# Checking the person: `sign_in:`

Signing in has two steps. First Jadpo checks the person is who they say,
for example that they can read email sent to their address. Then it gives
them a session: a cookie for a browser, or an API token for your own
client. `sign_in:` in `authentication { }` lists the ways Jadpo checks a
person for you, so your app writes no sign-in code:

```jadpo
// authentication.jadpo
authentication {
    browser_session: {
        cookie: "notes_session"
        origin: config.browser_origin
    }
    api_token: {}
    sign_in: {
        magic_link: {
            address: Member.email
            link: "/sign-in/confirm"
        }
        providers: [google, github]
    }
    on_first_sign_in: accounts.create_member
}
```

`sign_in:` holds up to three ways in:

- `magic_link:`, an email with a link and a code ([Magic links](magic-links.md));
- `passkey:`, a key held on the person's device ([Passkeys](passkeys.md));
- `providers:`, sign-in with another service such as Google or GitHub.

Each way ends by starting a session in the same way.

`on_first_sign_in:` names an action in your app, here `create_member` in
the `accounts` domain. It decides what happens the first time someone
signs in whom your app has no user for, whichever way they came in, an
external token included. See
[A person the app has not seen](a-person-the-app-has-not-seen.md).

You never write a magic-link action. `sessions.start` is only for a person
your app checks some other way, such as one accepting an invitation it
sent ([Starting and ending a session](starting-and-ending-a-session.md)).

## Providers

Each sign-in provider is a connection in `app.jadpo`'s `connections:`
([Integrations](external-services.md)), and
`providers: [...]` names those connections, as `email:` names its
connection. Google, Microsoft and other OpenID Connect providers are each
written `google: { driver: Driver.oidc  issuer:  client_id:  credential: }`,
and the provider's discovery document gives the rest. GitHub and Apple
aren't plain OpenID Connect, so they have the built-in drivers
`Driver.github` and `Driver.apple`.

## The old name

`sign_in_providers:` is refused, and the error renames it to `sign_in:`.

Not built yet: `providers:` is `toolchain.not_built_yet`. Use magic links
or passkeys for now.