Both phases of a provider's sign-in: the provider the request path names — kept in the session for the callback, which every provider shares — is looked up among the "auth:providers" plugins, refused unless the site the request reached offers it, and filled into the strategy — its Assent strategy, Assent's own defaults for it, what the plugin overrides, the site's keys and the callback on the site's address — before AshAuthentication's OAuth2.Plug runs the phase.