McDonald's App Idiocy

I am a simple man.

As someone on the heavier end of the spectrum, fast food is my jam. While nothing beats a burger I take the time to make at home, sometimes, you want something fast, convenient, and consistent. While that is fundamentally the premise of fast food, McDonald’s just nails it insanely well.

A Big Mac is a Big Mac, whether you get it in Washington or in Rhode Island. I hear Japan is different, but their entire shtick is being different (and usually good different), so they don’t count.

McDonald’s is one of my favorite fast food places. I don’t claim to be a fast food aficionado, and I’m not gonna sit here and defend McDonald’s when it’s compared to places like In-N-Out, Five Guys, or Chick-fil-A.

Let’s be real: Five Guys bodies McDonald’s 10 out of 10 times in terms of food quality. Unfortunately, Five Guys wants my fucking 1st-, 2nd-, and 3rd-born children to get the food. My annual income is south of $30k a year. Do the math.

McDonald’s is getting there because of the economy — their watermelon refresher is good, and I put up the money because I make poor financial decisions, but it being almost $5 before tax is criminal.

Now, lucky for me (and not my health), there is a McDonald’s roughly a mile from where I live. My job is adjacent to it. Needless to say, I get McDonald’s a fair bit. And, as someone who is on the “tech-savvy” side of the spectrum — to the point I am hosting a blog in Hugo — I use their mobile app. I make sure to get my Points™.

The purpose of the app is fairly transparent. While, yes, they offer discounts — and points can get you free shit — they still win. I’m sure the reasons as to how they win are more complicated than how I am about to present it, but alas, if you are someone who likes a fast food place enough to download their app, you are also more likely to eat there even when other options are presented. In other words, a person on the app tends to spend more than the average McDonald’s customer.

Thus, offering the discount is a net positive to McDonald’s, as in the customer’s lifetime they will spend more than the discounts offer them. Hence why the app has so many rules on the benefits they offer (e.g., you can only use 1 reward at a time, you can only apply a single deal in a 24-hour period, etc.).

Is this exploitative? Eh, depending on who you ask. A McDonald’s executive would say they are offering a service to willing customers.

Does this dissuade me? No. I like their food.

We live in a society.

The Incident

So, I’ve spent a good 420 words glazing McDonald’s. I’m sure their executives are thrilled at the free advertisement. But, why, exactly?

Because that is all a backdrop for the absolute smackdown I am about to perform on their mobile app. It has a really fucking stupid bug that should not exist for a company valued at roughly $167 billion (as of September 2026).

Single Sign-On

Even for a layman, it isn’t hard to understand why single sign-on is a good deal.

• The end user gets to not deal with making yet another online account.

• The app gets to pull the juicy data from the SSO provider and securely log in the end user.

When implemented correctly, it is pretty nice.

This is what people in the industry call foreshadowing.

When you first sign up for their mobile app, at the time of writing, you have the ability to sign up with the 3 options presented above. When you do this, you do the whole authentication cycle, opt in for points, sell your soul via the Terms of Service, the whole nine yards.

Let’s say, for example, you decide to sign up with Facebook in the year of our Lord 2021. I’m sure plenty of people did, given the state of the world. When you do this, McDonald’s ties your email to that account. This appears to be done independently of the unique ID given by the SSO provider.

Don’t worry, dear reader. I shall enlighten you.

Again, I’m pretty tech-savvy. I have in the recent past written a website in Flask with plenty of dependencies. It was done with AI help, just like this website, but I was very involved in what the AI was doing. The website in question uses Discord SSO for accounts.

When an application uses Discord SSO, it can ask Discord to have the user release a variety of information. The user is then told during login what information the application is asking for. This allows you, the user, to make an informed decision as to whether you want to give the application said information. Facebook and Google do the same thing; you just probably skip it without thinking.

For this website I built, I only needed non-identifying information. But information that most any application is going to ask for is the identifier of the platform account.

In the case of Discord, this is the account’s “Discord ID”. Discord assigns a long number to every user (and really a lot of objects, like channels) that uniquely identifies that user against any other user on the platform.

This allows the application using Discord SSO to uniquely identify that user against any other user logging in with Discord. The end user cannot change this number without creating an entirely new account. Thus, the application using Discord SSO knows that if Discord returns 4829103756281940382 as the authenticated Discord ID, the person who owns that account is the one logging in.

Now, this isn’t to say that all SSO providers have something like this. But I have it on very good authority that Facebook does.

Why do I say all this? Well, aside from me graciously giving you a new fact to impress your computer geek friends with, it is relevant for a very simple reason:

McDonald’s appears to NOT use the platform account identifier. They appear to use the email instead.

On the surface, this seems like an okay idea. Most platforms disallow accounts from using the same email and, so, it appears to be the same in function as a unique ID.

W R O N G.

This is because the platform allows the user to change their email. Emails are not immutable. Luckily, this is generally not enough to have an account be hijacked — platforms typically have safeguards requiring that new emails be validated prior to being used for account servicing. But McDonald’s doing this does introduce a really niche problem.

A problem I am dealing with and, at the time of writing, have escalated to the McDonald’s app technical team.

The McProblem

Going back to the McDonald’s app registration example, let’s say you register with Facebook in 2021. Your email for Facebook at the time is doratheexplorer@gmail.com. The process goes swimmingly and you immediately start earning points.

A couple of years pass. Perhaps you hate gmail.com because Google is taking a political position you disagree with. Perhaps they decide to monetize emails and make you pay money for the account. Whatever the reason, you instead obtain the email bobthebuilder@my-childhood.com. Because you are no longer using the gmail.com address, you responsibly go out of your way to make it your new primary Facebook email.

Let us say, at roughly the same time, you get a new phone and, for whatever reason, a clone of your phone data is not possible. So, you download all of your applications and log back in.

You decide to prioritize the McDonald’s app as you want to get a Big Mac in an hour or so. You click the “Login with Facebook” button. You authenticate. However, instead of taking you to your account, it instead shows you a generic registration screen.

“Odd…” you say to yourself. You shrug and put in your old email and go with it. You opt in for points, just as you did in 2021, and click “Finish Registration”. Why not? The app has always been finicky.

It loads for a second, then does nothing.

Oh no.

You back out and go back to the screen that lets you choose how to log in. You click “Login with Google” this time. You use your old Google account once again. You authenticate.

You see this:

And the idiocy is revealed.

You cannot log in with Facebook. It thinks you are a new account because it sees your new Facebook email as not being in the system, but because you provide your old email during registration, it sees that said email is already registered and errors out.

You cannot log in with Google, as the system is intelligent enough to know that you used Facebook in the past, and thus it wants you to use Facebook.

You don’t want to repeat the login with Facebook steps and use your new email, as it’ll just register a new account, thus causing you to lose your points, order history, and favorited locations.

All of this would be avoided if the app simply used the Facebook account identifier. Then the app would just update the user’s email if it saw Facebook return one that was different than what it had. Why? Because the email shouldn’t be used for authentication when using an SSO provider; the fact Facebook returns a unique identifier is the authentication.

But, no. The result is that you have, by no fault of your own, gotten locked out of your account.

This is not rocket science. The flow I have described above is well understood by web developers. People making hobbyist apps do not fuck this up. Yet, presumably, professional engineers at a $167 billion company fucked it up.

Or, worse, McDonald’s outsourced the creation of the application to a 3rd party — and an incompetent one at that — and just has underpaid customer service people using a presumably equally incompetent administration portal.

What.

The.

Fuck.

I Am McAngy

So, yeah. At the time of writing, the problem remains. There isn’t much more to say. I am not a Twitter celebrity, so I can’t just tag @McDonalds and get the CEO to push my issue forward. I am not a professional software engineer with contacts in the McDonald’s software team.

And, quite frankly, there may be some complicated engineering reason as to why this problem exists. Likely something to do with McDonald’s mixing SSO accounts with traditional email and password accounts. Not that it excuses the $167 billion company’s fuck-up.

I am but a simple man who wants Big Macs and cannot have my Points™ until my issue is resolved. If it is resolved. I am half-expecting a “get fucked, make a new account, sucks to suck” response.

We shall see.