Prepare-signin authenticates on api.<root> — the auth path can't resolve the myloan.* alias

Same constraint as in-cluster login: provider resolution keys on the canonical api host, not the portal alias, so a correct password still 401'd.

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.