Operations access
Use the company identity provider. Access requires the operations role and a completed MFA challenge.
Merchant dashboard credentials are intentionally rejected. The access token remains in an HttpOnly cookie and is never exposed to browser JavaScript.