Start here
Authentication
Sellers sign in with email + OTP, password, or Google. Sessions are httpOnly cookies on .mavelo.in.
Redirect the browser to GET /api/auth/google. Callback is https://api.mavelo.in/api/auth/google/callback. PKCE + signed state cookie. Google-verified mailboxes skip emailed OTP.
curl -I https://api.mavelo.in/api/auth/googleProviders
curl https://api.mavelo.in/api/auth/providersReturns { "google": true } when the Google client is configured.