Authentication surfaces — the auth: section.

local is derived: oidc and saml both issue app tokens through that same path, so either one forces it. Svelixir.Config.Otp applies the implication, and also enforces that any auth at all requires project.type: :web.

local/oidc/saml are the canonical names. The scaffolder skills reach the same three switches as options.local_auth/oidc_auth/saml_auth; those spellings are retired and are not accepted as input. See the mapping table in Svelixir.Config.