Email and password only. Your profile is created on signup; the app stays gated until onboarding is done. If Confirm email is on, the message link comes back through /auth/confirm.