After clicking the buy button, Metamask should open and ask you to make a transaction. This is on testnet so not real ether.
It may take a minute for your transaction to be mined. Make sure you have a balance of 1 or more before proceeding.
Account balance: ?
The server generates a one-time challenge message that you sign with metamask. Your signature proves to the server that you own the ethereum address.
You send your signature to the server, which then verifies that it matches your address and checks with the smart contract that you have at least one token, if you do then you are authenticated.