Sign in with an identity provider

Candor draws the screens around sign-in. It doesn't talk to an identity provider, hold a session or store a password. Your auth library does that, and the components take plain callbacks.

SignIn (Pro) has no password field. It offers your company's SSO and a one-time emailed code. onSso is called when the SSO button is pressed, and the button only shows when you pass it. Start the redirect there with your library: Better Auth's client calls authClient.signIn.social with a provider id such as "google", and its Generic OAuth and SSO plugins cover other OpenID Connect providers. Auth.js is the other common choice; its site now says the project is part of Better Auth, so read its current guidance before starting a new app on it. onSendCode and onVerifyCode receive the email and the six digits, and whatever your server answers goes back in error, which SignIn shows under the field it concerns.

SessionExpiredDialog blocks the page when the session ends while the app is open, and signing in again returns to the same place. Pass kept only when the app really kept something, such as an unsent message. AccountState is the whole-page stop for someone who is signed in but can't use the app yet: no account, removed from one, email not verified, an invite to accept. It names who is signed in and offers Sign out, because the usual cause is the wrong email.