One-click sign-in with your DID. Each app issues a capability token scoped to what it needs — revoke any time.