# `createClient().auth.signIn` (+ `signUp`)

```ts
createClient().auth.signIn.social() -> /sign-in/social
createClient().auth.signIn.email() -> /sign-in/email
createClient().auth.signIn.username() -> /sign-in/username
createClient().auth.signUp.email() -> /sign-up/email
```

If the browser calls the Rust auth host from a different origin, the auth host must pass the CORS preflight before sign-in runs.

In the current runtime, the default CORS allowlist includes `X-Athena-Sdk`, and allowed origins are assembled from `base_url` plus `trusted_origins`.

See [Auth runtime behavior](../runtime-behavior.md#direct-browser-requests-cors-and-shared-session-cookies) for the current direct-browser behavior and troubleshooting path.
For sibling-subdomain shared sessions without a frontend proxy, see [Shared session cookies for direct auth](../shared-session-cookies.md).
