Session being overridden between requests?

Before with

UserName = ClientUserName,
Password = ClientPassword,
AlwaysSendBasicAuthHeader = true

ClientUserName & ClientUserName are gotten from apisettings:

private string ClientUserName => ApiSettings.Instance.ClientUsername;
private string ClientPassword => ApiSettings.Instance.ClientPassword;

But the username/password I was getting in TryAuthenticateAsync() were not ClientUserName & ClientUserName it was the user’s own credentials.

Now using the Authenticate DTO I’m getting ClientUserName & ClientUserName in TryAuthenticateAsync()

Do you have any idea how it could be getting the users credentials earlier?

No, only devs with access to the code-base will be able to answer that.