Sign in

Global identity first. You then enter one gym, and every request is scoped to that gym by a short-lived context token held server-side.