- Shipped
- August 3, 2026 at 4:48 AM UTC
- Author
- Kamo
- Commit
- f621448
When /verify-email responds with the additive otk + autoLoginHost fields (minted by SecurityService on first verification), deep-link straight to https://<host>/validate?otk=… — the same consumer the enter-as flow uses — landing the fresh member on the internal home (FirstOrgCta) instead of bouncing them to the login form for a credential retype and a third ***. - PostCompletionScreen (code path + verified card): auto-session redirect with the login-page redirect kept as the fallback whenever the OTK is absent; fires the existing email-verified event first, plus a new auto-session analytics event on the OTK path. - /verification (email-link path): the token-verify response is the one that carries the OTK, so it redirects the same way; the register tab watching over SSE keeps its login fallback (the OTK is single use and lives in the link tab). - registerApi: verify calls now typed as VerifyEmailResponse.