Passwordless sign-in

Email me a secure sign-in code

We use the same response whether or not an account exists.

Protected by HttpOnly sessions, verified identities, and server-side role checks.