This site logs in with delegate, engine9's common sign-in. The Login button at the top of every page (option 1) is how a real site logs people in. Option 2 is the fallback for browsers without JavaScript or popups. Options 3 and 4 are debugging tools that show what delegate knows about this browser.
1. The Login button
@engine9/id login widget · the default way to use Delegate
The Login button in the header isloginWidget() from @engine9/id/widget. One dialog on this page logs in with Google, switches the email address this site sees, picks VIP or Admin, and logs out. Delegate opens in a popup and signs an Identity Token; the widget posts it to /auth/delegate, which verifies it via JWKS and starts this site’s session. The button below opens the same dialog.
You’ll see: delegate’s sign-in if you are not signed in there, in this site’s colors with aContinue with Google button (brand in src/lib/brand.ts), then its share page the first time. The share page lists your email addresses so you can pick one. After that, delegate remembers your choice (a Grant) and logs you straight in. Then the dialog’s Role section. VIP requires Level 1; Admin requires Level 3.
Switch email in the dialog asks delegate again with prompt=select, so the share page always appears. Use it to pick a different email address, add one, or switch Google accounts.
The same request the widget sends, for browsers without JavaScript or popups and for debugging:/identity/authorize with min_level=1and required fields display_name andemail. Log in takes this page to delegate and back; it sends brand_google=skip, so a signed-out visitor goes straight to Google without a second button. Log in (popup) callsrequestIdentity() from @engine9/iddirectly. Change your Delegate information is the widget’s Switch email as a redirect (prompt=select). After a redirect login you pick a role on /choose-role.
Asks Delegate who this browser already is — unid and whether they are logged in on Delegate — without creating a festival session (GET /whoami).
Cross-site limit: Delegate cookies areSameSite=Lax, so a credentialed fetch or<script src> from this demo origin willnot see who you are on Delegate (you get a throwaway anonymous UNID). A short top-level popup to/whoami/bridge does send cookies; itpostMessages the real identity back (allowlisted origin only — not XSS).
4. Delegate’s own sign-in (debug)
Delegate only · no festival session
Sign in to Delegate only opens Delegate’s own/login with no return_to back to this site. It signs you in to Delegate (UNID ↔ Google) but doesnot log you in here.
You’ll see: Delegate’s sign-in in a new tab. This demo’s header stays logged out until you use its Login button. Option 3’s popup bridge will then report loggedIn: true.