Wonder how long until this is broken (browser fingerprinting?) or more likely, your login is banned?

Regarding login, the *only* available method is really username and password since this is required in order to obtain a token.

BlueSky API looks like a more attractive option with no reverse engineering required.

emusks impersonates browser fingerprints by default (https://emusks.tiago.zip/getting-started/configuration.html#...). as for logging in, you can get a token from your active browser session.