Meteor accounts

accounts-base plus a flavor package (accounts-password, accounts-google, etc.). Meteor stores users in Meteor.users and ships the client a resume token mapped to that document.

Decision flow

1. Username + password? Add accounts-password.
2. Social login? Add accounts-base plus the provider package (e.g. accounts-google) and configure the service.
3. Magic-link? Add accounts-passwordless.
4. 2FA? Layer accounts-2fa on top of accounts-password.
5. Token storage on the client? Default is Web Storage. Meteor 3.3+ supports an HttpOnly cookie flow; see the section below.

Username + password