---
title: "Sign-in methods · Agent Wranglers"
url: https://agentwranglers.se/playbook/accounts/sign-in-methods
updated: 2026-10-20
licence: "All rights reserved"
---

# Sign-in methods

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

> Pick who runs sign-in, keep your own user IDs, and make passkeys the first choice. Email links and provider logins each need their own care.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/sign-in-methods`.

## Required

- [Keep your own user ID](https://agentwranglers.se/playbook/accounts/sign-in-methods/own-user-id): Give every person your own stable user ID and map each sign-in method to it. Never key records by an email address or a provider's user ID.
- [Verify every passkey answer on the server](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkey-verification): Accept a passkey sign-in only after the server checks the challenge, origin, relying party ID, user flags and signature with a maintained WebAuthn library.
- [Never remove the last way to sign in](https://agentwranglers.se/playbook/accounts/sign-in-methods/last-sign-in-method): Let people add and remove sign-in methods, but refuse to remove the last one. Never link a provider login to an account by email alone.

## Recommended

- [Decide whether a provider or a library runs sign-in](https://agentwranglers.se/playbook/accounts/sign-in-methods/auth-provider-or-library): Choose a hosted identity provider or a maintained library on purpose, write down why, and never write your own password, token or protocol code.
- [Offer passkeys first](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkeys-first): Offer passkeys as the main way to sign in, through autofill. Invite people to create one right after they sign in another way.
- [Weigh email links before making them the only way in](https://agentwranglers.se/playbook/accounts/sign-in-methods/email-sign-in-trade-offs): Use email links or codes as the only sign-in for low-risk accounts only. Bind each link to the browser that asked for it, and offer a passkey after the first sign-in.

## Optional

- [Keep the password manager's passkey list current](https://agentwranglers.se/playbook/accounts/sign-in-methods/passkey-signals): Tell the browser when a passkey stops working or a user's name changes, with the WebAuthn signal methods, so people stop picking dead passkeys.

- Previous: [Sign-up](https://agentwranglers.se/playbook/accounts/sign-up)
- Next: [Second factors and recovery](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery)
- [All chapters](https://agentwranglers.se/playbook/accounts)