Members are already signed in somewhere else
Members sign in on the organization's main portal. Asking them to sign in again for workshops was not an option, and each environment uses a different portal address.
The portal redirects to a dedicated login route with a signed token. The app exchanges it for its own API token, decodes the claims into a typed user (plan eligibility, price tier, payment method) and opens “My workshops”. The login URL is resolved from the host name for each of 4 environments.