First-party plugins you `.plug()` onto an app. Each page is one export from `okengine/plugins`.

## Authentication

<Cards>
  <Card title="Username" description="Username + password." href="/docs/plugins/username" />
  <Card
    title="Anonymous"
    description="Guest session, no password."
    href="/docs/plugins/anonymous"
  />
  <Card title="Magic link" description="One-time email link." href="/docs/plugins/magic-link" />
  <Card title="OTP" description="SMS, WhatsApp, or email codes." href="/docs/plugins/otp" />
  <Card title="Two-factor" description="TOTP enable / verify." href="/docs/plugins/two-factor" />
  <Card title="Passkey" description="WebAuthn-shaped passkeys." href="/docs/plugins/passkey" />
</Cards>

## OAuth

<Cards>
  <Card
    title="OAuth"
    description="Social sign-in — Authorization Code + PKCE for eight providers."
    href="/docs/plugins/oauth"
  />
  <Card
    title="Apple"
    description="Sign in with Apple — form_post + ES256 JWT."
    href="/docs/plugins/apple"
  />
  <Card
    title="Discord"
    description="Discord OAuth2 with nullable email."
    href="/docs/plugins/discord"
  />
  <Card
    title="Facebook"
    description="Facebook Login — never-verified emails."
    href="/docs/plugins/facebook"
  />
  <Card
    title="Figma"
    description="Figma OAuth2 with HTTP Basic token auth."
    href="/docs/plugins/figma"
  />
  <Card
    title="GitHub"
    description="GitHub OAuth2 with verified-email lookup."
    href="/docs/plugins/github"
  />
  <Card
    title="Google"
    description="Google OIDC — JWKS-verified ID tokens."
    href="/docs/plugins/google"
  />
  <Card
    title="Microsoft"
    description="Entra ID OIDC with tenant-aware issuer checks."
    href="/docs/plugins/microsoft"
  />
  <Card title="X" description="X OAuth2 public client — PKCE only." href="/docs/plugins/x" />
</Cards>

## Security

<Cards>
  <Card
    title="Headers"
    description="Secure headers on every HTTP response."
    href="/docs/plugins/headers"
  />
  <Card
    title="CORS"
    description="Cross-origin rules; closed by default."
    href="/docs/plugins/cors"
  />
  <Card
    title="CSRF"
    description="Fetch-metadata forgery defense, no tokens."
    href="/docs/plugins/csrf"
  />
  <Card
    title="IP Allowlist"
    description="Allow/deny by client IP at the edge."
    href="/docs/plugins/ip-allowlist"
  />
</Cards>

## Operations

<Cards>
  <Card
    title="Maintenance Mode"
    description="Drain HTTP with 503 and Retry-After."
    href="/docs/plugins/maintenance-mode"
  />
</Cards>

## Performance

<Cards>
  <Card
    title="Compression"
    description="gzip responses when the client accepts it."
    href="/docs/plugins/compression"
  />
</Cards>