# Events

Every sign-in publishes a built-in event, which your monitoring and your
app's own [subscribers](subscribers.md) can use:

| Event | Fields | When |
|---|---|---|
| `SignedIn` | `user_id` (the user entity's `id`), `method: SignInMethod`, `first_time: Bool` | A session or API token was started by `sign_in:` or an external token's first use |
| `SignInRefused` | `method: SignInMethod`, `reason: SignInRefusal`, `user_id` (when known) | A link, code or first sign-in was refused |
| `SignInCodesDisabled` | `user_id` (when the address has an account), `until: Instant` | An address reached `failed_codes_per_day:` |
| `PasskeyAdded` | `user_id`, `passkey_id: Uuid` | A person registered a passkey |
| `PasskeyRemoved` | `user_id`, `passkey_id: Uuid` | A person removed one of their passkeys |

`SignInRefusal` is a built-in enum: `link_expired`, `link_other_browser`,
`code_invalid`, `codes_disabled`, `refused_by_app`, `user_disabled`,
`passkey_challenge_expired` and `passkey_rejected`. `SignInMethod` has
`passkey` when `passkey:` is declared.

No event carries an address, a link, a code, a challenge, or a passkey's
credential ID or key.