@@ -1,10 +1,12 @@
 import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
 import * as NodeServices from "@effect/platform-node/NodeServices";
 import { describe, expect, it } from "@effect/vitest";
+import * as Context from "effect/Context";
 import * as Effect from "effect/Effect";
 import * as FileSystem from "effect/FileSystem";
 import * as Layer from "effect/Layer";
 import * as Schema from "effect/Schema";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpClient from "effect/http/HttpClient";
 import type * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -32,12 +34,17 @@ const quotaResponse = (planStatus: Record<string, unknown>) =>
 interface CapturedRequest {
   readonly url: string;
   readonly apiKey: string | undefined;
+  readonly redirect: RequestInit["redirect"];
 }
 
 const recordingClient = (captured: CapturedRequest[], response: Response) =>
-  HttpClient.make((request) =>
+  HttpClient.make((request, _url, _signal, fiber) =>
     Effect.sync(() => {
-      captured.push({ url: request.url, apiKey: requestApiKey(request) });
+      captured.push({
+        url: request.url,
+        apiKey: requestApiKey(request),
+        redirect: Context.getOrUndefined(fiber.context, FetchHttpClient.RequestInit)?.redirect,
+      });
       return HttpClientResponse.fromWeb(request, response);
     }),
   );
@@ -158,6 +165,7 @@ describe("readDevinUsageLimits", () => {
         "https://server.codeium.com/exa.seat_management_pb.SeatManagementService/GetUserStatus",
       );
       expect(captured[0]?.apiKey).toBe("stored-key");
+      expect(captured[0]?.redirect).toBe("error");
     }).pipe(Effect.provide(Layer.mergeAll(NodeServices.layer, NodeCrypto.layer))),
   );
 
 
@@ -7,6 +7,7 @@ import * as Option from "effect/Option";
 import * as Path from "effect/Path";
 import * as Schema from "effect/Schema";
 import * as Hex from "effect/encoding/Hex";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpClient from "effect/http/HttpClient";
 import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
@@ -21,6 +22,9 @@ import * as HostProcess from "@t3tools/shared/HostProcess";
 const DEFAULT_API_SERVER_URL = "https://server.codeium.com";
 const USER_STATUS_PATH = "/exa.seat_management_pb.SeatManagementService/GetUserStatus";
 
+/** The API key in the request body must never follow a redirect off the API server. */
+const NO_REDIRECT: RequestInit = { redirect: "error" };
+
 const tomlString = (contents: string, key: string): string | undefined =>
   new RegExp(`^\\s*${key}\\s*=\\s*"([^"\\n]*)"`, "m").exec(contents)?.[1];
 
@@ -99,24 +103,26 @@ export const readDevinUsageLimits = Effect.fn("readDevinUsageLimits")(function*
     if (!apiUrl || apiUrl.protocol !== "https:") return unsupported;
 
     const client = yield* HttpClient.HttpClient;
-    const response = yield* client.execute(
-      HttpClientRequest.post(`${apiUrl.origin}${USER_STATUS_PATH}`).pipe(
-        HttpClientRequest.setHeaders({
-          "content-type": "application/json",
-          "connect-protocol-version": "1",
-        }),
-        HttpClientRequest.bodyJsonUnsafe({
-          metadata: {
-            apiKey,
-            ideName: "t3code",
-            ideVersion: "0.0.0",
-            extensionName: "t3code",
-            extensionVersion: "0.0.0",
-            locale: "en",
-          },
-        }),
-      ),
-    );
+    const response = yield* client
+      .execute(
+        HttpClientRequest.post(`${apiUrl.origin}${USER_STATUS_PATH}`).pipe(
+          HttpClientRequest.setHeaders({
+            "content-type": "application/json",
+            "connect-protocol-version": "1",
+          }),
+          HttpClientRequest.bodyJsonUnsafe({
+            metadata: {
+              apiKey,
+              ideName: "t3code",
+              ideVersion: "0.0.0",
+              extensionName: "t3code",
+              extensionVersion: "0.0.0",
+              locale: "en",
+            },
+          }),
+        ),
+      )
+      .pipe(Effect.provideService(FetchHttpClient.RequestInit, NO_REDIRECT));
     if (response.status === 401 || response.status === 403) return unsupported;
     const body = yield* HttpClientResponse.filterStatusOk(response).pipe(
       Effect.flatMap(HttpClientResponse.schemaBodyJson(GetUserStatusResponse)),