there's a lot of product magic in agents like muse or instinct in making auth into websites work. however, there still seems to be some ways to go given the various login systems you run into (passkeys, OTP via text or email, 2fa, "auth on other device").