One idea makes this unit readable: an authenticator is a way of signing in that the site supports, and a member holds a link to each one they use, so one account can have a password, a passkey and Google at once.
Start with How the sign-in methods fit together, which sets out that model, the providers the platform ships, which are safe to enable and the policy questions to settle with the client. Enabling a provider covers credentials, redirect URIs and the sign-in buttons. The sign-in handshake walks a provider sign-in step by step, with every error and its cause, and Matching a provider sign-in to a member explains which account it becomes and the rule that prevents takeover by email address. The linked-accounts screen, Passkeys and Authorised applications and signed-in sessions are the member screens, with their templates and routes.