- Shipped
- October 14, 2025 at 4:24 AM UTC
- Author
- snadjafinia
- Commit
- 2ab736a
Root Cause Found: - /api/validate and /api/validate-otk in kamo-login were calling SecurityService - This consumed the OTK IMMEDIATELY after login (before user could use it) - SecurityService logs showed OTK being deleted right after creation - When user clicked redirect link, OTK was already gone Fix: - Delete /app/api/validate/route.ts - Delete /app/api/validate-otk/route.ts - kamo-login should NOT validate OTKs (that's kamo-internal's job) - kamo-login only needs to return the redirect URL with OTK Flow Now: 1. User logs in -> SecurityService creates OTK in Redis 2. User redirected to **************** 3. kamo-internal validates OTK directly from Redis 4. No premature consumption!