We use a magic link (no password). After login, the API uses your session token to resolve org access.