 <p>I have an app that does something similar - we use Open ID and OAuth exclusively for logins, and while we store the user's email address (Google Account or Facebook sends it back during authentication) they never login using it and so don't have/need a password.</p> <p>This is a callback for what happens when a user signs up via Facebook:</p> <pre><code> User.create!( :facebook_id =&gt; access_token['uid'], :email =&gt; data["email"], :name =&gt; data["name"], :password =&gt; Devise.friendly_token[0,20]) </code></pre> <p>The <code>Devise.friendly_token[...]</code> just generates a random 20 character password for the user, and we are using our default User model with devise just fine. Just setting the password in a similar way on your users would be my approach, since you are never going to use their password. Also, if you ever change your mind and want them to be able to login, you can just change a user's password in the database and build a login form, and devise will take care of the rest.</p>