Signing in from code the app writes

Most apps let sign_in: check people. When your app checks a person itself, such as someone accepting an invitation it sent, its action calls sessions.start(user_id) for a browser session or sessions.issue_token(user_id) for an API token. See Starting and ending a session.