Access-key sign-in: you keep the key, the server stores only its hash (argon2). The session is protected by an httpOnly cookie.