If my frontend is at a different domain than my backend, the cookie from the 302 redirect doesn't get set. If using bearer tokens there's no opportunity to get the token from the request before the redirect occurs. Email/password works.
Solution
Okay just had to play with cookies, config that fixed for this:
