used. In the meantime, please avoid using these restricted values as external ID.

We’ll post an update once we’ve made progress on improving the SDK behavior around rejected External IDs.