The portal has its own JWT-based auth (withPortalAuth). The CRM middleware was redirecting /portal/login and /api/portal/auth/request to /login, breaking the magic-link flow for unauthenticated clients. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>