Authorization code with PKCE, always S256.
The passwords that do exist are argon2id digests, and a scheme IAM does not recognize fails closed.
Refresh tokens are single-use and kept only as a hash. Presenting a spent one revokes the whole family, so a stolen token cannot outlive its session.
A second factor is an authenticator app, a code by SMS or email, or a passkey. Adding or dropping one signs the account out of every other browser.
Sign-in arrives from Google, from GitHub or from any OIDC issuer you name, and SCIM 2.0 keeps a directory in step.
Tokens are signed RS256, with ML-DSA-65 available per certificate and published in the same JWKS.
Every organization is a tenancy boundary, and membership travels in the token.
What you may reach once signed in is Authz’s to decide, reading the same token.