affb697708442a44d4912966e7a16dc70f646aff
The UAT_PLAYBOOK §5.25 (Customer Portal — Better Auth SSO Bridge) pre-condition incorrectly stated that the Authentik customer password comes from seed-uat-passwords:customer-password. That Secret holds the *Better Auth* email+password credential — a different identity store. The actual Authentik uat-customer password lives in authentik-uat-users-credentials:uat_customer_password, provisioned by infra/terraform/users.tf with lifecycle.ignore_changes = [password]. UAT testers were using the Better Auth value at the Authentik OIDC step and getting 401'd, blocking GRO-2026. Verified 2026-06-02: pulling the correct Secret value, signing in via SSO, and POST /api/portal/session-from-auth all succeed (returns 201 with valid portal session). Co-Authored-By: Paperclip <noreply@paperclip.ing>
web
GroomBook web app (extracted from groombook/app monorepo)
Description
Languages
TypeScript
99.5%
CSS
0.3%