Use SSO for normal staff access or the local admin credentials for break-glass login. JSON bearer auth is separate because mixing browser sessions and API tokens is how people create avoidable messes.
Service provider metadata: /view/login/saml/metadata