Downvoted because you still allow master password login. This is unjustified privilege overreach that raises a huge red flag as I already explained to you: master password allows to steal accounts. That's the only thing it does that more specific keys like posting and active keys don't. Why would you need that much priviledges?

Your app shouldn't need more than the posting key. Please remove any possibility to login with the master password, and direct your user to the "permissions" tab to get their posting key.