Following the connect/login redirect chain overwrites kf_session with a
plain web session, stripping the OAuth context. Stop at the first 302
so kf_session retains the api_key OAuth context through the twofa step.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>