Flask authentication with Flask-Security
Figured it out. Turns out Flask-security already has /login /logout built in and my login function was largely ignored. It wasn't used during normal app execution. Except url_for was still processed hence the BuildError.
I was trying to use an outdated example from https://github.com/dracule/FlaskBootstrapSecurity and it was a fail. Flask-Security was updated 3 mo ago. The action param should be updated to action=url_for('security.login') and it will work.
TL;DR adding a url_prefix will not use Flask-Security's built in /login /logout and a lot of vars were renamed
I know this is an old question but just in case someone has this problem as I had, here's the related documentation