- Shipped
- August 25, 2026 at 1:17 AM UTC
- Author
- Kamo
- Commit
- a34b8f8
The redirect is wrong. SignInCompletionService returns a relative /validate?otk=, which resolves against the host that served the sign-in -- login.<apex> -- and kamo-login has a /validate page of its own. It spends the one-time key and router.push('/')s straight back to the sign-in screen, so the member never reaches their workspace. The workspace is on internal.<apex>; the original host path built exactly that by rewriting api. to internal. This would have hit every sign-in on the platform host, not just members of several organizations: a member of one is auto-selected through the same completion path. Off again until completeSignIn names the workspace host.