Checking the person: sign_in:

Signing in has two steps. First Jadpo checks the person is who they say, for example that they can read email sent to their address. Then it gives them a session: a cookie for a browser, or an API token for your own client. sign_in: in authentication { } lists the ways Jadpo checks a person for you, so your app writes no sign-in code:

// authentication.jadpoauthentication {    browser_session: {        cookie: "notes_session"        origin: config.browser_origin    }    api_token: {}    sign_in: {        magic_link: {            address: Member.email            link: "/sign-in/confirm"        }        providers: [google, github]    }    on_first_sign_in: accounts.create_member}

sign_in: holds up to three ways in:

• magic_link:, an email with a link and a code (Magic links);
• passkey:, a key held on the person's device (Passkeys);
• providers:, sign-in with another service such as Google or GitHub.

Each way ends by starting a session in the same way.

on_first_sign_in: names an action in your app, here create_member in the accounts domain. It decides what happens the first time someone signs in whom your app has no user for, whichever way they came in, an external token included. See A person the app has not seen.

You never write a magic-link action. sessions.start is only for a person your app checks some other way, such as one accepting an invitation it sent (Starting and ending a session).

Providers

Each sign-in provider is a connection in app.jadpo's connections: (Integrations), and providers: [...] names those connections, as email: names its connection. Google, Microsoft and other OpenID Connect providers are each written google: { driver: Driver.oidc issuer: client_id: credential: }, and the provider's discovery document gives the rest. GitHub and Apple aren't plain OpenID Connect, so they have the built-in drivers Driver.github and Driver.apple.

The old name

sign_in_providers: is refused, and the error renames it to sign_in:.

Not built yet: providers: is toolchain.not_built_yet. Use magic links or passkeys for now.