Use server-minted OTK to switch into new org

Shipped

April 29, 2026 at 10:20 PM UTC

Author

kamo

Commit

4c6d2df

Prefer the otk returned by POST /api/security/org over the follow-up /api/security/enter-as round-trip. The server now mints a fresh owner session as part of org creation, so the post-create redirect to the new org's /validate is deterministic — no race with domain creation, no silent enter-as failure leaving the creator on the parent-org session.