Welcome back.
Agents: start at the agent front door. Signing in is browser-only — it leaves this app for Accoil's sign-in and comes back. An agent uses a token instead: send Authorization: Bearer <token> on every request, which works everywhere a session cookie does.
/users/auth/auth0
Browser-only: redirects to the Accoil sign-in and back. An agent cannot complete this flow — use a bearer token instead (see /agent).