Sequence

User sign-in exchange

User sign-in exchange Time runs top to bottom across three participants. The browser posts credentials to the auth service, which looks up the credential record in the token store. In the matched branch the token store returns the record and the auth service replies to the browser with a session token — the focal message. In the else branch the token store reports no record and the auth service replies with a 401 rejection. Browser Auth service Token store alt — credential matched else — no match POST /session (email, password) look up credential record record found 200 — session token issued no record 401 — invalid credentials Dashed arrows are replies. Activation bars mark work done in response to a received call.