# Identity

Identity is how Jadpo knows who is calling. You say which of your stored
records is a person and which is another system, and which ways in your
app accepts, such as a browser session or an API token. Jadpo checks the
caller on every request and gives your code one typed value for them,
`current_principal`. What that caller may do is decided separately, by
[Policy](policy.md).

You write it in three places, and read the caller in a fourth:

| Piece | Where | What it says |
|---|---|---|
| `principal { }` | `app.jadpo` | Which entity is a user, which is a service, and when each is active |
| `authentication { }` | `authentication.jadpo` | The ways a caller can sign in, and with `sign_in:` how a person is checked |
| `application { }` | `app.jadpo` | How long a revoked session may keep working, and the app's name in emails |
| `current_principal` | routes | The signed-in caller, passed to actions |

Five rules hold underneath all of it:

- Every route needs a signed-in caller unless it says otherwise.
- A request carries exactly one credential. A request with two, or with an
  invalid one beside a valid one, is refused; Jadpo never picks one.
- Jadpo checks the caller before it reads the request body or runs any of
  your code.
- Your code gets one typed caller. It never sees cookies, tokens, keys or a
  provider's claims.
- A credential never holds permissions. Policy decides them.

People sign in with a [magic link](magic-links.md) sent by email, or with a
[passkey](passkeys.md). An app can also accept tokens from an identity
provider it already uses ([Ways to sign in](ways-to-sign-in.md)). Jadpo has
no password sign-in.