Identities are seats (accounts rows) auto-registered by the hosted auth page — the simulator stores no passwords and validates no credentials.
Logging in here ≠ the hosted auth page: over there an "app user connects an account" and the app gets a redirect back; over here you (the developer) play a simulated user (seat) browsing their feed/inbox/invite lists (replying to a message fires the webhook; invites are auto-accepted by the simulator's wall-clock scheduler).
World Bearer dev-bypass