Prepare-signin authenticates on api.<root> — the auth path can't resolve the myloan.* alias

Same constraint as in-cluster login: provider resolution keys on the canonical api host, not the portal alias, so a correct password still 401'd.

Like what you see shipping?

All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.