credentials

usernames or emails both work. sessions are jwt-backed and survive refreshes.