# §12 — How do they prove it?

Three ways in, and the difference is who you make responsible for the password.

The third option is the one people forget is available, and it is the one that closes enterprise deals.

## Where now

- Email and a password you store — turn to §26 (You hold the hash. You also hold the reset flow.)
- Google, GitHub, Apple — someone else's button — turn to §95 (No password to lose.)
- Their employer's identity provider — turn to §38 (OIDC. Someone in procurement will ask.)