diff --git a/package.json b/package.json
index 96704e4..1e657c8 100644
--- a/package.json
+++ b/package.json
@@ -9,12 +9,9 @@
   "scripts": {
     "dev": "vite",
     "dev:app": "vite --port 5173 --strictPort",
-    "build": "tsc -b && vite build && npm run auth:build",
-    "auth:build": "vite build --config vite.auth.config.ts",
-    "auth:dev": "vite --config vite.auth.config.ts --port 5175 --strictPort",
-    "prebuild:all": "npm run auth:build && node scripts/ensure-playwright-runner.js && node scripts/ensure-personal-server.js",
+    "build": "tsc -b && vite build",
+    "prebuild:all": "node scripts/ensure-playwright-runner.js && node scripts/ensure-personal-server.js",
     "pretauri:dev": "npm run prebuild:all",
-    "pretauri:build": "npm run auth:build",
     "lint": "eslint .",
     "format": "prettier --write \"**/*.{ts,tsx,js,jsx,json,css,scss,md}\"",
     "format:check": "prettier --check \"**/*.{ts,tsx,js,jsx,json,css,scss,md}\"",
@@ -33,8 +30,6 @@
   },
   "dependencies": {
     "@base-ui/react": "^1.1.0",
-    "@privy-io/js-sdk-core": "^0.58.7",
-    "@privy-io/react-auth": "^2.4.0",
     "@reduxjs/toolkit": "^2.11.2",
     "@tabler/icons-react": "^3.36.1",
     "@tauri-apps/api": "~2.10.1",
@@ -54,6 +49,7 @@
     "shadcn": "^3.7.0",
     "tailwind-merge": "^3.4.0",
     "tw-animate-css": "^1.4.0",
+    "viem": "^2.45.1",
     "zod": "^3.25.76"
   },
   "devDependencies": {
diff --git a/src-tauri/src/commands/auth.rs b/src-tauri/src/commands/auth.rs
deleted file mode 100644
index c39685d..0000000
--- a/src-tauri/src/commands/auth.rs
+++ /dev/null
@@ -1,500 +0,0 @@
-use serde::{Deserialize, Serialize};
-use std::io::{BufRead, BufReader, Read, Write};
-use std::net::TcpListener;
-use std::path::PathBuf;
-use std::sync::mpsc;
-use std::thread;
-use tauri::path::BaseDirectory;
-use tauri::{AppHandle, Emitter, Manager};
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct AuthResult {
-    pub success: bool,
-    pub user: Option<AuthUser>,
-    #[serde(rename = "walletAddress")]
-    pub wallet_address: Option<String>,
-    #[serde(rename = "authToken")]
-    pub auth_token: Option<String>,
-    #[serde(rename = "masterKeySignature")]
-    pub master_key_signature: Option<String>,
-    pub error: Option<String>,
-}
-
-#[derive(Debug, Serialize, Deserialize, Clone)]
-pub struct AuthUser {
-    pub id: String,
-    pub email: Option<String>,
-}
-
-/// Start the external browser auth flow
-#[tauri::command]
-pub async fn start_browser_auth(
-    app: AppHandle,
-    privy_app_id: String,
-    privy_client_id: Option<String>,
-) -> Result<String, String> {
-    log::info!("Starting browser auth flow with Privy app ID: {}", privy_app_id);
-
-    // Try to bind to fixed port 3083 (whitelisted in Privy dashboard)
-    // Fall back to 5173 or random port if unavailable
-    let (listener, callback_port) = if let Ok(l) = TcpListener::bind("127.0.0.1:3083") {
-        log::info!("Bound to preferred port 3083");
-        (l, 3083u16)
-    } else if let Ok(l) = TcpListener::bind("127.0.0.1:5173") {
-        log::info!("Port 3083 unavailable, using fallback port 5173");
-        (l, 5173u16)
-    } else {
-        let l = TcpListener::bind("127.0.0.1:0")
-            .map_err(|e| format!("Failed to bind to any port: {}", e))?;
-        let port = l.local_addr()
-            .map_err(|e| format!("Failed to get local address: {}", e))?
-            .port();
-        log::warn!("Using random port {} - auth may fail if not whitelisted in Privy", port);
-        (l, port)
-    };
-
-    log::info!("Auth callback server starting on port {}", callback_port);
-
-    // Channel to receive auth result
-    let (tx, _rx) = mpsc::channel::<AuthResult>();
-
-    let app_handle = app.clone();
-    let privy_app_id_clone = privy_app_id.clone();
-    let privy_client_id_clone = privy_client_id.unwrap_or_default();
-
-    // Spawn callback server thread
-    thread::spawn(move || {
-        log::info!("Auth callback server thread started");
-
-        let resource_dir = app_handle
-            .path()
-            .resolve("auth-page", BaseDirectory::Resource)
-            .ok()
-            .filter(|path| path.exists());
-
-        let auth_dir = resource_dir.unwrap_or_else(|| {
-            PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("auth-page")
-        });
-
-        log::info!("Auth page directory: {}", auth_dir.display());
-
-        for stream in listener.incoming() {
-            match stream {
-                Ok(mut stream) => {
-                    let mut reader = BufReader::new(stream.try_clone().unwrap());
-                    let mut request_line = String::new();
-
-                    if reader.read_line(&mut request_line).is_err() {
-                        continue;
-                    }
-
-                    log::debug!("Auth callback server received: {}", request_line.trim());
-
-                    // Parse request
-                    let parts: Vec<&str> = request_line.split_whitespace().collect();
-                    if parts.len() < 2 {
-                        continue;
-                    }
-
-                    let method = parts[0];
-                    let path = parts[1];
-
-                    let request_path = path.split('?').next().unwrap_or(path);
-
-                    match method {
-                        "GET" if path == "/" || path.starts_with("/?") => {
-                            let index_path = auth_dir.join("index.html");
-                            match std::fs::read_to_string(&index_path) {
-                                Ok(html) => {
-                                    let resolved_html = html
-                                        .replace("%PRIVY_APP_ID%", &privy_app_id_clone)
-                                        .replace("%PRIVY_CLIENT_ID%", &privy_client_id_clone);
-                                    let response = format!(
-                                        "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nCache-Control: no-store\r\nContent-Length: {}\r\n\r\n{}",
-                                        resolved_html.len(),
-                                        resolved_html
-                                    );
-                                    let _ = stream.write_all(response.as_bytes());
-                                }
-                                Err(err) => {
-                                    log::error!(
-                                        "Failed to read auth page index.html: {}",
-                                        err
-                                    );
-                                    let response = "HTTP/1.1 500 Internal Server Error\r\n\r\n";
-                                    let _ = stream.write_all(response.as_bytes());
-                                }
-                            }
-                        }
-                        "GET"
-                            if request_path.starts_with("/assets/")
-                                || request_path.starts_with("/fonts/")
-                                || request_path == "/favicon.ico" =>
-                        {
-                            let asset_path = auth_dir.join(request_path.trim_start_matches('/'));
-                            match std::fs::read(&asset_path) {
-                                Ok(bytes) => {
-                                    let mime =
-                                        mime_guess::from_path(&asset_path).first_or_octet_stream();
-                                    let header = format!(
-                                        "HTTP/1.1 200 OK\r\nContent-Type: {}\r\nCache-Control: no-store\r\nContent-Length: {}\r\n\r\n",
-                                        mime,
-                                        bytes.len()
-                                    );
-                                    let _ = stream.write_all(header.as_bytes());
-                                    let _ = stream.write_all(&bytes);
-                                }
-                                Err(_) => {
-                                    let response = "HTTP/1.1 404 Not Found\r\n\r\n";
-                                    let _ = stream.write_all(response.as_bytes());
-                                }
-                            }
-                        }
-                        "POST" if path == "/auth-callback" || path == "/" => {
-                            // Read headers to get content length
-                            let mut content_length: usize = 0;
-                            let mut line = String::new();
-                            loop {
-                                line.clear();
-                                if reader.read_line(&mut line).is_err() || line == "\r\n" {
-                                    break;
-                                }
-                                if line.to_lowercase().starts_with("content-length:") {
-                                    if let Some(len_str) = line.split(':').nth(1) {
-                                        content_length = len_str.trim().parse().unwrap_or(0);
-                                    }
-                                }
-                            }
-
-                            // Read body
-                            let mut body = vec![0u8; content_length];
-                            if reader.read_exact(&mut body).is_ok() {
-                                if let Ok(body_str) = String::from_utf8(body) {
-                                    log::info!("Auth callback received: {}", body_str);
-
-                                    // Parse auth result
-                                    if let Ok(auth_result) = serde_json::from_str::<AuthResult>(&body_str) {
-                                        // Send to channel
-                                        let _ = tx.send(auth_result.clone());
-
-                                        // Emit event to frontend
-                                        let _ = app_handle.emit("auth-complete", auth_result);
-
-                                        // Focus the app window
-                                        if let Some(window) = app_handle.get_webview_window("main") {
-                                            let _ = window.set_focus();
-                                        }
-                                    }
-                                }
-                            }
-
-                            // Send response with CORS headers
-                            let response = "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\n\r\n{\"ok\":true}";
-                            let _ = stream.write_all(response.as_bytes());
-
-                            log::info!("Auth complete, waiting for close-tab request");
-                        }
-                        "GET" if path == "/server-identity" => {
-                            // Proxy the personal server health check to avoid CORS
-                            log::info!("Server identity request received");
-                            let cors = "Access-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type";
-                            let port_opt = super::server::PERSONAL_SERVER_PORT.lock().ok().and_then(|g| *g);
-                            log::info!("Personal server port: {:?}", port_opt);
-                            if let Some(port) = port_opt {
-                                match reqwest::blocking::get(format!("http://localhost:{}/health", port)) {
-                                    Ok(resp) if resp.status().is_success() => {
-                                        let body = resp.text().unwrap_or_default();
-                                        let resp_str = format!(
-                                            "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                            cors, body.len(), body
-                                        );
-                                        let _ = stream.write_all(resp_str.as_bytes());
-                                    }
-                                    _ => {
-                                        let resp_str = format!("HTTP/1.1 503 Service Unavailable\r\n{}\r\n\r\n", cors);
-                                        let _ = stream.write_all(resp_str.as_bytes());
-                                    }
-                                }
-                            } else {
-                                let resp_str = format!("HTTP/1.1 503 Service Unavailable\r\n{}\r\n\r\n", cors);
-                                let _ = stream.write_all(resp_str.as_bytes());
-                            }
-                        }
-                        "POST" if path == "/register-server" => {
-                            // Read POST body
-                            let mut content_length: usize = 0;
-                            let mut line = String::new();
-                            loop {
-                                line.clear();
-                                if reader.read_line(&mut line).is_err() || line == "\r\n" {
-                                    break;
-                                }
-                                if line.to_lowercase().starts_with("content-length:") {
-                                    if let Some(len_str) = line.split(':').nth(1) {
-                                        content_length = len_str.trim().parse().unwrap_or(0);
-                                    }
-                                }
-                            }
-
-                            let cors = "Access-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type";
-                            let mut body = vec![0u8; content_length];
-                            let gateway_url = "https://data-gateway-env-dev-opendatalabs.vercel.app";
-
-                            if reader.read_exact(&mut body).is_ok() {
-                                if let Ok(body_str) = String::from_utf8(body) {
-                                    log::info!("Register server request: {}", body_str);
-
-                                    // Parse { signature, message }
-                                    if let Ok(reg) = serde_json::from_str::<serde_json::Value>(&body_str) {
-                                        let signature = reg["signature"].as_str().unwrap_or_default();
-                                        let message = &reg["message"];
-
-                                        // POST to gateway
-                                        let client = reqwest::blocking::Client::new();
-                                        match client
-                                            .post(format!("{}/v1/servers", gateway_url))
-                                            .header("Content-Type", "application/json")
-                                            .header("Authorization", format!("Web3Signed {}", signature))
-                                            .json(message)
-                                            .send()
-                                        {
-                                            Ok(resp) => {
-                                                let status = resp.status().as_u16();
-                                                let resp_body = resp.text().unwrap_or_default();
-                                                log::info!("Gateway register response: {} {}", status, resp_body);
-
-                                                if status == 200 || status == 201 || status == 409 {
-                                                    // Extract serverId from response and include in event
-                                                    let server_id = serde_json::from_str::<serde_json::Value>(&resp_body)
-                                                        .ok()
-                                                        .and_then(|v| v["serverId"].as_str().map(|s| s.to_string()));
-                                                    let _ = app_handle.emit("server-registered", serde_json::json!({
-                                                        "status": status,
-                                                        "serverId": server_id
-                                                    }));
-                                                }
-
-                                                let resp_str = format!(
-                                                    "HTTP/1.1 {} OK\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                                    status, cors, resp_body.len(), resp_body
-                                                );
-                                                let _ = stream.write_all(resp_str.as_bytes());
-                                            }
-                                            Err(e) => {
-                                                let err_body = format!("{{\"error\":\"{}\"}}", e);
-                                                let resp_str = format!(
-                                                    "HTTP/1.1 502 Bad Gateway\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                                    cors, err_body.len(), err_body
-                                                );
-                                                let _ = stream.write_all(resp_str.as_bytes());
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                        "GET" if request_path == "/check-server-url" => {
-                            // Proxy GET /v1/servers/{address} to gateway
-                            let cors = "Access-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization";
-                            let gateway_url = "https://data-gateway-env-dev-opendatalabs.vercel.app";
-                            let address = path.split("address=").nth(1).unwrap_or("").split('&').next().unwrap_or("");
-
-                            if address.is_empty() {
-                                let resp_str = format!(
-                                    "HTTP/1.1 400 Bad Request\r\nContent-Type: application/json\r\n{}\r\n\r\n{{\"error\":\"Missing address parameter\"}}",
-                                    cors
-                                );
-                                let _ = stream.write_all(resp_str.as_bytes());
-                            } else {
-                                let client = reqwest::blocking::Client::new();
-                                match client
-                                    .get(format!("{}/v1/servers/{}", gateway_url, address))
-                                    .send()
-                                {
-                                    Ok(resp) => {
-                                        let status = resp.status().as_u16();
-                                        let resp_body = resp.text().unwrap_or_default();
-                                        log::info!("Gateway check-server-url response: {} {}", status, &resp_body[..resp_body.len().min(200)]);
-                                        let resp_str = format!(
-                                            "HTTP/1.1 {} OK\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                            status, cors, resp_body.len(), resp_body
-                                        );
-                                        let _ = stream.write_all(resp_str.as_bytes());
-                                    }
-                                    Err(e) => {
-                                        let err_body = format!("{{\"error\":\"{}\"}}", e);
-                                        let resp_str = format!(
-                                            "HTTP/1.1 502 Bad Gateway\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                            cors, err_body.len(), err_body
-                                        );
-                                        let _ = stream.write_all(resp_str.as_bytes());
-                                    }
-                                }
-                            }
-                        }
-                        "POST" if path == "/deregister-server" => {
-                            // Proxy DELETE /v1/servers/{serverAddress} to gateway
-                            let mut content_length: usize = 0;
-                            let mut line = String::new();
-                            loop {
-                                line.clear();
-                                if reader.read_line(&mut line).is_err() || line == "\r\n" {
-                                    break;
-                                }
-                                if line.to_lowercase().starts_with("content-length:") {
-                                    if let Some(len_str) = line.split(':').nth(1) {
-                                        content_length = len_str.trim().parse().unwrap_or(0);
-                                    }
-                                }
-                            }
-
-                            let cors = "Access-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization";
-                            let gateway_url = "https://data-gateway-env-dev-opendatalabs.vercel.app";
-                            let mut body = vec![0u8; content_length];
-
-                            if reader.read_exact(&mut body).is_ok() {
-                                if let Ok(body_str) = String::from_utf8(body) {
-                                    log::info!("Deregister server request: {}", body_str);
-
-                                    if let Ok(dereg) = serde_json::from_str::<serde_json::Value>(&body_str) {
-                                        let server_address = dereg["serverAddress"].as_str().unwrap_or_default();
-                                        let signature = dereg["signature"].as_str().unwrap_or_default();
-                                        let owner_address = dereg["ownerAddress"].as_str().unwrap_or_default();
-                                        let deadline = dereg["deadline"].as_u64().unwrap_or(0);
-
-                                        let delete_body = serde_json::json!({
-                                            "ownerAddress": owner_address,
-                                            "deadline": deadline,
-                                        });
-
-                                        let client = reqwest::blocking::Client::new();
-                                        match client
-                                            .delete(format!("{}/v1/servers/{}", gateway_url, server_address))
-                                            .header("Content-Type", "application/json")
-                                            .header("Authorization", format!("Web3Signed {}", signature))
-                                            .json(&delete_body)
-                                            .send()
-                                        {
-                                            Ok(resp) => {
-                                                let status = resp.status().as_u16();
-                                                let resp_body = resp.text().unwrap_or_default();
-                                                log::info!("Gateway deregister response: {} {}", status, resp_body);
-                                                let resp_str = format!(
-                                                    "HTTP/1.1 {} OK\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                                    status, cors, resp_body.len(), resp_body
-                                                );
-                                                let _ = stream.write_all(resp_str.as_bytes());
-                                            }
-                                            Err(e) => {
-                                                let err_body = format!("{{\"error\":\"{}\"}}", e);
-                                                let resp_str = format!(
-                                                    "HTTP/1.1 502 Bad Gateway\r\nContent-Type: application/json\r\n{}\r\nContent-Length: {}\r\n\r\n{}",
-                                                    cors, err_body.len(), err_body
-                                                );
-                                                let _ = stream.write_all(resp_str.as_bytes());
-                                            }
-                                        }
-                                    }
-                                }
-                            }
-                        }
-                        "GET" if path == "/close-tab" => {
-                            // Browser tab navigates here after showing success.
-                            // Serve a page with the success message, then close the tab
-                            // from the native side via Cmd+W (macOS).
-                            let close_html = r##"<!DOCTYPE html>
-<html><head><title>Signed in</title><style>
-body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; background: #f5f5f7; display: flex; align-items: center; justify-content: center; min-height: 100vh; margin: 0; }
-.c { text-align: center; background: white; border-radius: 16px; padding: 40px; box-shadow: 0 4px 24px rgba(0,0,0,0.06); max-width: 400px; }
-.i { width: 64px; height: 64px; background: #dcfce7; border-radius: 50%; display: flex; align-items: center; justify-content: center; margin: 0 auto 20px; }
-h2 { font-size: 22px; color: #1a1a1a; margin-bottom: 12px; }
-p { font-size: 14px; color: #6b7280; }
-</style></head><body><div class="c">
-<div class="i"><svg width="32" height="32" fill="none" viewBox="0 0 24 24" stroke="#22c55e"><path stroke-linecap="round" stroke-linejoin="round" stroke-width="2" d="M5 13l4 4L19 7"/></svg></div>
-<h2>You're signed in!</h2>
-<p>Closing this tab...</p>
-</div></body></html>"##;
-                            let response = format!(
-                                "HTTP/1.1 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: {}\r\n\r\n{}",
-                                close_html.len(),
-                                close_html
-                            );
-                            let _ = stream.write_all(response.as_bytes());
-
-                            #[cfg(target_os = "macos")]
-                            {
-                                std::thread::sleep(std::time::Duration::from_millis(800));
-                                let _ = std::process::Command::new("osascript")
-                                    .arg("-e")
-                                    .arg(r#"tell application "System Events" to keystroke "w" using command down"#)
-                                    .output();
-                            }
-
-                            log::info!("Close-tab done, shutting down auth server");
-                            break;
-                        }
-                        "OPTIONS" => {
-                            // Handle CORS preflight
-                            let response = "HTTP/1.1 200 OK\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: POST, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type\r\n\r\n";
-                            let _ = stream.write_all(response.as_bytes());
-                        }
-                        _ => {
-                            let response = "HTTP/1.1 404 Not Found\r\n\r\n";
-                            let _ = stream.write_all(response.as_bytes());
-                        }
-                    }
-                }
-                Err(e) => {
-                    log::error!("Auth callback server connection error: {}", e);
-                }
-            }
-        }
-
-        log::info!("Auth callback server thread ended");
-    });
-
-    // Open browser to the self-contained auth page served by our localhost server
-    let auth_url = format!("http://localhost:{}", callback_port);
-    log::info!("Opening browser to: {}", auth_url);
-
-    #[cfg(target_os = "macos")]
-    {
-        std::process::Command::new("open")
-            .arg(&auth_url)
-            .spawn()
-            .map_err(|e| format!("Failed to open browser: {}", e))?;
-    }
-
-    #[cfg(target_os = "linux")]
-    {
-        std::process::Command::new("xdg-open")
-            .arg(&auth_url)
-            .spawn()
-            .map_err(|e| format!("Failed to open browser: {}", e))?;
-    }
-
-    #[cfg(target_os = "windows")]
-    {
-        std::process::Command::new("cmd")
-            .args(["/C", "start", &auth_url])
-            .spawn()
-            .map_err(|e| format!("Failed to open browser: {}", e))?;
-    }
-
-    // Emit event that auth flow has started
-    app.emit(
-        "auth-started",
-        serde_json::json!({ "callbackPort": callback_port, "authUrl": auth_url }),
-    )
-        .map_err(|e| format!("Failed to emit event: {}", e))?;
-
-    Ok(auth_url)
-}
-
-/// Cancel the auth flow
-#[tauri::command]
-pub fn cancel_browser_auth() -> Result<(), String> {
-    // The server will automatically close when the thread ends
-    // or when the auth completes
-    Ok(())
-}
diff --git a/src-tauri/src/commands/mod.rs b/src-tauri/src/commands/mod.rs
index 6fe1ab1..c4c602a 100644
--- a/src-tauri/src/commands/mod.rs
+++ b/src-tauri/src/commands/mod.rs
@@ -1,11 +1,9 @@
-pub mod auth;
 pub mod connector;
 pub mod download;
 pub mod file_ops;
 pub mod server;
 pub mod updates;
 
-pub use auth::*;
 pub use connector::*;
 pub use download::*;
 pub use file_ops::*;
diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index fa6dbef..c18878e 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -2,13 +2,13 @@ mod commands;
 mod processors;
 
 use commands::{
-    cancel_browser_auth, check_browser_available, check_connected_platforms, check_connector_updates,
+    check_browser_available, check_connected_platforms, check_connector_updates,
     cleanup_personal_server, clear_browser_session, debug_connector_paths, download_browser,
     download_chromium_rust, download_connector, get_app_config, get_installed_connectors,
     get_personal_server_status, get_platforms, get_registry_url, get_run_files, get_user_data_path,
     handle_download, list_browser_sessions, load_latest_source_export_full,
     load_latest_source_export_preview, load_run_export_data, load_runs, mark_export_synced,
-    open_folder, open_platform_export_folder, set_app_config, start_browser_auth,
+    open_folder, open_platform_export_folder, set_app_config,
     start_personal_server, start_connector_run, stop_connector_run, stop_personal_server,
     test_nodejs, write_export_data,
 };
@@ -79,8 +79,6 @@ pub fn run() {
             get_installed_connectors,
             get_app_config,
             set_app_config,
-            start_browser_auth,
-            cancel_browser_auth,
             start_personal_server,
             stop_personal_server,
             get_personal_server_status,
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 6662745..6c0d080 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -6,7 +6,7 @@
   "build": {
     "frontendDist": "../dist",
     "devUrl": "http://localhost:5173",
-    "beforeDevCommand": "npm run auth:build && npm run dev",
+    "beforeDevCommand": "npm run dev",
     "beforeBuildCommand": "npm run build"
   },
   "app": {
@@ -62,10 +62,7 @@
       "../connectors/openai/**/*": "connectors/openai/",
       "../connectors/spotify/**/*": "connectors/spotify/",
       "../playwright-runner/dist/*": "playwright-runner/dist/",
-      "../personal-server/dist/personal-server*": "personal-server/dist/",
-      "auth-page/*": "auth-page/",
-      "auth-page/assets/*": "auth-page/assets/",
-      "auth-page/fonts/*": "auth-page/fonts/"
+      "../personal-server/dist/personal-server*": "personal-server/dist/"
     },
     "windows": {
       "nsis": {
diff --git a/src/App.tsx b/src/App.tsx
index 5734f98..d0e16d6 100644
--- a/src/App.tsx
+++ b/src/App.tsx
@@ -1,13 +1,10 @@
 import { lazy, Suspense } from "react"
-import { BrowserRouter, Routes, Route, useLocation } from "react-router-dom"
+import { BrowserRouter, Routes, Route } from "react-router-dom"
 import { Provider } from "react-redux"
 import { store } from "./state/store"
 import { useEvents } from "./hooks/useEvents"
 import { useInitialize } from "./hooks/useInitialize"
 import { TopNav } from "./components/top-nav"
-import { PrivyProvider } from "./components/providers/PrivyProvider"
-import { InlineLogin } from "./components/auth/InlineLogin"
-import { BrowserLogin } from "./pages/browser-login"
 import { useDeepLink } from "./hooks/use-deep-link"
 import { usePersonalServer } from "./hooks/usePersonalServer"
 import { usePendingApprovalRetry } from "./hooks/usePendingApproval"
@@ -84,7 +81,6 @@ function AppContent() {
               <Route path={ROUTES.settings} element={<Settings />} />
               <Route path={ROUTES.connect} element={<Connect />} />
               <Route path={ROUTES.grant} element={<Grant />} />
-              <Route path={ROUTES.login} element={<InlineLogin />} />
             </Routes>
           </Suspense>
         </main>
@@ -93,47 +89,32 @@ function AppContent() {
   )
 }
 
-// Router wrapper that handles both app content and standalone browser login
-function AppRouter() {
-  const location = useLocation()
-
-  // Browser login page is standalone (for external browser auth flow)
-  if (location.pathname === ROUTES.browserLogin) {
-    return <BrowserLogin />
-  }
-
-  return <AppContent />
-}
-
 function App() {
   return (
     <Provider store={store}>
-      <PrivyProvider>
-        <div style={dotPatternStyle} className="min-h-screen">
-          <BrowserRouter>
-            <Suspense fallback={<div className="p-8">Loading...</div>}>
-              <Routes>
-                <Route path={ROUTES.browserLogin} element={<BrowserLogin />} />
-                <Route
-                  path={ROUTES.rickrollMockRoot}
-                  element={<RickrollMockRoot />}
-                />
-                <Route
-                  path={ROUTES.rickrollMockSignIn}
-                  element={<RickrollMockSignIn />}
-                />
-                {/* Demo flow (throwaway — for video recording) */}
-                <Route path={ROUTES.demo} element={<DemoIndex />} />
-                <Route path={ROUTES.demoConnect} element={<DemoConnect />} />
-                <Route path={ROUTES.demoAuth} element={<DemoAuth />} />
-                <Route path={ROUTES.demoConsent} element={<DemoConsent />} />
-                <Route path={ROUTES.demoSuccess} element={<DemoSuccess />} />
-                <Route path="/*" element={<AppRouter />} />
-              </Routes>
-            </Suspense>
-          </BrowserRouter>
-        </div>
-      </PrivyProvider>
+      <div style={dotPatternStyle} className="min-h-screen">
+        <BrowserRouter>
+          <Suspense fallback={<div className="p-8">Loading...</div>}>
+            <Routes>
+              <Route
+                path={ROUTES.rickrollMockRoot}
+                element={<RickrollMockRoot />}
+              />
+              <Route
+                path={ROUTES.rickrollMockSignIn}
+                element={<RickrollMockSignIn />}
+              />
+              {/* Demo flow (throwaway — for video recording) */}
+              <Route path={ROUTES.demo} element={<DemoIndex />} />
+              <Route path={ROUTES.demoConnect} element={<DemoConnect />} />
+              <Route path={ROUTES.demoAuth} element={<DemoAuth />} />
+              <Route path={ROUTES.demoConsent} element={<DemoConsent />} />
+              <Route path={ROUTES.demoSuccess} element={<DemoSuccess />} />
+              <Route path="/*" element={<AppContent />} />
+            </Routes>
+          </Suspense>
+        </BrowserRouter>
+      </div>
     </Provider>
   )
 }
diff --git a/src/auth-page/App.tsx b/src/auth-page/App.tsx
deleted file mode 100644
index 53e4865..0000000
--- a/src/auth-page/App.tsx
+++ /dev/null
@@ -1,263 +0,0 @@
-import { ArrowRight, Loader2, Mail } from "lucide-react"
-import { VanaLogotype } from "@/components/icons/vana-logotype"
-import { Button } from "@/components/ui/button"
-import { Input } from "@/components/ui/input"
-import { Text } from "@/components/typography/text"
-import { PlatformAppleIcon } from "@/components/icons/platform-apple"
-import { useAuthPage } from "./auth"
-import { cn } from "@/lib/classes"
-
-// View this page locally:
-// - npx vite --config vite.auth.config.ts
-// - open http://localhost:5173
-// (Optional) Full Tauri window: npm run tauri:dev
-
-const GoogleIcon = () => (
-  <svg className="size-5" viewBox="0 0 24 24" aria-hidden="true">
-    <path
-      fill="#4285F4"
-      d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
-    />
-    <path
-      fill="#34A853"
-      d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
-    />
-    <path
-      fill="#FBBC05"
-      d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
-    />
-    <path
-      fill="#EA4335"
-      d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
-    />
-  </svg>
-)
-
-export const App = () => {
-  const {
-    view,
-    loadingText,
-    error,
-    email,
-    code,
-    showCode,
-    isSendingEmail,
-    isVerifyingCode,
-    isGoogleLoading,
-    isAppleLoading,
-    walletIframeUrl,
-    walletIframeRef,
-    handleWalletIframeLoad,
-    handleEmailChange,
-    handleCodeChange,
-    handleEmailSubmit,
-    handleVerifyCode,
-    handleGoogleLogin,
-    handleAppleLogin,
-  } = useAuthPage()
-
-  const isEmailDisabled = isSendingEmail || isGoogleLoading || isAppleLoading
-  const isVerifyDisabled = isVerifyingCode || isGoogleLoading || isAppleLoading
-
-  return (
-    <main className="viewport-wrapper bg-muted text-foreground">
-      <div className="viewport-wrapper-child flex min-h-[inherit] items-center justify-center px-6 py-10">
-        <div
-          className={cn(
-            "container bg-background rounded-squish",
-            "py-w12 px-w8",
-            "ring-1 ring-foreground/10"
-          )}
-        >
-          {view === "loading" && (
-            <div className="flex flex-col items-center justify-center gap-4 py-8 text-center">
-              <Loader2 className="size-8 animate-spin text-accent" />
-              <Text intent="small" color="mutedForeground">
-                {loadingText}
-              </Text>
-            </div>
-          )}
-
-          {view === "success" && (
-            <div className="flex flex-col items-center justify-center gap-4 py-8 text-center">
-              <div className="flex size-16 items-center justify-center rounded-full bg-success/20 text-success">
-                <svg
-                  className="size-8"
-                  viewBox="0 0 24 24"
-                  fill="none"
-                  aria-hidden="true"
-                >
-                  <path
-                    d="M5 13l4 4L19 7"
-                    stroke="currentColor"
-                    strokeWidth="2"
-                    strokeLinecap="round"
-                    strokeLinejoin="round"
-                  />
-                </svg>
-              </div>
-              <Text as="h2" intent="heading" weight="semi">
-                Signed in.
-              </Text>
-              <Text intent="small" color="mutedForeground">
-                You may now close this tab.
-              </Text>
-            </div>
-          )}
-
-          {view === "login" && (
-            <div className="space-y-6">
-              <div className="space-y-gap">
-                <VanaLogotype height={13} className="text-iris" />
-                <Text as="h1" intent="title">
-                  <span className="text-iris">
-                    Data Connect uses Vana Passport
-                  </span>
-                  <br />
-                  to bring your data everywhere
-                </Text>
-                <Text as="p" dim>
-                  Sign-in or create your Vana Passport to grant permissions.
-                </Text>
-              </div>
-
-              {error && (
-                <div className="rounded-[10px] border border-destructive/30 bg-destructive/10 px-3 py-2 text-small text-destructive">
-                  {error}
-                </div>
-              )}
-
-              <div className="space-y-gap">
-                {!showCode && (
-                  <div className="flex items-center gap-3 rounded-[14px] border border-input bg-background px-3 py-1.5 focus-within:border-ring focus-within:ring-2 focus-within:ring-ring/20">
-                    <Mail className="size-5 text-muted-foreground" />
-                    <Input
-                      type="email"
-                      value={email}
-                      onChange={event => handleEmailChange(event.target.value)}
-                      onKeyDown={event => {
-                        if (event.key === "Enter") {
-                          handleEmailSubmit()
-                        }
-                      }}
-                      placeholder="jane@example.com"
-                      className="h-8 border-0 bg-transparent px-0 text-body focus-visible:border-transparent focus-visible:ring-0"
-                    />
-                    <Button
-                      type="button"
-                      variant="accent"
-                      size="icon"
-                      onClick={handleEmailSubmit}
-                      disabled={isEmailDisabled}
-                      aria-label="Send sign-in code"
-                    >
-                      <ArrowRight className="size-4" />
-                    </Button>
-                  </div>
-                )}
-
-                <Button
-                  type="button"
-                  variant="outline"
-                  size="lg"
-                  fullWidth
-                  className="justify-start gap-3"
-                  onClick={handleGoogleLogin}
-                  disabled={isGoogleLoading}
-                >
-                  <GoogleIcon />
-                  Continue with Google
-                </Button>
-
-                <Button
-                  type="button"
-                  variant="outline"
-                  size="lg"
-                  fullWidth
-                  className="justify-start gap-3"
-                  onClick={handleAppleLogin}
-                  disabled={isAppleLoading}
-                >
-                  <PlatformAppleIcon className="size-5" />
-                  Continue with Apple
-                </Button>
-              </div>
-
-              {showCode && (
-                <div className="space-y-3">
-                  <Text
-                    as="label"
-                    intent="small"
-                    weight="medium"
-                    className="block"
-                  >
-                    Enter verification code
-                  </Text>
-                  <Input
-                    type="text"
-                    value={code}
-                    onChange={event => handleCodeChange(event.target.value)}
-                    onKeyDown={event => {
-                      if (event.key === "Enter") {
-                        handleVerifyCode()
-                      }
-                    }}
-                    placeholder="------"
-                    maxLength={6}
-                    className="h-12 text-center text-xlarge tracking-[0.35em]"
-                  />
-                  <Button
-                    type="button"
-                    variant="accent"
-                    size="lg"
-                    fullWidth
-                    onClick={handleVerifyCode}
-                    disabled={isVerifyDisabled}
-                  >
-                    {isVerifyingCode ? "Verifying..." : "Verify code"}
-                  </Button>
-                </div>
-              )}
-
-              <Text
-                intent="fine"
-                color="mutedForeground"
-                align="center"
-                className="leading-relaxed"
-              >
-                By creating an account, you agree to our{" "}
-                <a
-                  className="link"
-                  href="https://www.vana.org/terms"
-                  target="_blank"
-                >
-                  Terms of Service
-                </a>{" "}
-                and{" "}
-                <a
-                  className="link"
-                  href="https://www.vana.org/privacy-policy"
-                  target="_blank"
-                >
-                  Privacy Policy
-                </a>
-                .
-              </Text>
-            </div>
-          )}
-        </div>
-
-        {walletIframeUrl && (
-          <iframe
-            ref={walletIframeRef}
-            title="Privy Wallet"
-            src={walletIframeUrl}
-            onLoad={handleWalletIframeLoad}
-            className="hidden"
-            data-privy-wallet="true"
-          />
-        )}
-      </div>
-    </main>
-  )
-}
diff --git a/src/auth-page/README.md b/src/auth-page/README.md
deleted file mode 100644
index 114f548..0000000
--- a/src/auth-page/README.md
+++ /dev/null
@@ -1,85 +0,0 @@
-## Auth Page
-
-### What this is
-
-- Standalone browser auth page — a **completely separate Vite application**, not
-  a React Router page.
-- The Tauri backend (`auth.rs`) serves this as static HTML in the user's **real
-  browser** (Chrome/Safari/etc.), not inside the Tauri webview. OAuth redirects
-  (Google, Apple) bounce back to a tiny local HTTP server that `start_browser_auth`
-  spins up.
-- Uses the Privy **JS SDK** (`@privy-io/js-sdk-core`) rather than the React SDK.
-- Posts auth results back to the local auth server via `POST /auth-callback`,
-  then shows a success message; the user closes the tab manually.
-- Creates an embedded wallet, signs the master key, and registers the Personal
-  Server when possible.
-- For the full rationale and flow tradeoffs, see
-  `docs/_archive/spike-privy-auth-architecture.md`.
-
-### How it is invoked
-
-- `useGrantFlow` calls the Tauri command `start_browser_auth` when auth is
-  required.
-- The Tauri command serves this page and opens it in the user's real browser.
-
-### Build & output
-
-- Builds via `npm run auth:build` → output lands in `src-tauri/auth-page/`.
-- `pretauri:dev` and `pretauri:build` both run `auth:build` automatically, so
-  the auth page is always rebuilt before any Tauri build.
-- Commit policy: treat `src-tauri/auth-page/*` as generated output. Do not commit
-  hash-only updates in `src-tauri/auth-page/index.html` unless the matching built
-  assets in `src-tauri/auth-page/assets/*` (and related generated files) are
-  committed together and validated.
-
-### Config injection
-
-- `index.html` contains `%PRIVY_APP_ID%` / `%PRIVY_CLIENT_ID%` placeholders.
-- **Dev**: the `authHtmlPlaceholders` Vite plugin (in `vite.auth.config.ts`)
-  replaces them with `VITE_PRIVY_*` env vars from `.env.local`.
-- **Production**: Rust injects the real values at serve-time before sending
-  the HTML to the browser.
-- The page reads these via `window.__AUTH_CONFIG__` (declared in `types.ts`).
-
-### Auth result contract
-
-`POST /auth-callback` receives an `AuthResult`:
-
-```ts
-{
-  success: boolean
-  user?: { id: string; email?: string | null }
-  walletAddress?: string | null
-  authToken?: string | null
-  masterKeySignature?: string | null
-  error?: string
-}
-```
-
-### Files
-
-- `index.html`: HTML shell with config placeholders.
-- `main.tsx`: Standalone React entry point (`createRoot`, no router).
-- `App.tsx`: UI shell and view switching (loading → login → success).
-- `auth.ts`: Privy JS SDK logic, wallet setup, server registration, callback.
-- `types.ts`: `AuthResult`, `AuthConfig`, `AuthView`, `window.__AUTH_CONFIG__`.
-- `styles.css`: Re-exports the main app styles (`@import "../styles/index.css"`).
-
-### Shared component coupling
-
-`App.tsx` imports `Button`, `Input`, `Text`, and icons from `@/components/` via
-the `@` alias configured in `vite.auth.config.ts`. Changes to these shared
-components affect the auth page.
-
-### Dev usage
-
-- Run: `npm run auth:dev`
-- Open: `http://localhost:5175`
-- Optionally run the app: `npm run dev:app`
-
-### Related routes
-
-- `/browser-login` is a separate React Router page that uses the Privy **React**
-  SDK and a different callback mechanism (`callbackPort` query param).
-- As of now, the grant flow uses **this** auth page via `start_browser_auth`,
-  not `/browser-login`.
diff --git a/src/auth-page/auth.test.ts b/src/auth-page/auth.test.ts
deleted file mode 100644
index b66ed41..0000000
--- a/src/auth-page/auth.test.ts
+++ /dev/null
@@ -1,213 +0,0 @@
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest"
-import { act, renderHook, waitFor } from "@testing-library/react"
-import * as authModule from "./auth"
-
-const mockPrivy = vi.hoisted(() => ({
-  mockLoginWithCode: vi.fn(),
-  mockLogout: vi.fn(),
-  mockInitialize: vi.fn(),
-  mockSetMessagePoster: vi.fn(),
-  mockGetAccessToken: vi.fn(),
-  mockGetURL: vi.fn(() => "https://wallet.example/"),
-  mockGetProvider: vi.fn(),
-  mockProviderRequest: vi.fn(),
-  mockEmailSendCode: vi.fn(),
-  mockEmailLoginWithCode: vi.fn(),
-  mockGenerateURL: vi.fn(),
-  mockEmbeddedWalletCreate: vi.fn(),
-  mockEmbeddedWalletOnMessage: vi.fn(),
-}))
-
-vi.mock("@privy-io/js-sdk-core", () => {
-  class MockPrivyClient {
-    auth = {
-      logout: mockPrivy.mockLogout,
-      oauth: {
-        loginWithCode: mockPrivy.mockLoginWithCode,
-        generateURL: mockPrivy.mockGenerateURL,
-      },
-      email: {
-        sendCode: mockPrivy.mockEmailSendCode,
-        loginWithCode: mockPrivy.mockEmailLoginWithCode,
-      },
-    }
-
-    embeddedWallet = {
-      getURL: mockPrivy.mockGetURL,
-      getProvider: mockPrivy.mockGetProvider,
-      create: mockPrivy.mockEmbeddedWalletCreate,
-      onMessage: mockPrivy.mockEmbeddedWalletOnMessage,
-    }
-
-    setMessagePoster = mockPrivy.mockSetMessagePoster
-    initialize = mockPrivy.mockInitialize
-    getAccessToken = mockPrivy.mockGetAccessToken
-  }
-
-  class LocalStorage {}
-
-  return { default: MockPrivyClient, LocalStorage }
-})
-
-const { scheduleCloseTab, useAuthPage } = authModule
-
-const createDeferred = <T>() => {
-  let resolve: (value: T) => void
-  let reject: (reason?: unknown) => void
-  const promise = new Promise<T>((res, rej) => {
-    resolve = res
-    reject = rej
-  })
-  return { promise, resolve: resolve!, reject: reject! }
-}
-
-describe("scheduleCloseTab", () => {
-  afterEach(() => {
-    vi.useRealTimers()
-    vi.restoreAllMocks()
-  })
-
-  it("requests close-tab before closing", () => {
-    vi.useFakeTimers()
-    const closeSpy = vi.fn()
-    const requestSpy = vi.fn()
-
-    scheduleCloseTab(10, { close: closeSpy, requestCloseTab: requestSpy })
-    vi.runAllTimers()
-
-    expect(closeSpy).toHaveBeenCalled()
-    expect(requestSpy).toHaveBeenCalled()
-    expect(requestSpy.mock.invocationCallOrder[0]).toBeLessThan(
-      closeSpy.mock.invocationCallOrder[0]
-    )
-  })
-})
-
-describe("useAuthPage", () => {
-  beforeEach(() => {
-    mockPrivy.mockLoginWithCode.mockReset()
-    mockPrivy.mockLogout.mockReset()
-    mockPrivy.mockInitialize.mockReset()
-    mockPrivy.mockSetMessagePoster.mockReset()
-    mockPrivy.mockGetAccessToken.mockReset()
-    mockPrivy.mockGetURL.mockReset()
-    mockPrivy.mockGetProvider.mockReset()
-    mockPrivy.mockProviderRequest.mockReset()
-    mockPrivy.mockEmailSendCode.mockReset()
-    mockPrivy.mockEmailLoginWithCode.mockReset()
-    mockPrivy.mockGenerateURL.mockReset()
-    mockPrivy.mockEmbeddedWalletCreate.mockReset()
-    mockPrivy.mockEmbeddedWalletOnMessage.mockReset()
-    mockPrivy.mockGetURL.mockReturnValue("https://wallet.example/")
-    mockPrivy.mockGetProvider.mockResolvedValue({
-      request: mockPrivy.mockProviderRequest.mockResolvedValue("0xdeadbeef"),
-    })
-    mockPrivy.mockEmbeddedWalletCreate.mockResolvedValue({
-      user: {
-        linked_accounts: [
-          { type: "wallet", address: "0xabc", walletClientType: "privy" },
-        ],
-      },
-    })
-    ;(window as typeof window & { __AUTH_CONFIG__?: unknown }).__AUTH_CONFIG__ =
-      {
-        privyAppId: "app-id",
-        privyClientId: "client-id",
-      }
-  })
-
-  afterEach(() => {
-    vi.unstubAllGlobals()
-    window.history.pushState({}, "", "/")
-  })
-
-  it("shows an error when auth callback fails and skips close-tab", async () => {
-    window.history.pushState(
-      {},
-      "",
-      "/?privy_oauth_code=code&privy_oauth_state=state"
-    )
-
-    const fetchSpy = vi.fn(async (input: RequestInfo | URL) => {
-      const url = input.toString()
-      if (url.includes("/auth-callback")) {
-        return { ok: false, status: 500 } as Response
-      }
-      return { ok: true, status: 200 } as Response
-    })
-    vi.stubGlobal("fetch", fetchSpy)
-
-    const sessionDeferred = createDeferred<{
-      user: {
-        id: string
-        email?: { address?: string | null } | null
-        linked_accounts?: Array<{
-          type: string
-          address?: string
-          walletClientType?: string
-        }>
-      }
-    }>()
-    mockPrivy.mockLoginWithCode.mockReturnValueOnce(sessionDeferred.promise)
-
-    const scheduleSpy = vi.spyOn(authModule, "scheduleCloseTab")
-    const { result } = renderHook(() => useAuthPage())
-
-    await waitFor(() => {
-      expect(mockPrivy.mockLoginWithCode).toHaveBeenCalled()
-    })
-
-    act(() => {
-      const iframe = {
-        contentWindow: {} as Window,
-        addEventListener: vi.fn(),
-      } as unknown as HTMLIFrameElement
-      result.current.walletIframeRef.current = iframe
-    })
-
-    await act(async () => {
-      sessionDeferred.resolve({
-        user: {
-          id: "user-1",
-          email: { address: "user@example.com" },
-          linked_accounts: [
-            { type: "wallet", address: "0xabc", walletClientType: "privy" },
-          ],
-        },
-      })
-    })
-
-    await waitFor(() => {
-      expect(result.current.error).toBe(
-        "Couldn't return to the app. Try again."
-      )
-    })
-
-    expect(result.current.view).toBe("login")
-    expect(scheduleSpy).not.toHaveBeenCalled()
-  })
-
-  it("sets the wallet message poster on iframe load", async () => {
-    window.history.pushState({}, "", "/")
-
-    const { result } = renderHook(() => useAuthPage())
-
-    await waitFor(() => {
-      expect(result.current.view).toBe("login")
-    })
-
-    const iframe = {
-      contentWindow: {} as Window,
-      addEventListener: vi.fn(),
-    } as unknown as HTMLIFrameElement
-
-    act(() => {
-      result.current.walletIframeRef.current = iframe
-      result.current.handleWalletIframeLoad()
-    })
-
-    expect(mockPrivy.mockSetMessagePoster).toHaveBeenCalledWith(
-      iframe.contentWindow
-    )
-  })
-})
diff --git a/src/auth-page/auth.ts b/src/auth-page/auth.ts
deleted file mode 100644
index 8b7674d..0000000
--- a/src/auth-page/auth.ts
+++ /dev/null
@@ -1,945 +0,0 @@
-import { useCallback, useEffect, useRef, useState, type RefObject } from "react"
-import PrivyClient, { LocalStorage } from "@privy-io/js-sdk-core"
-import type { AuthConfig, AuthResult, AuthView } from "./types"
-
-type PrivyLinkedAccount = {
-  type: string
-  address?: string
-  email?: string
-  walletClientType?: string
-  wallet_client_type?: string
-}
-
-type PrivyUser = {
-  id: string
-  email?: { address?: string | null } | null
-  linked_accounts?: PrivyLinkedAccount[]
-  linkedAccounts?: PrivyLinkedAccount[]
-}
-
-type PrivySession = {
-  user: PrivyUser
-  accessToken?: string | null
-  access_token?: string | null
-}
-
-type UseAuthPageState = {
-  view: AuthView
-  loadingText: string
-  error: string | null
-  email: string
-  code: string
-  showCode: boolean
-  isSendingEmail: boolean
-  isVerifyingCode: boolean
-  isGoogleLoading: boolean
-  isAppleLoading: boolean
-  walletIframeUrl: string | null
-  walletIframeRef: RefObject<HTMLIFrameElement>
-  handleWalletIframeLoad: () => void
-  handleEmailChange: (value: string) => void
-  handleCodeChange: (value: string) => void
-  handleEmailSubmit: () => Promise<void>
-  handleVerifyCode: () => Promise<void>
-  handleGoogleLogin: () => Promise<void>
-  handleAppleLogin: () => Promise<void>
-}
-
-const MASTER_KEY_MESSAGE = "vana-master-key-v1"
-const LOGIN_ERROR_MESSAGE = "Auth init failed."
-
-type CloseTabActions = {
-  close?: () => void
-  requestCloseTab?: () => void
-}
-
-const requestCloseTabDefault = () => {
-  try {
-    void fetch("/close-tab", { method: "GET", keepalive: true })
-  } catch {
-    // ignored
-  }
-}
-
-export const scheduleCloseTab = (
-  delayMs = 1500,
-  actions: CloseTabActions = {}
-) => {
-  const close = actions.close ?? (() => window.close())
-  const requestCloseTab = actions.requestCloseTab ?? requestCloseTabDefault
-
-  window.setTimeout(() => {
-    try {
-      requestCloseTab()
-    } catch {
-      // ignored
-    }
-    window.setTimeout(() => {
-      try {
-        close()
-      } catch {
-        // ignored
-      }
-    }, 250)
-  }, delayMs)
-}
-
-const toHexMessage = (value: string) => {
-  const encoded = new TextEncoder().encode(value)
-  return `0x${Array.from(encoded)
-    .map(byte => byte.toString(16).padStart(2, "0"))
-    .join("")}`
-}
-
-const parseAuthConfig = (): { error: string } | { config: AuthConfig } => {
-  const config = window.__AUTH_CONFIG__
-  const privyAppId = (config?.privyAppId ?? "").trim()
-  const privyClientId = (config?.privyClientId ?? "").trim()
-  const hasPlaceholder = (value: string) => value.includes("%PRIVY_")
-
-  if (!privyAppId || hasPlaceholder(privyAppId)) {
-    return { error: "Missing Privy app config." }
-  }
-
-  if (!privyClientId || hasPlaceholder(privyClientId)) {
-    return { error: "Missing Privy client config." }
-  }
-
-  return { config: { privyAppId, privyClientId } satisfies AuthConfig }
-}
-
-export const useAuthPage = (): UseAuthPageState => {
-  const [view, setView] = useState<AuthView>("loading")
-  const [loadingText, setLoadingText] = useState("Starting...")
-  const [error, setError] = useState<string | null>(null)
-  const [email, setEmail] = useState("")
-  const [code, setCode] = useState("")
-  const [showCode, setShowCode] = useState(false)
-  const [isSendingEmail, setIsSendingEmail] = useState(false)
-  const [isVerifyingCode, setIsVerifyingCode] = useState(false)
-  const [isGoogleLoading, setIsGoogleLoading] = useState(false)
-  const [isAppleLoading, setIsAppleLoading] = useState(false)
-  const [walletIframeUrl, setWalletIframeUrl] = useState<string | null>(null)
-
-  const privyRef = useRef<PrivyClient | null>(null)
-  const currentEmailRef = useRef("")
-  const walletIframeRef = useRef<HTMLIFrameElement>(null!)
-  const messageHandlerInstalledRef = useRef(false)
-
-  const setWalletMessagePoster = useCallback(
-    (privy: PrivyClient | null) => {
-      if (!privy) return false
-      const iframe = walletIframeRef.current
-      if (!iframe?.contentWindow) return false
-      try {
-        privy.setMessagePoster(
-          iframe.contentWindow as unknown as Parameters<
-            typeof privy.setMessagePoster
-          >[0]
-        )
-        return true
-      } catch (err) {
-        console.warn("[AUTH] setMessagePoster error:", err)
-        return false
-      }
-    },
-    []
-  )
-
-  const showLoading = useCallback((message: string) => {
-    setView("loading")
-    setLoadingText(message)
-    setError(null)
-  }, [])
-
-  const showLoginForm = useCallback(() => {
-    setView("login")
-  }, [])
-
-  const showSuccess = useCallback(() => {
-    setView("success")
-  }, [])
-
-  const showError = useCallback((message: string) => {
-    setError(message)
-    setView("login")
-  }, [])
-
-  const handleWalletIframeLoad = useCallback(() => {
-    setWalletMessagePoster(privyRef.current)
-  }, [setWalletMessagePoster])
-
-  const createPrivyClient = useCallback(
-    async (config: AuthConfig, skipInit: boolean) => {
-      const privy = new PrivyClient({
-        appId: config.privyAppId,
-        clientId: config.privyClientId,
-        storage: new LocalStorage(),
-      })
-
-      if (!skipInit) {
-        try {
-          await privy.initialize()
-        } catch (initErr) {
-          console.log("Privy init (may be expected):", initErr)
-        }
-      }
-
-      return privy
-    },
-    []
-  )
-
-  const sendAuthResult = useCallback(async (result: AuthResult) => {
-    console.log("Sending auth result:", JSON.stringify(result))
-    try {
-      const resp = await fetch("/auth-callback", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(result),
-      })
-      console.log("Auth callback response:", resp.status)
-      return resp.ok
-    } catch (err) {
-      console.error("Failed to send auth result:", err)
-      return false
-    }
-  }, [])
-
-  const setupWalletIframe = useCallback(
-    async (privy: PrivyClient) => {
-      try {
-        console.log("[AUTH] setupWalletIframe: starting...")
-
-        const iframeUrl = privy.embeddedWallet.getURL()
-        console.log("[AUTH] iframe URL:", iframeUrl)
-        setWalletIframeUrl(iframeUrl)
-
-        await new Promise<void>(resolve => {
-          let resolved = false
-          const resolveOnce = () => {
-            if (resolved) return
-            resolved = true
-            window.clearTimeout(timeoutId)
-            resolve()
-          }
-          const timeoutId = window.setTimeout(() => {
-            if (resolved) return
-            console.warn("[AUTH] iframe setup timed out after 5s")
-            resolveOnce()
-          }, 5000)
-
-          const attachListeners = () => {
-            const iframe = walletIframeRef.current
-            if (!iframe) {
-              requestAnimationFrame(attachListeners)
-              return
-            }
-
-            // Install a single message forwarder synchronously so it's
-            // ready before getProvider() is called. React useEffect runs
-            // after commit and may miss early messages from the iframe.
-            if (!messageHandlerInstalledRef.current) {
-              messageHandlerInstalledRef.current = true
-              console.log("[AUTH] Installing message forwarder")
-              window.addEventListener("message", (event: MessageEvent) => {
-                const currentIframe = walletIframeRef.current
-                if (!currentIframe?.contentWindow) return
-                if (event.source !== currentIframe.contentWindow) return
-                const p = privyRef.current
-                if (!p) return
-                try {
-                  p.embeddedWallet.onMessage(event.data)
-                } catch (err) {
-                  console.warn("[AUTH] onMessage error:", err)
-                }
-              })
-            }
-
-            const handleLoad = () => {
-              if (resolved) return
-              console.log("[AUTH] iframe loaded")
-              setWalletMessagePoster(privy)
-              window.setTimeout(resolveOnce, 2000)
-            }
-
-            const handleError = (err: Event) => {
-              if (resolved) return
-              console.error("[AUTH] iframe load error:", err)
-              resolveOnce()
-            }
-
-            if (setWalletMessagePoster(privy)) {
-              resolveOnce()
-              return
-            }
-
-            iframe.addEventListener("load", handleLoad, { once: true })
-            iframe.addEventListener("error", handleError, { once: true })
-          }
-
-          attachListeners()
-        })
-
-        console.log("[AUTH] setupWalletIframe: done")
-      } catch (err) {
-        console.error("[AUTH] Embedded wallet iframe setup failed:", err)
-      }
-    },
-    [setWalletMessagePoster]
-  )
-
-  const registerPersonalServer = useCallback(
-    async (
-      privy: PrivyClient,
-      walletAddress: string,
-      walletAccount: PrivyLinkedAccount
-    ) => {
-      console.log("[AUTH] registerPersonalServer: starting...")
-      showLoading("Starting server...")
-
-      let identity: Record<string, unknown> | null = null
-
-      for (let i = 0; i < 30; i += 1) {
-        await new Promise(resolve => setTimeout(resolve, 2000))
-        try {
-          console.log("[AUTH] Polling /server-identity attempt", i + 1)
-          const resp = await fetch("/server-identity")
-          console.log("[AUTH] /server-identity response:", resp.status)
-          if (resp.ok) {
-            const data = await resp.json()
-            identity = data
-            console.log(
-              "[AUTH] Server identity:",
-              JSON.stringify(identity).substring(0, 200)
-            )
-            const addr = (
-              data as {
-                identity?: { address?: string }
-                address?: string
-              }
-            )
-            if (addr.identity?.address || addr.address) {
-              break
-            }
-            console.log("[AUTH] Identity available but no address yet")
-          }
-        } catch (err) {
-          console.warn("[AUTH] /server-identity fetch error:", err)
-        }
-      }
-
-      if (!identity) {
-        console.warn("[AUTH] Server not ready after 60s, skipping registration")
-        return
-      }
-
-      const identityRecord = identity as {
-        identity?: {
-          address?: string
-          publicKey?: string
-          serverId?: string
-        }
-        address?: string
-        publicKey?: string
-        serverId?: string
-      }
-
-      const serverAddress =
-        identityRecord.identity?.address ?? identityRecord.address
-      const publicKey =
-        identityRecord.identity?.publicKey ?? identityRecord.publicKey
-      const serverId =
-        identityRecord.identity?.serverId ?? identityRecord.serverId
-
-      // Tunnel URL is deterministic: https://{serverAddress}.server.vana.org
-      const tunnelPublicUrl = serverAddress
-        ? `https://${serverAddress.toLowerCase()}.server.vana.org`
-        : null
-
-      if (!tunnelPublicUrl) {
-        console.error("[AUTH] No server address — cannot derive tunnel URL")
-        return
-      }
-
-      console.log("[AUTH] Using derived tunnel URL:", tunnelPublicUrl)
-
-      if (serverId) {
-        // Check if existing registration has the correct URL
-        try {
-          const checkResp = await fetch(
-            `/check-server-url?address=${serverAddress}`
-          )
-          if (checkResp.ok) {
-            const gatewayData = await checkResp.json()
-            const currentUrl = (
-              gatewayData as { data?: { serverUrl?: string } }
-            )?.data?.serverUrl
-            if (currentUrl === tunnelPublicUrl) {
-              console.log(
-                "[AUTH] Server already registered with correct URL:",
-                serverId
-              )
-              return
-            }
-            console.log(
-              "[AUTH] Server registered with wrong URL:",
-              currentUrl,
-              "→ need:",
-              tunnelPublicUrl
-            )
-          }
-        } catch {
-          // If we can't check, proceed with deregister attempt
-        }
-
-        // Deregister the existing server so we can re-register with correct URL
-        showLoading("Updating server registration...")
-        const deadline = Math.floor(Date.now() / 1000) + 300
-
-        const deregTypedData = {
-          types: {
-            EIP712Domain: [
-              { name: "name", type: "string" },
-              { name: "version", type: "string" },
-              { name: "chainId", type: "uint256" },
-              { name: "verifyingContract", type: "address" },
-            ],
-            ServerDeregistration: [
-              { name: "ownerAddress", type: "address" },
-              { name: "serverAddress", type: "address" },
-              { name: "serverId", type: "bytes32" },
-              { name: "deadline", type: "uint256" },
-            ],
-          },
-          domain: {
-            name: "Vana Data Portability",
-            version: "1",
-            chainId: 14800,
-            verifyingContract: "0x1483B1F634DBA75AeaE60da7f01A679aabd5ee2c",
-          },
-          primaryType: "ServerDeregistration",
-          message: {
-            ownerAddress: walletAddress,
-            serverAddress,
-            serverId,
-            deadline,
-          },
-        }
-
-        await setupWalletIframe(privy)
-        const provider = await privy.embeddedWallet.getProvider(
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- PrivyLinkedAccount is a subset of the SDK's full type
-          walletAccount as any
-        )
-        const deregSig = await provider.request({
-          method: "eth_signTypedData_v4",
-          params: [walletAddress, JSON.stringify(deregTypedData)],
-        })
-
-        const deregResp = await fetch("/deregister-server", {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            serverAddress,
-            ownerAddress: walletAddress,
-            deadline,
-            signature: deregSig,
-          }),
-        })
-
-        if (!deregResp.ok && deregResp.status !== 404) {
-          console.warn("[AUTH] Deregistration failed:", deregResp.status)
-          // Fall through to try registration anyway — gateway may reject with 409
-        }
-
-        // Fall through to registration below with correct tunnel URL
-      }
-
-      if (!serverAddress || !publicKey) {
-        console.warn("[AUTH] Server identity missing address or publicKey")
-        return
-      }
-
-      showLoading("Registering server...")
-
-      const serverUrl = tunnelPublicUrl
-      const message = {
-        ownerAddress: walletAddress,
-        serverAddress,
-        publicKey,
-        serverUrl,
-      }
-
-      const typedData = {
-        types: {
-          EIP712Domain: [
-            { name: "name", type: "string" },
-            { name: "version", type: "string" },
-            { name: "chainId", type: "uint256" },
-            { name: "verifyingContract", type: "address" },
-          ],
-          ServerRegistration: [
-            { name: "ownerAddress", type: "address" },
-            { name: "serverAddress", type: "address" },
-            { name: "publicKey", type: "string" },
-            { name: "serverUrl", type: "string" },
-          ],
-        },
-        domain: {
-          name: "Vana Data Portability",
-          version: "1",
-          chainId: 14800,
-          verifyingContract: "0x1483B1F634DBA75AeaE60da7f01A679aabd5ee2c",
-        },
-        primaryType: "ServerRegistration",
-        message,
-      }
-
-      await setupWalletIframe(privy)
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any -- PrivyLinkedAccount is a subset of the SDK's full type
-      const provider = await privy.embeddedWallet.getProvider(walletAccount as any)
-      const signature = await provider.request({
-        method: "eth_signTypedData_v4",
-        params: [walletAddress, JSON.stringify(typedData)],
-      })
-
-      console.log(
-        "[AUTH] Server registration signed:",
-        signature?.substring(0, 20) + "..."
-      )
-
-      const regResp = await fetch("/register-server", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ signature, message }),
-      })
-
-      if (regResp.status === 409) {
-        console.log("[AUTH] Server already registered (409)")
-        return
-      }
-
-      if (!regResp.ok) {
-        const errText = await regResp.text().catch(() => "")
-        throw new Error(`Registration failed (${regResp.status}): ${errText}`)
-      }
-
-      console.log("[AUTH] Server registered successfully")
-    },
-    [showLoading, setupWalletIframe]
-  )
-
-  const handleAuthenticatedUser = useCallback(
-    async (
-      privy: PrivyClient,
-      user: PrivyUser,
-      session?: PrivySession | null
-    ) => {
-      showLoading("Wallet setup...")
-
-      const accounts = user.linked_accounts || user.linkedAccounts || []
-      console.log(
-        "[AUTH] linked_accounts (" + accounts.length + "):",
-        JSON.stringify(
-          accounts.map(a => ({
-            type: a.type,
-            address: a.address,
-            wallet_client_type: a.wallet_client_type,
-            walletClientType: a.walletClientType,
-            connector_type: (a as Record<string, unknown>).connector_type,
-          }))
-        )
-      )
-
-      const findEmbeddedWallet = (accts: PrivyLinkedAccount[]) =>
-        accts.find(
-          account =>
-            account.type === "wallet" &&
-            (account.walletClientType === "privy" ||
-              account.wallet_client_type === "privy")
-        )
-
-      let embeddedWallet = findEmbeddedWallet(accounts)
-      let walletAddress = embeddedWallet?.address ?? null
-      console.log(
-        "[AUTH] Initial find - walletAddress:",
-        walletAddress,
-        "embeddedWallet:",
-        embeddedWallet ? "found" : "null"
-      )
-
-      if (!walletAddress) {
-        try {
-          console.log("[AUTH] No wallet found, setting up iframe for create...")
-          await setupWalletIframe(privy)
-          console.log("[AUTH] Calling embeddedWallet.create()...")
-          const result = await privy.embeddedWallet.create({})
-          console.log(
-            "[AUTH] create() returned, keys:",
-            Object.keys(result || {})
-          )
-          const createdUser = (result as { user?: PrivyUser }).user
-          if (createdUser) {
-            const createdAccounts =
-              createdUser.linked_accounts || createdUser.linkedAccounts || []
-            console.log(
-              "[AUTH] create() user linked_accounts (" +
-                createdAccounts.length +
-                "):",
-              JSON.stringify(
-                createdAccounts.map(a => ({
-                  type: a.type,
-                  address: a.address,
-                  wallet_client_type: a.wallet_client_type,
-                  connector_type: (a as Record<string, unknown>).connector_type,
-                }))
-              )
-            )
-            embeddedWallet = findEmbeddedWallet(createdAccounts)
-          } else {
-            // create() might return user at root level (not nested)
-            console.log(
-              "[AUTH] create() result has no .user, checking root:",
-              JSON.stringify(result).substring(0, 300)
-            )
-            const rootUser = result as unknown as PrivyUser
-            const rootAccounts =
-              rootUser?.linked_accounts || rootUser?.linkedAccounts || []
-            if (rootAccounts.length > 0) {
-              embeddedWallet = findEmbeddedWallet(rootAccounts)
-            }
-          }
-          walletAddress = embeddedWallet?.address ?? null
-          console.log(
-            "[AUTH] After create - walletAddress:",
-            walletAddress,
-            "embeddedWallet:",
-            embeddedWallet ? "found" : "null"
-          )
-        } catch (err) {
-          console.error("[AUTH] Failed to create embedded wallet:", err)
-        }
-      }
-
-      let authToken = session?.accessToken ?? session?.access_token ?? null
-      if (!authToken) {
-        try {
-          authToken = await privy.getAccessToken()
-        } catch {
-          authToken = null
-        }
-      }
-
-      let masterKeySignature: string | null = null
-      console.log(
-        "[AUTH] Pre-signing check - walletAddress:",
-        walletAddress,
-        "embeddedWallet truthy:",
-        !!embeddedWallet
-      )
-      if (walletAddress && embeddedWallet) {
-        try {
-          showLoading("Signing key...")
-          console.log(
-            "[AUTH] Embedded wallet account:",
-            JSON.stringify(embeddedWallet)
-          )
-          await setupWalletIframe(privy)
-          console.log(
-            "[AUTH] Getting provider for wallet:",
-            embeddedWallet.address
-          )
-          // eslint-disable-next-line @typescript-eslint/no-explicit-any -- PrivyLinkedAccount is a subset of the SDK's full type
-          const provider =
-            await privy.embeddedWallet.getProvider(embeddedWallet as any)
-          console.log("[AUTH] Provider obtained:", provider ? "ok" : "null")
-          console.log("[AUTH] Requesting personal_sign...")
-          masterKeySignature = await provider.request({
-            method: "personal_sign",
-            params: [toHexMessage(MASTER_KEY_MESSAGE), walletAddress],
-          })
-          console.log(
-            "[AUTH] Master key signed:",
-            masterKeySignature?.substring(0, 20) + "..."
-          )
-        } catch (err) {
-          console.error("[AUTH] Master key signing failed:", err)
-        }
-      } else {
-        console.warn(
-          "[AUTH] Skipping signing - walletAddress:",
-          walletAddress,
-          "embeddedWallet:",
-          embeddedWallet
-        )
-      }
-
-      const didSend = await sendAuthResult({
-        success: true,
-        user: {
-          id: user.id,
-          email:
-            user.email?.address ??
-            (user.linked_accounts || user.linkedAccounts)?.find(
-              account => account.type === "email"
-            )?.address ??
-            (user.linked_accounts || user.linkedAccounts)?.find(
-              account => account.type === "google_oauth"
-            )?.email ??
-            (user.linked_accounts || user.linkedAccounts)?.find(
-              account => account.type === "apple_oauth"
-            )?.email ??
-            null,
-        },
-        walletAddress,
-        authToken,
-        masterKeySignature,
-      })
-
-      if (!didSend) {
-        showError("Couldn't return to the app. Try again.")
-        return
-      }
-
-      if (walletAddress && embeddedWallet) {
-        try {
-          await registerPersonalServer(privy, walletAddress, embeddedWallet)
-        } catch (err) {
-          console.warn("[AUTH] Server registration failed (non-fatal):", err)
-        }
-      }
-
-      showSuccess()
-    },
-    [
-      registerPersonalServer,
-      sendAuthResult,
-      setupWalletIframe,
-      showError,
-      showLoading,
-      showSuccess,
-    ]
-  )
-
-  const handleOAuthLogin = useCallback(
-    async (provider: "google" | "apple") => {
-      const privy = privyRef.current
-      if (!privy) {
-        showError(LOGIN_ERROR_MESSAGE)
-        return
-      }
-
-      try {
-        if (provider === "google") {
-          setIsGoogleLoading(true)
-        } else {
-          setIsAppleLoading(true)
-        }
-
-        try {
-          await privy.auth.logout()
-        } catch {
-          // ignore logout failures
-        }
-
-        const redirectURI = `${window.location.origin}${window.location.pathname}`
-        const result = await privy.auth.oauth.generateURL(provider, redirectURI)
-        const url =
-          typeof result === "string"
-            ? result
-            : (result as { url?: string }).url ?? String(result)
-        window.location.href = url
-      } catch (err) {
-        console.error(`${provider} login error:`, err)
-        showError(
-          err instanceof Error
-            ? err.message
-            : `${provider === "google" ? "Google" : "Apple"} sign-in failed.`
-        )
-      } finally {
-        if (provider === "google") {
-          setIsGoogleLoading(false)
-        } else {
-          setIsAppleLoading(false)
-        }
-      }
-    },
-    [showError]
-  )
-
-  const handleEmailSubmit = useCallback(async () => {
-    const privy = privyRef.current
-    if (!privy) {
-      showError(LOGIN_ERROR_MESSAGE)
-      return
-    }
-
-    const nextEmail = email.trim()
-    if (!nextEmail) {
-      showError("Enter your email.")
-      return
-    }
-
-    try {
-      setIsSendingEmail(true)
-      setError(null)
-      currentEmailRef.current = nextEmail
-      await privy.auth.email.sendCode(nextEmail)
-      setShowCode(true)
-      setCode("")
-    } catch (err) {
-      console.error("Send code error:", err)
-      showError(err instanceof Error ? err.message : "Couldn't send code.")
-    } finally {
-      setIsSendingEmail(false)
-    }
-  }, [email, showError])
-
-  const handleVerifyCode = useCallback(async () => {
-    const privy = privyRef.current
-    if (!privy) {
-      showError(LOGIN_ERROR_MESSAGE)
-      return
-    }
-
-    const trimmedCode = code.trim()
-    if (!trimmedCode) {
-      showError("Enter the code.")
-      return
-    }
-
-    try {
-      setIsVerifyingCode(true)
-      const session = (await privy.auth.email.loginWithCode(
-        currentEmailRef.current,
-        trimmedCode
-      )) as PrivySession
-      await handleAuthenticatedUser(privy, session.user, session)
-    } catch (err) {
-      console.error("Verify code error:", err)
-      showError(err instanceof Error ? err.message : "Code invalid.")
-    } finally {
-      setIsVerifyingCode(false)
-    }
-  }, [code, handleAuthenticatedUser, showError])
-
-  const handleGoogleLogin = useCallback(async () => {
-    await handleOAuthLogin("google")
-  }, [handleOAuthLogin])
-
-  const handleAppleLogin = useCallback(async () => {
-    await handleOAuthLogin("apple")
-  }, [handleOAuthLogin])
-
-  useEffect(() => {
-    const init = async () => {
-      const configResult = parseAuthConfig()
-      if (!("config" in configResult)) {
-        showLoginForm()
-        showError(configResult.error)
-        return
-      }
-
-      const config = configResult.config
-
-      try {
-        const queryParams = new URLSearchParams(window.location.search)
-        const oauthCode = queryParams.get("privy_oauth_code")
-        const oauthState = queryParams.get("privy_oauth_state")
-
-        if (!oauthCode) {
-          localStorage.clear()
-        }
-
-        const privy = await createPrivyClient(config, !!oauthCode)
-        privyRef.current = privy
-
-        if (!oauthCode) {
-          try {
-            await privy.auth.logout()
-          } catch {
-            // ignore logout failures
-          }
-        }
-
-        if (oauthCode && oauthState) {
-          showLoading("Finishing sign-in...")
-          console.log(
-            "[AUTH] OAuth callback detected, code:",
-            oauthCode.substring(0, 8) + "..."
-          )
-          try {
-            console.log("[AUTH] Calling loginWithCode...")
-            const session = (await privy.auth.oauth.loginWithCode(
-              oauthCode,
-              oauthState
-            )) as PrivySession
-
-            try {
-              console.log("[AUTH] Initializing SDK after login...")
-              await privy.initialize()
-              console.log("[AUTH] SDK initialized successfully")
-            } catch (initErr) {
-              console.warn("[AUTH] Post-login initialize (may be ok):", initErr)
-            }
-
-            await handleAuthenticatedUser(privy, session.user, session)
-            return
-          } catch (err) {
-            console.error("[AUTH] OAuth callback error:", err)
-            showError(
-              err instanceof Error
-                ? err.message
-                : "Failed to complete OAuth sign-in."
-            )
-          }
-        }
-
-        showLoginForm()
-      } catch (err) {
-        console.error("Privy initialization error:", err)
-        showLoginForm()
-        showError(
-          err instanceof Error
-            ? `${LOGIN_ERROR_MESSAGE} ${err.message}`
-            : LOGIN_ERROR_MESSAGE
-        )
-      }
-    }
-
-    init()
-  }, [
-    createPrivyClient,
-    handleAuthenticatedUser,
-    showError,
-    showLoading,
-    showLoginForm,
-  ])
-
-  // Message forwarding is handled by the single handler installed in
-  // setupWalletIframe (via messageHandlerInstalledRef) to avoid race
-  // conditions with React's async effect scheduling.
-
-  return {
-    view,
-    loadingText,
-    error,
-    email,
-    code,
-    showCode,
-    isSendingEmail,
-    isVerifyingCode,
-    isGoogleLoading,
-    isAppleLoading,
-    walletIframeUrl,
-    walletIframeRef,
-    handleWalletIframeLoad,
-    handleEmailChange: setEmail,
-    handleCodeChange: setCode,
-    handleEmailSubmit,
-    handleVerifyCode,
-    handleGoogleLogin,
-    handleAppleLogin,
-  }
-}
diff --git a/src/auth-page/index.html b/src/auth-page/index.html
deleted file mode 100644
index b81ccb8..0000000
--- a/src/auth-page/index.html
+++ /dev/null
@@ -1,18 +0,0 @@
-<!doctype html>
-<html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>Sign in - Vana Passport</title>
-  </head>
-  <body>
-    <div id="root"></div>
-    <script>
-      window.__AUTH_CONFIG__ = {
-        privyAppId: "%PRIVY_APP_ID%",
-        privyClientId: "%PRIVY_CLIENT_ID%",
-      }
-    </script>
-    <script type="module" src="/main.tsx"></script>
-  </body>
-</html>
diff --git a/src/auth-page/main.tsx b/src/auth-page/main.tsx
deleted file mode 100644
index 64249ee..0000000
--- a/src/auth-page/main.tsx
+++ /dev/null
@@ -1,19 +0,0 @@
-import { Buffer } from "buffer"
-;(globalThis as Record<string, unknown>).Buffer = Buffer
-
-import React from "react"
-import { createRoot } from "react-dom/client"
-import { App } from "./App"
-import "./styles.css"
-
-const root = document.getElementById("root")
-
-if (!root) {
-  throw new Error("Missing root element for auth page.")
-}
-
-createRoot(root).render(
-  <React.StrictMode>
-    <App />
-  </React.StrictMode>
-)
diff --git a/src/auth-page/styles.css b/src/auth-page/styles.css
deleted file mode 100644
index faa3039..0000000
--- a/src/auth-page/styles.css
+++ /dev/null
@@ -1 +0,0 @@
-@import "../styles/index.css";
diff --git a/src/auth-page/types.ts b/src/auth-page/types.ts
deleted file mode 100644
index 015c13d..0000000
--- a/src/auth-page/types.ts
+++ /dev/null
@@ -1,26 +0,0 @@
-export type AuthView = "loading" | "login" | "success"
-
-export interface AuthConfig {
-  privyAppId: string
-  privyClientId: string
-}
-
-export interface AuthUser {
-  id: string
-  email?: string | null
-}
-
-export interface AuthResult {
-  success: boolean
-  user?: AuthUser
-  walletAddress?: string | null
-  authToken?: string | null
-  masterKeySignature?: string | null
-  error?: string
-}
-
-declare global {
-  interface Window {
-    __AUTH_CONFIG__?: AuthConfig
-  }
-}
diff --git a/src/components/auth/InlineLogin.tsx b/src/components/auth/InlineLogin.tsx
deleted file mode 100644
index 3ad776b..0000000
--- a/src/components/auth/InlineLogin.tsx
+++ /dev/null
@@ -1,266 +0,0 @@
-import { useCallback, useEffect, useRef, useState } from 'react';
-import { useNavigate } from 'react-router';
-import { useDispatch } from 'react-redux';
-import { invoke } from '@tauri-apps/api/core';
-import { listen } from '@tauri-apps/api/event';
-import { Loader, ExternalLink } from 'lucide-react';
-import { setAuthenticated } from '../../state/store';
-
-const PRIVY_APP_ID = import.meta.env.VITE_PRIVY_APP_ID;
-const PRIVY_CLIENT_ID = import.meta.env.VITE_PRIVY_CLIENT_ID;
-
-interface AuthResult {
-  success: boolean;
-  user?: {
-    id: string;
-    email?: string;
-  };
-  walletAddress?: string;
-  authToken?: string;
-  masterKeySignature?: string;
-  error?: string;
-}
-
-export function InlineLogin() {
-  const navigate = useNavigate();
-  const dispatch = useDispatch();
-  const [isLoading, setIsLoading] = useState(false);
-  const [error, setError] = useState<string | null>(null);
-  const [authStarted, setAuthStarted] = useState(false);
-  const isPrivyConfigured = Boolean(PRIVY_APP_ID && PRIVY_CLIENT_ID);
-
-  // Store unlisten function in ref for synchronous cleanup
-  const unlistenRef = useRef<(() => void) | null>(null);
-
-  // Listen for auth completion
-  useEffect(() => {
-    let isActive = true;
-
-    listen<AuthResult>('auth-complete', (event) => {
-      const result = event.payload;
-
-      if (result.success && result.user) {
-        dispatch(
-          setAuthenticated({
-            user: {
-              id: result.user.id,
-              email: result.user.email,
-            },
-            walletAddress: result.walletAddress || null,
-            masterKeySignature: result.masterKeySignature || null,
-          })
-        );
-        navigate(-1); // Go back to grant flow
-      } else {
-        setError(result.error || 'Authentication failed. Please try again.');
-        setIsLoading(false);
-        setAuthStarted(false);
-      }
-    }).then((fn) => {
-      if (!isActive) {
-        fn();
-        return;
-      }
-      unlistenRef.current = fn;
-    });
-
-    // Synchronous cleanup using ref
-    return () => {
-      isActive = false;
-      unlistenRef.current?.();
-      unlistenRef.current = null;
-    };
-  }, [dispatch, navigate]);
-
-  const handleBrowserAuth = useCallback(async () => {
-    if (!PRIVY_APP_ID || !PRIVY_CLIENT_ID) {
-      setError('Authentication is not configured. Missing VITE_PRIVY_APP_ID or VITE_PRIVY_CLIENT_ID.');
-      return;
-    }
-
-    setError(null);
-    setIsLoading(true);
-    setAuthStarted(true);
-
-    try {
-      await invoke('start_browser_auth', { privyAppId: PRIVY_APP_ID, privyClientId: PRIVY_CLIENT_ID });
-    } catch (err) {
-      console.error('Failed to start browser auth:', err);
-      setError(err instanceof Error ? err.message : 'Failed to open browser for authentication.');
-      setIsLoading(false);
-      setAuthStarted(false);
-    }
-  }, []);
-
-  // Auto-start browser auth on mount
-  const autoStarted = useRef(false);
-  useEffect(() => {
-    if (autoStarted.current || !PRIVY_APP_ID || !PRIVY_CLIENT_ID) return;
-    autoStarted.current = true;
-    handleBrowserAuth();
-  }, [handleBrowserAuth]);
-
-  useEffect(() => {
-    if (isPrivyConfigured) return;
-    setError('Authentication is not configured. Missing VITE_PRIVY_APP_ID or VITE_PRIVY_CLIENT_ID.');
-  }, [isPrivyConfigured]);
-
-  // Waiting for browser auth to complete
-  if (authStarted) {
-    return (
-      <div
-        style={{
-          display: 'flex',
-          flexDirection: 'column',
-          alignItems: 'center',
-          justifyContent: 'center',
-          minHeight: '100vh',
-          padding: '24px',
-          backgroundColor: '#f5f5f7',
-        }}
-      >
-        <div
-          style={{
-            width: '100%',
-            maxWidth: '400px',
-            backgroundColor: 'white',
-            borderRadius: '16px',
-            padding: '40px',
-            boxShadow: '0 4px 24px rgba(0, 0, 0, 0.06)',
-            textAlign: 'center',
-          }}
-        >
-          <Loader
-            style={{
-              width: '48px',
-              height: '48px',
-              color: '#6366f1',
-              animation: 'spin 1s linear infinite',
-              margin: '0 auto 24px',
-            }}
-          />
-          <h1 style={{ fontSize: '20px', fontWeight: 600, color: '#1a1a1a', marginBottom: '12px' }}>
-            Complete sign-in in your browser
-          </h1>
-          <p style={{ fontSize: '14px', color: '#6b7280', marginBottom: '24px' }}>
-            A browser window has opened for you to sign in. Return here once you've completed the sign-in process.
-          </p>
-          <button
-            onClick={() => {
-              setAuthStarted(false);
-              setIsLoading(false);
-            }}
-            style={{
-              padding: '10px 20px',
-              fontSize: '14px',
-              color: '#6b7280',
-              backgroundColor: 'transparent',
-              border: '1px solid #e5e7eb',
-              borderRadius: '8px',
-              cursor: 'pointer',
-            }}
-          >
-            Cancel
-          </button>
-        </div>
-      </div>
-    );
-  }
-
-  return (
-    <div
-      style={{
-        display: 'flex',
-        flexDirection: 'column',
-        alignItems: 'center',
-        justifyContent: 'center',
-        minHeight: '100vh',
-        padding: '24px',
-        backgroundColor: '#f5f5f7',
-      }}
-    >
-      <div
-        style={{
-          width: '100%',
-          maxWidth: '400px',
-          backgroundColor: 'white',
-          borderRadius: '16px',
-          padding: '40px',
-          boxShadow: '0 4px 24px rgba(0, 0, 0, 0.06)',
-        }}
-      >
-        <div style={{ textAlign: 'center', marginBottom: '32px' }}>
-          <h1 style={{ fontSize: '24px', fontWeight: 600, color: '#1a1a1a', marginBottom: '8px' }}>
-            Welcome to Data Connect
-          </h1>
-          <p style={{ fontSize: '14px', color: '#6b7280' }}>Sign in to continue</p>
-        </div>
-
-        {error && (
-          <div
-            style={{
-              padding: '12px',
-              backgroundColor: '#fef2f2',
-              border: '1px solid #fecaca',
-              borderRadius: '8px',
-              marginBottom: '16px',
-              fontSize: '14px',
-              color: '#dc2626',
-            }}
-          >
-            {error}
-          </div>
-        )}
-
-        <button
-          onClick={handleBrowserAuth}
-          disabled={isLoading || !isPrivyConfigured}
-          style={{
-            display: 'flex',
-            alignItems: 'center',
-            justifyContent: 'center',
-            gap: '12px',
-            width: '100%',
-            padding: '14px 16px',
-            fontSize: '15px',
-            fontWeight: 500,
-            color: 'white',
-            backgroundColor: isLoading ? '#9ca3af' : '#6366f1',
-            border: 'none',
-            borderRadius: '10px',
-            cursor: isLoading ? 'not-allowed' : 'pointer',
-            transition: 'all 0.15s ease',
-          }}
-          onMouseEnter={(e) => {
-            if (!isLoading) {
-              e.currentTarget.style.backgroundColor = '#4f46e5';
-            }
-          }}
-          onMouseLeave={(e) => {
-            if (!isLoading) {
-              e.currentTarget.style.backgroundColor = '#6366f1';
-            }
-          }}
-        >
-          {isLoading ? (
-            <Loader style={{ width: '20px', height: '20px', animation: 'spin 1s linear infinite' }} />
-          ) : (
-            <ExternalLink style={{ width: '20px', height: '20px' }} />
-          )}
-          Sign in with Browser
-        </button>
-
-        <p
-          style={{
-            marginTop: '16px',
-            fontSize: '13px',
-            color: '#9ca3af',
-            textAlign: 'center',
-          }}
-        >
-          A browser window will open for secure sign-in with Google or email.
-        </p>
-      </div>
-    </div>
-  );
-}
diff --git a/src/components/providers/PrivyProvider.tsx b/src/components/providers/PrivyProvider.tsx
deleted file mode 100644
index c53856c..0000000
--- a/src/components/providers/PrivyProvider.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import type { ReactNode } from 'react';
-import { PrivyProvider as PrivyAuthProvider } from '@privy-io/react-auth';
-
-interface PrivyProviderProps {
-  children: ReactNode;
-}
-
-const PRIVY_APP_ID = import.meta.env.VITE_PRIVY_APP_ID;
-const PRIVY_CLIENT_ID = import.meta.env.VITE_PRIVY_CLIENT_ID;
-
-export function PrivyProvider({ children }: PrivyProviderProps) {
-  // Privy auth is optional - if not configured, just render children
-  if (!PRIVY_APP_ID) {
-    return <>{children}</>;
-  }
-
-  return (
-    <PrivyAuthProvider
-      appId={PRIVY_APP_ID}
-      clientId={PRIVY_CLIENT_ID}
-      config={{
-        appearance: {
-          theme: 'light',
-          accentColor: '#6366f1',
-        },
-        embeddedWallets: {
-          ethereum: {
-            createOnLogin: 'users-without-wallets',
-          },
-        },
-        loginMethods: ['google', 'email'],
-      }}
-    >
-      {children}
-    </PrivyAuthProvider>
-  );
-}
diff --git a/src/config/routes.ts b/src/config/routes.ts
index 2a5ebcd..d588a9b 100644
--- a/src/config/routes.ts
+++ b/src/config/routes.ts
@@ -7,8 +7,6 @@ export const ROUTES = {
   settings: "/settings",
   connect: "/connect",
   grant: "/grant",
-  login: "/login",
-  browserLogin: "/browser-login",
   rickrollMockRoot: "/rickroll",
   rickrollMockSignIn: "/rickroll/signin",
   // Demo flow (throwaway — for video recording)
diff --git a/src/hooks/use-deep-link.test.tsx b/src/hooks/use-deep-link.test.tsx
index 021d9bb..bf2c08d 100644
--- a/src/hooks/use-deep-link.test.tsx
+++ b/src/hooks/use-deep-link.test.tsx
@@ -9,12 +9,23 @@ import {
 import { ROUTES } from "@/config/routes"
 import { useDeepLink } from "./use-deep-link"
 
+const mockDispatch = vi.fn()
+
 // Mock the Tauri deep-link plugin
 vi.mock("@tauri-apps/plugin-deep-link", () => ({
   getCurrent: vi.fn(),
   onOpenUrl: vi.fn(),
 }))
 
+vi.mock("react-redux", () => ({
+  useDispatch: () => mockDispatch,
+}))
+
+vi.mock("viem", () => ({
+  hashMessage: vi.fn(() => "0xmockhash"),
+  recoverAddress: vi.fn(() => Promise.resolve("0xRecoveredAddress")),
+}))
+
 function DeepLinkHarness({
   onChange,
 }: {
@@ -33,6 +44,7 @@ function DeepLinkHarness({
 describe("useDeepLink", () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    mockDispatch.mockReset()
   })
 
   it("normalizes deep link params into /connect URL", async () => {
@@ -207,6 +219,107 @@ describe("useDeepLink", () => {
     expect(searchParams.get("scopes")).toBe('["chatgpt.conversations"]')
   })
 
+  it("derives wallet address from masterKeySig and dispatches auth", async () => {
+    const deepLink = await import("@tauri-apps/plugin-deep-link")
+    ;(deepLink.getCurrent as Mock).mockResolvedValue([
+      "vana://connect?sessionId=sig-sess&secret=sig-sec&masterKeySig=0xdeadbeef",
+    ])
+    ;(deepLink.onOpenUrl as Mock).mockResolvedValue(() => {})
+
+    let latestPathname = ""
+
+    const router = createMemoryRouter(
+      [
+        {
+          path: "*",
+          element: (
+            <DeepLinkHarness
+              onChange={(pathname) => {
+                latestPathname = pathname
+              }}
+            />
+          ),
+        },
+      ],
+      { initialEntries: [ROUTES.home] }
+    )
+
+    render(<RouterProvider router={router} />)
+
+    await waitFor(() => {
+      expect(latestPathname).toBe(ROUTES.connect)
+    })
+
+    const { recoverAddress } = await import("viem")
+    expect(recoverAddress).toHaveBeenCalledWith({
+      hash: "0xmockhash",
+      signature: "0xdeadbeef",
+    })
+
+    await waitFor(() => {
+      expect(mockDispatch).toHaveBeenCalledWith(
+        expect.objectContaining({
+          payload: expect.objectContaining({
+            walletAddress: "0xRecoveredAddress",
+            masterKeySignature: "0xdeadbeef",
+          }),
+        })
+      )
+    })
+  })
+
+  it("recovers auth from masterKeySig in URL params (fallback path)", async () => {
+    const deepLink = await import("@tauri-apps/plugin-deep-link")
+    ;(deepLink.getCurrent as Mock).mockResolvedValue(null)
+    ;(deepLink.onOpenUrl as Mock).mockResolvedValue(() => {})
+
+    let latestPathname = ""
+
+    const router = createMemoryRouter(
+      [
+        {
+          path: "*",
+          element: (
+            <DeepLinkHarness
+              onChange={(pathname) => {
+                latestPathname = pathname
+              }}
+            />
+          ),
+        },
+      ],
+      {
+        initialEntries: [
+          `${ROUTES.connect}?sessionId=fallback-sess&masterKeySig=0xfallbacksig`,
+        ],
+      }
+    )
+
+    render(<RouterProvider router={router} />)
+
+    // Should stay on /connect (already on target route)
+    await waitFor(() => {
+      expect(latestPathname).toBe(ROUTES.connect)
+    })
+
+    const { recoverAddress } = await import("viem")
+    expect(recoverAddress).toHaveBeenCalledWith({
+      hash: "0xmockhash",
+      signature: "0xfallbacksig",
+    })
+
+    await waitFor(() => {
+      expect(mockDispatch).toHaveBeenCalledWith(
+        expect.objectContaining({
+          payload: expect.objectContaining({
+            walletAddress: "0xRecoveredAddress",
+            masterKeySignature: "0xfallbacksig",
+          }),
+        })
+      )
+    })
+  })
+
   it("ignores invalid deep link URLs from native plugin", async () => {
     const deepLink = await import("@tauri-apps/plugin-deep-link")
     ;(deepLink.getCurrent as Mock).mockResolvedValue([
diff --git a/src/hooks/use-deep-link.ts b/src/hooks/use-deep-link.ts
index fffecd5..d97ec32 100644
--- a/src/hooks/use-deep-link.ts
+++ b/src/hooks/use-deep-link.ts
@@ -1,10 +1,13 @@
 import { useEffect, useRef, useState } from "react"
 import { useLocation, useNavigate } from "react-router-dom"
+import { useDispatch } from "react-redux"
+import { hashMessage, recoverAddress } from "viem"
 import {
   buildGrantSearchParams,
   getGrantParamsFromSearchParams,
   type GrantParams,
 } from "../lib/grant-params"
+import { setAuthenticated } from "../state/store"
 import { ROUTES } from "@/config/routes"
 
 /**
@@ -40,16 +43,39 @@ async function getTauriDeepLink() {
 export function useDeepLink() {
   const navigate = useNavigate()
   const location = useLocation()
+  const dispatch = useDispatch()
   const [deepLinkParams, setDeepLinkParams] = useState<GrantParams | null>(null)
   const [isDeepLink, setIsDeepLink] = useState(false)
   const navigateRef = useRef(navigate)
   navigateRef.current = navigate
+  const dispatchRef = useRef(dispatch)
+  dispatchRef.current = dispatch
 
   // Navigate to the appropriate route based on grant params
   const handleGrantParams = (params: GrantParams) => {
     setDeepLinkParams(params)
     setIsDeepLink(true)
 
+    // Derive wallet address from masterKeySignature and populate auth state
+    if (params.masterKeySignature) {
+      recoverAddress({
+        hash: hashMessage("vana-master-key-v1"),
+        signature: params.masterKeySignature as `0x${string}`,
+      })
+        .then(walletAddress => {
+          dispatchRef.current(
+            setAuthenticated({
+              user: { id: walletAddress },
+              walletAddress,
+              masterKeySignature: params.masterKeySignature,
+            })
+          )
+        })
+        .catch(err => {
+          console.error("[DeepLink] Failed to recover address from masterKeySig:", err)
+        })
+    }
+
     const normalizedSearch = buildGrantSearchParams(params).toString()
     const targetSearch = normalizedSearch ? `?${normalizedSearch}` : ""
     const targetRoute =
@@ -108,6 +134,26 @@ export function useDeepLink() {
       setDeepLinkParams(params)
       setIsDeepLink(true)
 
+      // Derive wallet address from masterKeySignature and populate auth state
+      if (params.masterKeySignature) {
+        recoverAddress({
+          hash: hashMessage("vana-master-key-v1"),
+          signature: params.masterKeySignature as `0x${string}`,
+        })
+          .then(walletAddress => {
+            dispatchRef.current(
+              setAuthenticated({
+                user: { id: walletAddress },
+                walletAddress,
+                masterKeySignature: params.masterKeySignature,
+              })
+            )
+          })
+          .catch(err => {
+            console.error("[DeepLink] Failed to recover address from masterKeySig:", err)
+          })
+      }
+
       const normalizedSearch = buildGrantSearchParams(params).toString()
       const targetSearch = normalizedSearch ? `?${normalizedSearch}` : ""
       const targetRoute =
diff --git a/src/hooks/useAuth.ts b/src/hooks/useAuth.ts
index 8bc34a0..145b7d2 100644
--- a/src/hooks/useAuth.ts
+++ b/src/hooks/useAuth.ts
@@ -1,35 +1,24 @@
-import { useCallback, useEffect } from 'react';
+import { useCallback } from 'react';
 import { useDispatch, useSelector } from 'react-redux';
-import { clearAuth, setAuthLoading } from '../state/store';
+import { clearAuth } from '../state/store';
 import type { RootState } from '../state/store';
 
-const PRIVY_APP_ID = import.meta.env.VITE_PRIVY_APP_ID;
-
 export function useAuth() {
   const dispatch = useDispatch();
   const auth = useSelector((state: RootState) => state.app.auth);
 
-  const privyEnabled = !!PRIVY_APP_ID;
-
-  // Set loading to false on mount since auth is handled externally via browser
-  useEffect(() => {
-    if (auth.isLoading) {
-      dispatch(setAuthLoading(false));
-    }
-  }, [dispatch, auth.isLoading]);
-
   const logout = useCallback(async () => {
     dispatch(clearAuth());
   }, [dispatch]);
 
   return {
-    isAuthenticated: auth.isAuthenticated,
-    isLoading: auth.isLoading,
+    isAuthenticated: Boolean(auth.walletAddress && auth.masterKeySignature),
+    isLoading: false,
     user: auth.user,
     walletAddress: auth.walletAddress,
+    masterKeySignature: auth.masterKeySignature,
     accountRole: auth.accountRole,
     canAccessDebugRuns: auth.accountRole === 'debug',
-    privyEnabled,
     logout,
   };
 }
diff --git a/src/lib/grant-params.ts b/src/lib/grant-params.ts
index b5c4c62..ced9e44 100644
--- a/src/lib/grant-params.ts
+++ b/src/lib/grant-params.ts
@@ -4,6 +4,7 @@ export type GrantParams = {
   appId?: string
   scopes?: string[]
   status?: GrantStatusParam
+  masterKeySignature?: string
 }
 
 export type GrantStatusParam = "success"
@@ -53,6 +54,7 @@ export function getGrantParamsFromSearchParams(
   const scopes = parseScopesParam(searchParams.get("scopes"))
   const status =
     searchParams.get("status") === "success" ? ("success" as const) : undefined
+  const masterKeySignature = searchParams.get("masterKeySig") || undefined
 
   return {
     sessionId,
@@ -60,6 +62,7 @@ export function getGrantParamsFromSearchParams(
     appId,
     scopes,
     status,
+    masterKeySignature,
   }
 }
 
@@ -86,5 +89,9 @@ export function buildGrantSearchParams(params: GrantParams): URLSearchParams {
     searchParams.set("status", params.status)
   }
 
+  if (params.masterKeySignature) {
+    searchParams.set("masterKeySig", params.masterKeySignature)
+  }
+
   return searchParams
 }
diff --git a/src/pages/browser-login/README.md b/src/pages/browser-login/README.md
deleted file mode 100644
index 408b599..0000000
--- a/src/pages/browser-login/README.md
+++ /dev/null
@@ -1,52 +0,0 @@
-## Browser Login page
-
-### What this is
-
-- Authentication page for the embedded browser during connector runs.
-- Supports Google OAuth and email code verification via Privy.
-- Communicates authentication result back to the Tauri app via callback port.
-- For the full rationale and flow tradeoffs, see `docs/_archive/spike-privy-auth-architecture.md`.
-
-### Files
-
-- `index.tsx`: page shell, view-state conditional rendering.
-- `types.ts`: `BrowserLoginState`, `AuthCallbackPayload` interfaces.
-- `utils.ts`: `inputClassName` constant (shared input styles).
-- `use-browser-login.ts`: route-level state, Privy hooks, auth callback effect.
-- `components/browser-login-form.tsx`: main form with Google OAuth and email code flow.
-- `components/invalid-request-view.tsx`: error state when callbackPort is missing.
-- `components/loading-view.tsx`: loading state while Privy initializes.
-- `components/success-view.tsx`: success state after auth is sent.
-- `components/wallet-creating-view.tsx`: loading state during wallet creation.
-
-### Data flow
-
-- `use-browser-login.ts` provides:
-  - `callbackPort` from URL search params.
-  - Privy state: `ready`, `authenticated`, `user`, `wallets`.
-  - Form state: `email`, `code`, `isCodeSent`, `error`, `isCreatingWallet`, `authSent`.
-  - Loading state: derived `isLoading` from OAuth/email/wallet states.
-  - Handlers: `handleGoogleLogin`, `handleSendCode`, `handleLoginWithCode`, `handleResetEmail`.
-- Effect sends auth callback to `localhost:{callbackPort}/auth-callback` on successful login.
-- Automatically creates embedded wallet if user doesn't have one.
-
-### App integration
-
-- Route: `/browser-login` is lazy-loaded in `src/App.tsx`.
-- URL params: `callbackPort` (required) - port for Tauri IPC callback.
-- Dependencies: Privy SDK (`usePrivy`, `useLoginWithOAuth`, `useLoginWithEmail`, `useCreateWallet`, `useWallets`).
-
-### Behavior
-
-1. If `callbackPort` is missing, show invalid request error.
-2. If Privy not ready, show loading spinner.
-3. If authenticated and wallet created, send auth callback and show success.
-4. If creating wallet, show wallet creation loading state.
-5. Otherwise, show login form with Google OAuth and email code options.
-
-### Notes
-
-- Direct imports only (no barrels) per Vercel React rule `bundle-barrel-imports`.
-- Critical for connector flow - authentication enables data extraction.
-- Embedded wallet is required for protocol participation.
-- Error handling shows user-friendly messages for all failure states.
diff --git a/src/pages/browser-login/components/browser-login-form.tsx b/src/pages/browser-login/components/browser-login-form.tsx
deleted file mode 100644
index 0750d2f..0000000
--- a/src/pages/browser-login/components/browser-login-form.tsx
+++ /dev/null
@@ -1,187 +0,0 @@
-import { LoaderIcon } from "lucide-react"
-import { Text } from "@/components/typography/text"
-import { Button } from "@/components/ui/button"
-import { cn } from "@/lib/classes"
-import { inputClassName } from "../utils"
-
-interface BrowserLoginFormProps {
-  email: string
-  setEmail: (email: string) => void
-  code: string
-  setCode: (code: string) => void
-  isCodeSent: boolean
-  error: string | null
-  isLoading: boolean
-  oauthStatus: string
-  emailStatus: string
-  onGoogleLogin: () => void
-  onSendCode: () => void
-  onLoginWithCode: () => void
-  onResetEmail: () => void
-}
-
-export function BrowserLoginForm({
-  email,
-  setEmail,
-  code,
-  setCode,
-  isCodeSent,
-  error,
-  isLoading,
-  oauthStatus,
-  emailStatus,
-  onGoogleLogin,
-  onSendCode,
-  onLoginWithCode,
-  onResetEmail,
-}: BrowserLoginFormProps) {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted px-6 py-10">
-      <div className="w-full max-w-[420px] rounded-card bg-background p-10 shadow-md">
-        <div className="space-y-2 text-center">
-          <Text as="h1" intent="heading" weight="semi">
-            Welcome to Data Connect
-          </Text>
-          <Text as="p" intent="small" color="mutedForeground">
-            Sign in to continue
-          </Text>
-        </div>
-
-        {error && (
-          <div className="mt-6 rounded-button border border-destructive/30 bg-destructive/10 px-4 py-3">
-            <Text as="p" intent="small" color="destructive">
-              {error}
-            </Text>
-          </div>
-        )}
-
-        <div className="mt-8 space-y-6">
-          <Button
-            type="button"
-            variant="outline"
-            fullWidth
-            onClick={onGoogleLogin}
-            disabled={isLoading}
-          >
-            {oauthStatus === "loading" ? (
-              <LoaderIcon
-                aria-hidden="true"
-                className="size-4 animate-spin motion-reduce:animate-none"
-              />
-            ) : (
-              <svg aria-hidden="true" className="size-4" viewBox="0 0 24 24">
-                <path
-                  fill="#4285F4"
-                  d="M22.56 12.25c0-.78-.07-1.53-.2-2.25H12v4.26h5.92c-.26 1.37-1.04 2.53-2.21 3.31v2.77h3.57c2.08-1.92 3.28-4.74 3.28-8.09z"
-                />
-                <path
-                  fill="#34A853"
-                  d="M12 23c2.97 0 5.46-.98 7.28-2.66l-3.57-2.77c-.98.66-2.23 1.06-3.71 1.06-2.86 0-5.29-1.93-6.16-4.53H2.18v2.84C3.99 20.53 7.7 23 12 23z"
-                />
-                <path
-                  fill="#FBBC05"
-                  d="M5.84 14.09c-.22-.66-.35-1.36-.35-2.09s.13-1.43.35-2.09V7.07H2.18C1.43 8.55 1 10.22 1 12s.43 3.45 1.18 4.93l2.85-2.22.81-.62z"
-                />
-                <path
-                  fill="#EA4335"
-                  d="M12 5.38c1.62 0 3.06.56 4.21 1.64l3.15-3.15C17.45 2.09 14.97 1 12 1 7.7 1 3.99 3.47 2.18 7.07l3.66 2.84c.87-2.6 3.3-4.53 6.16-4.53z"
-                />
-              </svg>
-            )}
-            Continue with Google
-          </Button>
-
-          <div className="flex items-center gap-4">
-            <div className="h-px flex-1 bg-border" />
-            <Text as="span" intent="fine" color="mutedForeground">
-              or
-            </Text>
-            <div className="h-px flex-1 bg-border" />
-          </div>
-
-          {!isCodeSent ? (
-            <div className="space-y-gap">
-              <div className="space-y-2">
-                <Text as="label" intent="fine" weight="medium" htmlFor="email">
-                  Email
-                </Text>
-                <input
-                  id="email"
-                  type="email"
-                  value={email}
-                  onChange={event => setEmail(event.target.value)}
-                  placeholder="you@example.com"
-                  className={inputClassName}
-                />
-              </div>
-              <Button
-                type="button"
-                variant="accent"
-                fullWidth
-                onClick={onSendCode}
-                disabled={isLoading || !email}
-              >
-                {emailStatus === "sending-code" ? (
-                  <>
-                    <LoaderIcon
-                      aria-hidden="true"
-                      className="size-4 animate-spin motion-reduce:animate-none"
-                    />
-                    Sending...
-                  </>
-                ) : (
-                  "Send sign-in code"
-                )}
-              </Button>
-            </div>
-          ) : (
-            <div className="space-y-gap">
-              <div className="space-y-2">
-                <Text as="label" intent="fine" weight="medium" htmlFor="code">
-                  Enter the code sent to {email}
-                </Text>
-                <input
-                  id="code"
-                  type="text"
-                  value={code}
-                  onChange={event => setCode(event.target.value)}
-                  placeholder="Enter code"
-                  maxLength={6}
-                  className={cn(inputClassName, "text-center tracking-[0.35em]")}
-                />
-              </div>
-              <Button
-                type="button"
-                variant="accent"
-                fullWidth
-                onClick={onLoginWithCode}
-                disabled={isLoading || !code}
-              >
-                {emailStatus === "submitting-code" ? (
-                  <>
-                    <LoaderIcon
-                      aria-hidden="true"
-                      className="size-4 animate-spin motion-reduce:animate-none"
-                    />
-                    Verifying...
-                  </>
-                ) : (
-                  "Verify code"
-                )}
-              </Button>
-              <Button
-                type="button"
-                variant="ghost"
-                fullWidth
-                onClick={onResetEmail}
-                className="text-muted-foreground"
-              >
-                Use a different email
-              </Button>
-            </div>
-          )}
-        </div>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/browser-login/components/invalid-request-view.tsx b/src/pages/browser-login/components/invalid-request-view.tsx
deleted file mode 100644
index b0cb91f..0000000
--- a/src/pages/browser-login/components/invalid-request-view.tsx
+++ /dev/null
@@ -1,17 +0,0 @@
-import { Text } from "@/components/typography/text"
-
-export function InvalidRequestView() {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted px-6 py-10">
-      <div className="w-full max-w-[420px] rounded-card bg-background p-10 shadow-md">
-        <Text as="h1" intent="heading" weight="semi" className="mb-2">
-          Invalid Request
-        </Text>
-        <Text as="p" intent="small" color="mutedForeground">
-          This page should be opened from the DataConnect app. Please return to the app
-          and try again.
-        </Text>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/browser-login/components/loading-view.tsx b/src/pages/browser-login/components/loading-view.tsx
deleted file mode 100644
index bcc68fe..0000000
--- a/src/pages/browser-login/components/loading-view.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-import { LoaderIcon } from "lucide-react"
-import { Text } from "@/components/typography/text"
-
-export function LoadingView() {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted px-6 py-10">
-      <div className="w-full max-w-[420px] rounded-card bg-background p-10 text-center shadow-md">
-        <LoaderIcon
-          aria-hidden="true"
-          className="mx-auto size-8 animate-spin text-accent motion-reduce:animate-none"
-        />
-        <Text as="p" intent="small" color="mutedForeground" className="mt-4">
-          Initializing...
-        </Text>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/browser-login/components/success-view.tsx b/src/pages/browser-login/components/success-view.tsx
deleted file mode 100644
index 5b3b737..0000000
--- a/src/pages/browser-login/components/success-view.tsx
+++ /dev/null
@@ -1,20 +0,0 @@
-import { CheckCircleIcon } from "lucide-react"
-import { Text } from "@/components/typography/text"
-
-export function SuccessView() {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted px-6 py-10">
-      <div className="w-full max-w-[420px] rounded-card bg-background p-10 text-center shadow-md">
-        <div className="mx-auto mb-4 flex size-16 items-center justify-center rounded-full bg-success/10">
-          <CheckCircleIcon aria-hidden="true" className="size-8 text-success" />
-        </div>
-        <Text as="h1" intent="heading" weight="semi" className="mb-2">
-          You&apos;re signed in!
-        </Text>
-        <Text as="p" intent="small" color="mutedForeground">
-          You can close this window and return to the app.
-        </Text>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/browser-login/components/wallet-creating-view.tsx b/src/pages/browser-login/components/wallet-creating-view.tsx
deleted file mode 100644
index 333da46..0000000
--- a/src/pages/browser-login/components/wallet-creating-view.tsx
+++ /dev/null
@@ -1,18 +0,0 @@
-import { LoaderIcon } from "lucide-react"
-import { Text } from "@/components/typography/text"
-
-export function WalletCreatingView() {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted px-6 py-10">
-      <div className="w-full max-w-[420px] rounded-card bg-background p-10 text-center shadow-md">
-        <LoaderIcon
-          aria-hidden="true"
-          className="mx-auto size-8 animate-spin text-accent motion-reduce:animate-none"
-        />
-        <Text as="p" intent="small" color="mutedForeground" className="mt-4">
-          Setting up your wallet...
-        </Text>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/browser-login/index.test.tsx b/src/pages/browser-login/index.test.tsx
deleted file mode 100644
index ad303b6..0000000
--- a/src/pages/browser-login/index.test.tsx
+++ /dev/null
@@ -1,117 +0,0 @@
-import { describe, expect, it, beforeEach, vi } from "vitest"
-import { render, screen } from "@testing-library/react"
-import { createMemoryRouter, RouterProvider } from "react-router-dom"
-import { ROUTES } from "@/config/routes"
-import { BrowserLogin } from "./index"
-
-const mockUsePrivy = vi.fn()
-const mockUseWallets = vi.fn()
-const mockUseLoginWithOAuth = vi.fn()
-const mockUseLoginWithEmail = vi.fn()
-const mockUseCreateWallet = vi.fn()
-
-vi.mock("react-router", async () => {
-  const actual = await vi.importActual<object>("react-router")
-  return {
-    ...actual,
-    useSearchParams: () => [new URLSearchParams("callbackPort=3456")],
-  }
-})
-
-vi.mock("@privy-io/react-auth", () => ({
-  usePrivy: () => mockUsePrivy(),
-  useWallets: () => mockUseWallets(),
-  useLoginWithOAuth: (opts: { onComplete?: () => void; onError?: () => void }) => {
-    mockUseLoginWithOAuth(opts)
-    return {
-      initOAuth: vi.fn(),
-      state: { status: "initial" },
-    }
-  },
-  useLoginWithEmail: (opts: { onComplete?: () => void; onError?: () => void }) => {
-    mockUseLoginWithEmail(opts)
-    return {
-      sendCode: vi.fn(),
-      loginWithCode: vi.fn(),
-      state: { status: "initial" },
-    }
-  },
-  useCreateWallet: (opts: { onSuccess?: () => void; onError?: () => void }) => {
-    mockUseCreateWallet(opts)
-    return {
-      createWallet: vi.fn(),
-    }
-  },
-}))
-
-const renderBrowserLogin = () => {
-  const router = createMemoryRouter(
-    [{ path: ROUTES.browserLogin, element: <BrowserLogin /> }],
-    {
-      initialEntries: [`${ROUTES.browserLogin}?callbackPort=3456`],
-    }
-  )
-
-  return render(<RouterProvider router={router} />)
-}
-
-beforeEach(() => {
-  vi.clearAllMocks()
-  mockUsePrivy.mockReturnValue({
-    authenticated: false,
-    user: null,
-    ready: true,
-  })
-  mockUseWallets.mockReturnValue({
-    wallets: [],
-  })
-})
-
-describe("BrowserLogin", () => {
-  it("shows loading state when Privy is not ready", () => {
-    mockUsePrivy.mockReturnValue({
-      authenticated: false,
-      user: null,
-      ready: false,
-    })
-
-    renderBrowserLogin()
-
-    expect(screen.getByText("Initializing...")).toBeTruthy()
-  })
-
-  it("shows login form when Privy is ready and not authenticated", () => {
-    renderBrowserLogin()
-
-    expect(screen.getByText("Welcome to Data Connect")).toBeTruthy()
-    expect(screen.getByRole("button", { name: /Continue with Google/i })).toBeTruthy()
-  })
-
-  it("shows email input field for email login", () => {
-    renderBrowserLogin()
-
-    // Use getAllBy since StrictMode may render multiple elements
-    const emailInputs = screen.getAllByPlaceholderText("you@example.com")
-    expect(emailInputs.length).toBeGreaterThanOrEqual(1)
-    emailInputs.forEach(input => {
-      expect((input as HTMLInputElement).type).toBe("email")
-    })
-  })
-
-  it("renders successfully when authenticated", () => {
-    mockUsePrivy.mockReturnValue({
-      authenticated: true,
-      user: {
-        id: "user-123",
-        email: { address: "test@example.com" },
-        linkedAccounts: [],
-      },
-      ready: true,
-    })
-
-    const { container } = renderBrowserLogin()
-
-    // Component should render without crashing
-    expect(container.textContent).toBeTruthy()
-  })
-})
diff --git a/src/pages/browser-login/index.tsx b/src/pages/browser-login/index.tsx
deleted file mode 100644
index b4c894d..0000000
--- a/src/pages/browser-login/index.tsx
+++ /dev/null
@@ -1,63 +0,0 @@
-import { useBrowserLogin } from "./use-browser-login"
-import { InvalidRequestView } from "./components/invalid-request-view"
-import { LoadingView } from "./components/loading-view"
-import { SuccessView } from "./components/success-view"
-import { WalletCreatingView } from "./components/wallet-creating-view"
-import { BrowserLoginForm } from "./components/browser-login-form"
-
-export function BrowserLogin() {
-  const {
-    callbackPort,
-    ready,
-    authenticated,
-    email,
-    setEmail,
-    code,
-    setCode,
-    isCodeSent,
-    error,
-    isCreatingWallet,
-    authSent,
-    isLoading,
-    oauthState,
-    emailState,
-    handleGoogleLogin,
-    handleSendCode,
-    handleLoginWithCode,
-    handleResetEmail,
-  } = useBrowserLogin()
-
-  if (!callbackPort) {
-    return <InvalidRequestView />
-  }
-
-  if (!ready) {
-    return <LoadingView />
-  }
-
-  if (authSent) {
-    return <SuccessView />
-  }
-
-  if (authenticated && isCreatingWallet) {
-    return <WalletCreatingView />
-  }
-
-  return (
-    <BrowserLoginForm
-      email={email}
-      setEmail={setEmail}
-      code={code}
-      setCode={setCode}
-      isCodeSent={isCodeSent}
-      error={error}
-      isLoading={isLoading}
-      oauthStatus={oauthState.status}
-      emailStatus={emailState.status}
-      onGoogleLogin={handleGoogleLogin}
-      onSendCode={handleSendCode}
-      onLoginWithCode={handleLoginWithCode}
-      onResetEmail={handleResetEmail}
-    />
-  )
-}
diff --git a/src/pages/browser-login/types.ts b/src/pages/browser-login/types.ts
deleted file mode 100644
index e752c7b..0000000
--- a/src/pages/browser-login/types.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-export interface BrowserLoginState {
-  email: string
-  code: string
-  isCodeSent: boolean
-  error: string | null
-  isCreatingWallet: boolean
-  authSent: boolean
-}
-
-export interface AuthCallbackPayload {
-  success: boolean
-  user: {
-    id: string
-    email: string | null
-  }
-  walletAddress: string | null
-}
diff --git a/src/pages/browser-login/use-browser-login.ts b/src/pages/browser-login/use-browser-login.ts
deleted file mode 100644
index ea5f074..0000000
--- a/src/pages/browser-login/use-browser-login.ts
+++ /dev/null
@@ -1,183 +0,0 @@
-import { useCallback, useEffect, useState } from "react"
-import { useSearchParams } from "react-router"
-import {
-  usePrivy,
-  useLoginWithOAuth,
-  useLoginWithEmail,
-  useCreateWallet,
-  useWallets,
-} from "@privy-io/react-auth"
-import type { User } from "@privy-io/react-auth"
-
-export function useBrowserLogin() {
-  const [searchParams] = useSearchParams()
-  const callbackPort = searchParams.get("callbackPort")
-
-  const { authenticated, user, ready } = usePrivy()
-  const { wallets } = useWallets()
-
-  const [email, setEmail] = useState("")
-  const [code, setCode] = useState("")
-  const [isCodeSent, setIsCodeSent] = useState(false)
-  const [error, setError] = useState<string | null>(null)
-  const [isCreatingWallet, setIsCreatingWallet] = useState(false)
-  const [authSent, setAuthSent] = useState(false)
-
-  const { createWallet } = useCreateWallet({
-    onSuccess: () => {
-      setIsCreatingWallet(false)
-    },
-    onError: err => {
-      console.error("Wallet creation error:", err)
-      setIsCreatingWallet(false)
-    },
-  })
-
-  const ensureEmbeddedWallet = useCallback(
-    async (privyUser: User) => {
-      const hasEmbeddedWallet = privyUser.linkedAccounts?.some(
-        account => account.type === "wallet" && account.walletClientType === "privy"
-      )
-
-      if (!hasEmbeddedWallet) {
-        setIsCreatingWallet(true)
-        try {
-          await createWallet()
-        } catch (err) {
-          console.error("Failed to create embedded wallet:", err)
-          setIsCreatingWallet(false)
-        }
-      }
-    },
-    [createWallet]
-  )
-
-  const { initOAuth, state: oauthState } = useLoginWithOAuth({
-    onComplete: async ({ user: privyUser }) => {
-      setError(null)
-      await ensureEmbeddedWallet(privyUser)
-    },
-    onError: err => {
-      console.error("OAuth Error:", err)
-      setError(err || "Login with Google failed.")
-    },
-  })
-
-  const {
-    sendCode,
-    loginWithCode,
-    state: emailState,
-  } = useLoginWithEmail({
-    onComplete: async ({ user: privyUser }) => {
-      setError(null)
-      await ensureEmbeddedWallet(privyUser)
-    },
-    onError: err => {
-      console.error("Email Error:", err)
-      setError(err || "Failed to send/verify code.")
-    },
-  })
-
-  useEffect(() => {
-    if (authenticated && user && callbackPort && !authSent && !isCreatingWallet) {
-      const embeddedWallet = wallets.find(w => w.walletClientType === "privy")
-      const linkedWallet = user.linkedAccounts?.find(
-        account => account.type === "wallet" && account.walletClientType === "privy"
-      )
-
-      const walletAddress =
-        (linkedWallet && "address" in linkedWallet ? linkedWallet.address : null) ||
-        embeddedWallet?.address ||
-        null
-
-      if (!walletAddress && user.linkedAccounts?.length === 0) {
-        return
-      }
-
-      const sendAuthResult = async () => {
-        try {
-          await fetch(`http://localhost:${callbackPort}/auth-callback`, {
-            method: "POST",
-            headers: { "Content-Type": "application/json" },
-            body: JSON.stringify({
-              success: true,
-              user: {
-                id: user.id,
-                email: user.email?.address || null,
-              },
-              walletAddress,
-            }),
-          })
-          setAuthSent(true)
-        } catch (err) {
-          console.error("Failed to send auth result:", err)
-          setError("Failed to communicate with app. Please try again.")
-        }
-      }
-
-      sendAuthResult()
-    }
-  }, [authenticated, user, wallets, callbackPort, authSent, isCreatingWallet])
-
-  const handleGoogleLogin = useCallback(() => {
-    setError(null)
-    initOAuth({ provider: "google" })
-  }, [initOAuth])
-
-  const handleSendCode = useCallback(async () => {
-    setError(null)
-    try {
-      await sendCode({ email })
-      setIsCodeSent(true)
-    } catch {
-      // Error handled by onError callback
-    }
-  }, [email, sendCode])
-
-  const handleLoginWithCode = useCallback(async () => {
-    setError(null)
-    try {
-      await loginWithCode({ code })
-    } catch {
-      // Error handled by onError callback
-    }
-  }, [code, loginWithCode])
-
-  const handleResetEmail = useCallback(() => {
-    setIsCodeSent(false)
-    setCode("")
-    setError(null)
-  }, [])
-
-  const isLoading =
-    oauthState.status === "loading" ||
-    emailState.status === "sending-code" ||
-    emailState.status === "submitting-code" ||
-    isCreatingWallet
-
-  return {
-    // URL params
-    callbackPort,
-    // Privy state
-    ready,
-    authenticated,
-    // Form state
-    email,
-    setEmail,
-    code,
-    setCode,
-    isCodeSent,
-    error,
-    isCreatingWallet,
-    authSent,
-    // Loading states
-    isLoading,
-    oauthState,
-    emailState,
-    // Handlers
-    handleGoogleLogin,
-    handleSendCode,
-    handleLoginWithCode,
-    handleResetEmail,
-  }
-}
diff --git a/src/pages/browser-login/utils.ts b/src/pages/browser-login/utils.ts
deleted file mode 100644
index f928d5e..0000000
--- a/src/pages/browser-login/utils.ts
+++ /dev/null
@@ -1,13 +0,0 @@
-import { cn } from "@/lib/classes"
-
-export const inputClassName = cn(
-  // layout
-  "w-full rounded-button border border-input bg-background px-3 py-2",
-  // typography
-  "text-body text-foreground placeholder:text-muted-foreground",
-  // focus
-  "outline-none focus-visible:border-ring focus-visible:ring-[3px] focus-visible:ring-ring/50",
-  "focus-visible:ring-offset-2 focus-visible:ring-offset-background",
-  // disabled
-  "disabled:cursor-not-allowed disabled:opacity-50"
-)
diff --git a/src/pages/grant/README.md b/src/pages/grant/README.md
index a28aea8..b0aff76 100644
--- a/src/pages/grant/README.md
+++ b/src/pages/grant/README.md
@@ -28,9 +28,8 @@ Behavior:
 1. `/connect` runs the connector and routes to `/grant` with `sessionId`, `appId`, `scopes`.
 2. `/grant` loads session data in `useGrantFlow` and moves to `consent`.
 3. Clicking **Allow**:
-   - If unauthenticated, `useGrantFlow.handleApprove` sets status `auth-required` and triggers `start_browser_auth`.
-   - External auth page opens in a new tab.
-   - On `auth-complete`, the flow resumes and approval continues.
+   - Auth must already be populated from the deep link (`masterKeySig` param).
+   - If not authenticated, an error is shown directing the user to account.vana.org.
 4. Clicking **Cancel** returns to **Data Apps** (`/apps`).
 5. Deep-link success: `/grant?...&status=success` renders the Step 4 success UI.
 
@@ -40,13 +39,6 @@ Data-source label:
 - Fallback: "data source" / "data"
 - Shared helpers live in `src/lib/scope-labels.ts` and are used by `/connect` and `/grant`.
 
-Dev flow visibility:
-
-- **Tauri dev:** `start_browser_auth` serves `src-tauri/auth-page` and opens the browser.
-- **Web dev (mock-only):** the auth page does not auto-open. Click "Open Sign-In Page" or
-  open `http://localhost:5175` manually.
-  - Run `npm run auth:dev` to start the auth page dev server.
-
 ## Mocking the Grant URL
 
 Use these in the browser when testing the grant flow directly:
@@ -58,19 +50,6 @@ Use these in the browser when testing the grant flow directly:
 - Step 4 success:
   `http://localhost:5173/grant?sessionId=grant-session-123&appId=rickroll&scopes=%5B%22read:chatgpt-conversations%22%5D&status=success`
 
-When you click **Allow** in the browser, open the auth page dev server at
-`http://localhost:5175`. Run this first:
-
-```
-npm run auth:dev
-```
-
-Run the app in another tab:
-
-```
-npm run dev:app
-```
-
 If generating in code, do not encode the full query string:
 
 ```ts
diff --git a/src/pages/grant/components/grant-auth-required-state.tsx b/src/pages/grant/components/grant-auth-required-state.tsx
deleted file mode 100644
index a267e8b..0000000
--- a/src/pages/grant/components/grant-auth-required-state.tsx
+++ /dev/null
@@ -1,86 +0,0 @@
-import { LoaderIcon } from "lucide-react"
-import { Text } from "@/components/typography/text"
-import { Button } from "@/components/ui/button"
-import { openExternalUrl } from "@/lib/open-resource"
-
-interface GrantAuthRequiredStateProps {
-  appName?: string
-  authUrl: string | null
-  authError: string | null
-  onRetryAuth: () => void
-  onDeny?: () => void
-}
-
-export function GrantAuthRequiredState({
-  appName,
-  authUrl,
-  authError,
-  onRetryAuth,
-  onDeny,
-}: GrantAuthRequiredStateProps) {
-  return (
-    <div className="grid min-h-screen place-items-center bg-muted p-6">
-      <div className="w-full max-w-[440px] rounded-card bg-background p-10 shadow-md">
-        <div className="flex flex-col items-center space-y-6 text-center">
-          <LoaderIcon
-            aria-hidden="true"
-            className="size-12 animate-spin text-accent motion-reduce:animate-none"
-          />
-          <div className="space-y-3">
-            <Text as="h1" intent="heading">
-              Sign In to Continue
-            </Text>
-            <Text as="p" intent="body" color="mutedForeground">
-              Open the sign-in page in your browser to grant{" "}
-              <strong>{appName || "this app"}</strong> access to your data.
-            </Text>
-          </div>
-          {authError && (
-            <Text as="p" intent="small" color="destructive">
-              {authError}
-            </Text>
-          )}
-          {authUrl ? (
-            <div className="w-full space-y-3">
-              <Button
-                type="button"
-                onClick={() => openExternalUrl(authUrl)}
-                fullWidth
-                className="hover:bg-foreground/90"
-              >
-                Open Sign-In Page
-              </Button>
-              <Text
-                as="div"
-                intent="fine"
-                color="mutedForeground"
-                mono
-                className="break-all"
-              >
-                {authUrl}
-              </Text>
-            </div>
-          ) : (
-            <Button
-              type="button"
-              onClick={onRetryAuth}
-              variant="outline"
-              fullWidth
-              className="border-border hover:bg-muted"
-            >
-              Try Opening Sign-In Again
-            </Button>
-          )}
-          <Button
-            type="button"
-            variant="outline"
-            className="border-border bg-transparent px-5 py-2.5 hover:bg-muted"
-            onClick={onDeny}
-          >
-            Cancel
-          </Button>
-        </div>
-      </div>
-    </div>
-  )
-}
diff --git a/src/pages/grant/components/grant-debug-panel.tsx b/src/pages/grant/components/grant-debug-panel.tsx
index c7e8fff..f9d2d2c 100644
--- a/src/pages/grant/components/grant-debug-panel.tsx
+++ b/src/pages/grant/components/grant-debug-panel.tsx
@@ -7,7 +7,6 @@ const DEBUG_STATUSES: GrantFlowState["status"][] = [
   "claiming",
   "verifying-builder",
   "consent",
-  "auth-required",
   "preparing-server",
   "creating-grant",
   "approving",
diff --git a/src/pages/grant/index.tsx b/src/pages/grant/index.tsx
index c3ff4de..38a77e9 100644
--- a/src/pages/grant/index.tsx
+++ b/src/pages/grant/index.tsx
@@ -5,7 +5,6 @@ import { useBrowserStatus } from "./use-browser-status"
 import { useGrantFlow } from "./use-grant-flow"
 import { BrowserSetupSection } from "./components/browser-setup-section"
 import { GrantLoadingState } from "./components/grant-loading-state"
-import { GrantAuthRequiredState } from "./components/grant-auth-required-state"
 import { GrantErrorState } from "./components/grant-error-state"
 import { GrantSuccessState } from "./components/grant-success-state"
 import { GrantConsentState } from "./components/consent/grant-consent-state"
@@ -47,9 +46,6 @@ export function Grant() {
   const {
     flowState,
     isApproving,
-    authUrl,
-    authError,
-    startBrowserAuth,
     handleApprove,
     handleDeny,
     handleRetry,
@@ -77,11 +73,6 @@ export function Grant() {
     ? activeDebugStatus === "creating-grant" ||
       activeDebugStatus === "approving"
     : isApproving
-  const resolvedAuthUrl =
-    isDebugging && activeDebugStatus === "auth-required"
-      ? "https://passport.vana.org"
-      : authUrl
-  const resolvedAuthError = isDebugging ? null : authError
   const resolvedBuilderName = isDebugging
     ? debugSession.appName
     : builderName
@@ -116,16 +107,6 @@ export function Grant() {
       ? "Preparing secure connection…"
       : undefined
     content = <GrantLoadingState message={loadingMessage} />
-  } else if (resolvedFlowState.status === "auth-required") {
-    content = (
-      <GrantAuthRequiredState
-        appName={resolvedBuilderName}
-        authUrl={resolvedAuthUrl}
-        authError={resolvedAuthError}
-        onRetryAuth={startBrowserAuth}
-        onDeny={handleDeny}
-      />
-    )
   } else if (resolvedFlowState.status === "error") {
     content = (
       <GrantErrorState
diff --git a/src/pages/grant/types.ts b/src/pages/grant/types.ts
index 19de3a1..1ab727a 100644
--- a/src/pages/grant/types.ts
+++ b/src/pages/grant/types.ts
@@ -31,7 +31,6 @@ export interface GrantFlowState {
     | "claiming"
     | "verifying-builder"
     | "consent"
-    | "auth-required"
     | "preparing-server"
     | "creating-grant"
     | "approving"
diff --git a/src/pages/grant/use-grant-flow.test.tsx b/src/pages/grant/use-grant-flow.test.tsx
index d361c9e..f725cb6 100644
--- a/src/pages/grant/use-grant-flow.test.tsx
+++ b/src/pages/grant/use-grant-flow.test.tsx
@@ -1,6 +1,5 @@
 import { beforeEach, describe, expect, it, vi } from "vitest"
 import { act, renderHook, waitFor } from "@testing-library/react"
-import { invoke } from "@tauri-apps/api/core"
 import { useGrantFlow } from "./use-grant-flow"
 
 const mockNavigate = vi.fn()
@@ -30,24 +29,6 @@ let personalServerState = {
   restartingRef: { current: false },
 }
 
-let authCompleteHandler: ((event: { payload: any }) => void) | null = null
-const tauriWindow = window as Window & { __TAURI__?: unknown; __TAURI_INTERNALS__?: unknown }
-
-vi.mock("@tauri-apps/api/core", () => ({
-  invoke: vi.fn(),
-}))
-
-vi.mock("@tauri-apps/api/event", () => ({
-  listen: vi.fn(
-    (eventName: string, handler: (event: { payload: any }) => void) => {
-      if (eventName === "auth-complete") {
-        authCompleteHandler = handler
-      }
-      return Promise.resolve(() => {})
-    }
-  ),
-}))
-
 vi.mock("react-redux", () => ({
   useDispatch: () => vi.fn(),
 }))
@@ -105,9 +86,6 @@ beforeEach(() => {
   mockCreateGrant.mockReset()
   mockFetchServerIdentity.mockReset()
   mockFetchServerIdentity.mockResolvedValue({ address: "0xserver", publicKey: "pk", serverId: null })
-  authCompleteHandler = null
-  delete tauriWindow.__TAURI__
-  delete tauriWindow.__TAURI_INTERNALS__
   authState = {
     isAuthenticated: false,
     isLoading: false,
@@ -148,12 +126,8 @@ describe("useGrantFlow", () => {
     expect(result.current.builderName).toBe("Demo App")
   })
 
-  it("starts auth only after approval and auto-approves on auth completion", async () => {
-    tauriWindow.__TAURI_INTERNALS__ = {}
-    const mockedInvoke = vi.mocked(invoke)
-    mockedInvoke.mockResolvedValue("https://auth.vana.test")
-
-    const { result, rerender } = renderHook(() =>
+  it("shows error when unauthenticated user tries to approve", async () => {
+    const { result } = renderHook(() =>
       useGrantFlow({
         sessionId: "grant-session-456",
       })
@@ -163,43 +137,18 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // Click Allow while not authenticated → should go to auth-required
+    // Click Allow while not authenticated → should show error
     await act(async () => {
       await result.current.handleApprove()
     })
 
     await waitFor(() => {
-      expect(result.current.flowState.status).toBe("auth-required")
-    })
-    expect(mockedInvoke).toHaveBeenCalledWith("start_browser_auth", {
-      privyAppId: expect.any(String),
-      privyClientId: expect.any(String),
-    })
-
-    // Simulate auth completion
-    await act(async () => {
-      authState = {
-        isAuthenticated: true,
-        isLoading: false,
-        walletAddress: "0xabc",
-      }
-      authCompleteHandler?.({
-        payload: {
-          success: true,
-          user: { id: "user-1", email: "test@vana.org" },
-          walletAddress: "0xabc",
-        },
-      })
-      rerender()
-    })
-
-    // Demo sessions skip grant creation → go straight to success
-    await waitFor(() => {
-      expect(result.current.flowState.status).toBe("success")
+      expect(result.current.flowState.status).toBe("error")
     })
+    expect(result.current.flowState.error).toContain("Not signed in")
   })
 
-  it("waits for Personal Server port and tunnel before auto-approving after auth", async () => {
+  it("waits for Personal Server port and tunnel before auto-approving", async () => {
     // Start with server still starting (port and tunnel null)
     personalServerState = {
       ...personalServerState,
@@ -209,9 +158,12 @@ describe("useGrantFlow", () => {
       devToken: "test-dev-token",
     }
 
-    tauriWindow.__TAURI_INTERNALS__ = {}
-    const mockedInvoke = vi.mocked(invoke)
-    mockedInvoke.mockResolvedValue("https://auth.vana.test")
+    // Auth is already populated (from deep link)
+    authState = {
+      isAuthenticated: true,
+      isLoading: false,
+      walletAddress: "0xuser",
+    }
 
     // Use pre-fetched data for a real (non-demo) session to skip claim+verify
     const prefetched = {
@@ -241,36 +193,13 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // Click Allow while not authenticated → auth-required
+    // Click Allow — server port still null, should defer
     await act(async () => {
       await result.current.handleApprove()
     })
 
-    await waitFor(() => {
-      expect(result.current.flowState.status).toBe("auth-required")
-    })
-
-    // Simulate auth completion (server port still null)
-    await act(async () => {
-      authState = {
-        isAuthenticated: true,
-        isLoading: false,
-        walletAddress: "0xuser",
-      }
-      authCompleteHandler?.({
-        payload: {
-          success: true,
-          user: { id: "user-1", email: "test@vana.org" },
-          walletAddress: "0xuser",
-        },
-      })
-      rerender()
-    })
-
     // Auto-approve should NOT have fired — server port is still null
     expect(mockCreateGrant).not.toHaveBeenCalled()
-    // Status should transition to preparing-server (not stay on auth-required)
-    expect(result.current.flowState.status).toBe("preparing-server")
 
     // Simulate server port becoming ready (but tunnel still null)
     await act(async () => {
@@ -285,7 +214,6 @@ describe("useGrantFlow", () => {
 
     // Auto-approve should still NOT have fired — tunnel is not ready
     expect(mockCreateGrant).not.toHaveBeenCalled()
-    expect(result.current.flowState.status).toBe("preparing-server")
 
     // Simulate tunnel becoming ready
     await act(async () => {
@@ -428,8 +356,6 @@ describe("useGrantFlow", () => {
   })
 
   it("skips claim + verify when pre-fetched data is provided", async () => {
-    // When the connect page pre-fetched session + builder data in the background,
-    // the grant flow should skip straight to consent without calling claim/verify.
     const prefetched = {
       session: {
         id: "prefetch-session-1",
@@ -458,18 +384,14 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // Claim and verify should NOT have been called — data was pre-fetched
     expect(mockClaimSession).not.toHaveBeenCalled()
     expect(mockVerifyBuilder).not.toHaveBeenCalled()
-
-    // Pre-fetched data should be in state
     expect(result.current.flowState.session?.granteeAddress).toBe("0xprefetchbuilder")
     expect(result.current.builderName).toBe("Pre-fetched Builder")
   })
 
   it("handles deny flow — calls deny API and navigates to apps", async () => {
     mockClaimSession.mockResolvedValue({
-      sessionId: "deny-session-1",
       granteeAddress: "0xbuilder",
       scopes: ["chatgpt.conversations"],
       expiresAt: "2030-01-01T00:00:00.000Z",
@@ -538,7 +460,6 @@ describe("useGrantFlow", () => {
       })
     )
 
-    // Per protocol spec: "MUST NOT render the consent screen and MUST fail the session flow"
     await waitFor(() => {
       expect(result.current.flowState.status).toBe("error")
     })
@@ -620,7 +541,6 @@ describe("useGrantFlow", () => {
       await result.current.handleDeny()
     })
 
-    // Should still navigate away despite deny call failure
     expect(mockNavigate).toHaveBeenCalledWith("/apps")
   })
 
@@ -631,7 +551,6 @@ describe("useGrantFlow", () => {
       walletAddress: "0xuser",
     }
 
-    // Use pre-fetched data to bypass the initial claim (which would error on missing secret)
     const prefetched = {
       session: {
         id: "no-secret-session",
@@ -670,51 +589,7 @@ describe("useGrantFlow", () => {
     expect(result.current.flowState.error).toContain("secret is missing")
   })
 
-  it("calls denySession when canceling from auth-required state", async () => {
-    mockClaimSession.mockResolvedValue({
-      granteeAddress: "0xbuilder",
-      scopes: ["chatgpt.conversations"],
-      expiresAt: "2030-01-01T00:00:00.000Z",
-    })
-    mockVerifyBuilder.mockResolvedValue({
-      name: "Test Builder",
-      appUrl: "https://test.example.com",
-    })
-
-    const { result } = renderHook(() =>
-      useGrantFlow({
-        sessionId: "auth-cancel-1",
-        secret: "auth-cancel-secret",
-      })
-    )
-
-    await waitFor(() => {
-      expect(result.current.flowState.status).toBe("consent")
-    })
-
-    // Click Allow while not authenticated → transitions to auth-required
-    await act(async () => {
-      await result.current.handleApprove()
-    })
-
-    await waitFor(() => {
-      expect(result.current.flowState.status).toBe("auth-required")
-    })
-
-    // Cancel from auth-required — should call denySession and navigate away
-    await act(async () => {
-      await result.current.handleDeny()
-    })
-
-    expect(mockDenySession).toHaveBeenCalledWith("auth-cancel-1", {
-      secret: "auth-cancel-secret",
-      reason: "User declined",
-    })
-    expect(mockNavigate).toHaveBeenCalledWith("/apps")
-  })
-
   it("retries the flow from error state via handleRetry", async () => {
-    // First call fails, second call succeeds
     mockClaimSession
       .mockRejectedValueOnce(new Error("Network timeout"))
       .mockResolvedValueOnce({
@@ -734,12 +609,10 @@ describe("useGrantFlow", () => {
       })
     )
 
-    // First attempt should fail
     await waitFor(() => {
       expect(result.current.flowState.status).toBe("error")
     })
 
-    // Retry should re-run the flow
     await act(async () => {
       result.current.handleRetry()
     })
@@ -759,13 +632,12 @@ describe("useGrantFlow", () => {
       walletAddress: "0xuser",
     }
 
-    // Session with an already-expired expiresAt
     const prefetched = {
       session: {
         id: "expired-session-1",
         granteeAddress: "0xbuilder",
         scopes: ["chatgpt.conversations"],
-        expiresAt: "2020-01-01T00:00:00.000Z", // in the past
+        expiresAt: "2020-01-01T00:00:00.000Z",
       },
       builderManifest: {
         name: "Test Builder",
@@ -795,7 +667,6 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("error")
     })
     expect(result.current.flowState.error).toContain("expired")
-    // Grant creation should not have been attempted
     expect(mockCreateGrant).not.toHaveBeenCalled()
   })
 
@@ -834,8 +705,6 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // handleApprove defers when port is null; the auto-approve effect
-    // then surfaces the error because personalServer.status is "error"
     await act(async () => {
       await result.current.handleApprove()
     })
@@ -849,8 +718,6 @@ describe("useGrantFlow", () => {
   })
 
   it("waits during Phase 2 restart even if tunnelFailed is stale from Phase 1", async () => {
-    // Phase 1 tunnel failed, but server is restarting for Phase 2.
-    // The auto-approve effect should wait (not error) because restartingRef is true.
     authState = {
       isAuthenticated: true,
       isLoading: false,
@@ -892,15 +759,12 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // handleApprove defers because port+tunnel are null
     await act(async () => {
       await result.current.handleApprove()
     })
 
-    // Should NOT show tunnel error — restartingRef guards against stale tunnelFailed
     expect(result.current.flowState.status).not.toBe("error")
 
-    // Simulate Phase 2 restart completing: server ready, tunnel connected
     await act(async () => {
       personalServerState = {
         ...personalServerState,
@@ -913,14 +777,13 @@ describe("useGrantFlow", () => {
       rerender()
     })
 
-    // Now auto-approve should proceed
     await waitFor(() => {
       expect(result.current.flowState.status).toBe("success")
     })
     expect(mockCreateGrant).toHaveBeenCalled()
   })
 
-  it("shows error after 90s tunnel timeout, not on tunnelFailed alone", async () => {
+  it("shows error after 90s tunnel timeout", async () => {
     vi.useFakeTimers({ shouldAdvanceTime: true })
 
     authState = {
@@ -964,22 +827,17 @@ describe("useGrantFlow", () => {
       expect(result.current.flowState.status).toBe("consent")
     })
 
-    // handleApprove defers because tunnelUrl is null
     await act(async () => {
       await result.current.handleApprove()
     })
 
-    // tunnelFailed is true but the effect should NOT immediately error —
-    // it keeps waiting in "preparing-server" for a late tunnel-success event.
     expect(result.current.flowState.status).toBe("preparing-server")
     expect(mockCreateGrant).not.toHaveBeenCalled()
 
-    // Advance past the 90s timeout
     await act(async () => {
       vi.advanceTimersByTime(91_000)
     })
 
-    // NOW the error should surface
     await waitFor(() => {
       expect(result.current.flowState.status).toBe("error")
     })
diff --git a/src/pages/grant/use-grant-flow.ts b/src/pages/grant/use-grant-flow.ts
index 6584eb7..6167d76 100644
--- a/src/pages/grant/use-grant-flow.ts
+++ b/src/pages/grant/use-grant-flow.ts
@@ -1,10 +1,8 @@
 import { useCallback, useEffect, useRef, useState } from "react"
 import { useNavigate } from "react-router-dom"
-import { invoke } from "@tauri-apps/api/core"
-import { listen } from "@tauri-apps/api/event"
 import { useDispatch } from "react-redux"
 import { useAuth } from "../../hooks/useAuth"
-import { setAuthenticated, addConnectedApp } from "../../state/store"
+import { addConnectedApp } from "../../state/store"
 import {
   claimSession,
   approveSession,
@@ -31,12 +29,8 @@ import type {
 } from "./types"
 import { ROUTES } from "@/config/routes"
 
-const PRIVY_APP_ID = import.meta.env.VITE_PRIVY_APP_ID
-const PRIVY_CLIENT_ID = import.meta.env.VITE_PRIVY_CLIENT_ID
-const DEV_AUTH_PAGE_URL = "http://localhost:5175"
-const isTauriRuntime = () =>
-  typeof window !== "undefined" &&
-  ("__TAURI__" in window || "__TAURI_INTERNALS__" in window)
+const ACCOUNT_URL =
+  import.meta.env.VITE_ACCOUNT_URL || "https://account.vana.org"
 
 // Demo mode: sessions starting with "grant-session-" use mock data (dev only)
 function isDemoSession(sessionId: string): boolean {
@@ -74,11 +68,8 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
     sessionId: "",
     status: "loading",
   })
-  const authTriggered = useRef(false)
   const [isApproving, setIsApproving] = useState(false)
   const [authPending, setAuthPending] = useState(false)
-  const [authUrl, setAuthUrl] = useState<string | null>(null)
-  const [authError, setAuthError] = useState<string | null>(null)
   const [retryCount, setRetryCount] = useState(0)
 
   const sessionId = params?.sessionId
@@ -87,9 +78,6 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
 
   // Reset auth state when sessionId changes
   useEffect(() => {
-    authTriggered.current = false
-    setAuthUrl(null)
-    setAuthError(null)
     setAuthPending(false)
   }, [sessionId])
 
@@ -269,83 +257,21 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
     setFlowState(prev => ({ ...prev, status: "success" }))
   }, [flowState.session, flowState.status, hasSuccessOverride])
 
-  // --- Auth ---
-  const startBrowserAuth = useCallback(async () => {
-    if (import.meta.env.DEV && !isTauriRuntime()) {
-      setAuthError(null)
-      setAuthUrl(DEV_AUTH_PAGE_URL)
-      return
-    }
-    if (!PRIVY_APP_ID || !PRIVY_CLIENT_ID) {
-      setAuthError("Missing VITE_PRIVY_APP_ID or VITE_PRIVY_CLIENT_ID.")
-      return
-    }
-
-    setAuthError(null)
-    try {
-      const url = await invoke<string>("start_browser_auth", {
-        privyAppId: PRIVY_APP_ID,
-        privyClientId: PRIVY_CLIENT_ID,
-      })
-      setAuthUrl(url)
-    } catch (err) {
-      if (import.meta.env.DEV) {
-        setAuthUrl(null)
-        setAuthError(
-          `Auth dev server runs at ${DEV_AUTH_PAGE_URL}. Switch to that tab to continue.`
-        )
-        return
-      }
-      console.error("Failed to start browser auth:", err)
-      setAuthError(
-        err instanceof Error
-          ? err.message
-          : "Failed to open browser for authentication."
-      )
-      authTriggered.current = false
-    }
-  }, [])
-
-  // Auto-start browser auth when auth is required
-  useEffect(() => {
-    if (flowState.status !== "auth-required" || authTriggered.current) return
-    authTriggered.current = true
-    startBrowserAuth()
-  }, [flowState.status, startBrowserAuth])
-
-  // Listen for auth completion from browser
-  useEffect(() => {
-    const unlisten = listen<{
-      success: boolean
-      user?: { id: string; email: string | null }
-      walletAddress?: string
-      masterKeySignature?: string
-      error?: string
-    }>("auth-complete", event => {
-      const result = event.payload
-      if (result.success && result.user) {
-        dispatch(
-          setAuthenticated({
-            user: { id: result.user.id, email: result.user.email || undefined },
-            walletAddress: result.walletAddress || null,
-            masterKeySignature: result.masterKeySignature || null,
-          })
-        )
-      }
-    })
-    return () => {
-      unlisten.then(fn => fn())
-    }
-  }, [dispatch])
-
   // --- Approve flow ---
   const handleApprove = useCallback(async () => {
     if (!flowState.session) return
 
-    // If not authenticated, defer to auth (auto-approve effect will resume)
+    // Auth should already be populated from the deep link (masterKeySig).
+    // If missing, the user needs to sign in via account.vana.org first.
     if (!isAuthenticated || !walletAddress) {
-      setAuthPending(true)
-      setFlowState(prev => ({ ...prev, status: "auth-required" }))
+      const connectUrl = new URL("/connect", ACCOUNT_URL)
+      if (flowState.sessionId) connectUrl.searchParams.set("sessionId", flowState.sessionId)
+      if (flowState.secret) connectUrl.searchParams.set("secret", flowState.secret)
+      setFlowState(prev => ({
+        ...prev,
+        status: "error",
+        error: `Not signed in. Please sign in at ${connectUrl.toString()} and relaunch Data Connect.`,
+      }))
       return
     }
 
@@ -472,12 +398,9 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
     dispatch,
   ])
 
-  // Auto-approve after auth completes (if user had clicked Allow before auth).
-  // For non-demo sessions, wait until the Personal Server is fully ready
-  // (port + tunnel) so handleApprove doesn't throw and the builder can reach
-  // the server externally. If the server errors out, surface the error
-  // immediately. For tunnel failures, keep waiting — the backend monitors
-  // frpc asynchronously and may emit a late tunnel-success event.
+  // Auto-approve after auth is ready and Personal Server is available.
+  // Auth is now populated from the deep link, but the Personal Server
+  // may still be starting up when the user clicks Allow.
   const preparingTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
   const [tunnelTimedOut, setTunnelTimedOut] = useState(false)
 
@@ -545,7 +468,6 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
   // For errors during grant creation/approval, the user returns to consent
   // and can click Allow again.
   const handleRetry = useCallback(() => {
-    authTriggered.current = false
     setAuthPending(false)
     setRetryCount(c => c + 1)
   }, [])
@@ -578,9 +500,6 @@ export function useGrantFlow(params: GrantFlowParams, prefetched?: PrefetchedGra
   return {
     flowState,
     isApproving,
-    authUrl,
-    authError,
-    startBrowserAuth,
     handleApprove,
     handleDeny,
     handleRetry,
diff --git a/src/pages/settings/sections/imports/components/personal-server-card.tsx b/src/pages/settings/sections/imports/components/personal-server-card.tsx
index 07d1855..6cdc247 100644
--- a/src/pages/settings/sections/imports/components/personal-server-card.tsx
+++ b/src/pages/settings/sections/imports/components/personal-server-card.tsx
@@ -1,4 +1,3 @@
-import { useNavigate } from "react-router"
 import {
   CheckCircleIcon,
   ExternalLinkIcon,
@@ -12,7 +11,10 @@ import { OpenExternalLink } from "@/components/typography/link-open-external"
 import { Text } from "@/components/typography/text"
 import { Button } from "@/components/ui/button"
 import { cn } from "@/lib/classes"
-import { ROUTES } from "@/config/routes"
+import { openExternalUrl } from "@/lib/open-resource"
+
+const ACCOUNT_URL =
+  import.meta.env.VITE_ACCOUNT_URL || "https://account.vana.org"
 
 export interface PersonalServerCardProps {
   isAuthenticated: boolean
@@ -25,8 +27,6 @@ export function PersonalServerCard({
   personalServer,
   serverId,
 }: PersonalServerCardProps) {
-  const navigate = useNavigate()
-
   const isRunning = personalServer.status === "running"
   const isStarting = personalServer.status === "starting"
   const statusKey = isRunning
@@ -65,7 +65,7 @@ export function PersonalServerCard({
             type="button"
             variant="accent"
             size="sm"
-            onClick={() => navigate(ROUTES.login)}
+            onClick={() => openExternalUrl(ACCOUNT_URL)}
           >
             <LogInIcon aria-hidden="true" className="size-4" />
             Sign in
diff --git a/src/pages/settings/use-settings-page.ts b/src/pages/settings/use-settings-page.ts
index cb87a01..a285042 100644
--- a/src/pages/settings/use-settings-page.ts
+++ b/src/pages/settings/use-settings-page.ts
@@ -6,7 +6,7 @@ import { useAuth } from "@/hooks/useAuth"
 import { usePersonalServer } from "@/hooks/usePersonalServer"
 import { useConnectedApps } from "@/hooks/useConnectedApps"
 import { ROUTES } from "@/config/routes"
-import { openLocalPath } from "@/lib/open-resource"
+import { openLocalPath, openExternalUrl } from "@/lib/open-resource"
 import { getUserDataPath } from "@/lib/tauri-paths"
 import type { BrowserSession, BrowserStatus, NodeJsTestResult, SettingsSection } from "./types"
 import {
@@ -183,8 +183,10 @@ export function useSettingsPage() {
   }, [logout, navigate])
 
   const handleSignIn = useCallback(() => {
-    navigate(ROUTES.login)
-  }, [navigate])
+    const accountUrl =
+      import.meta.env.VITE_ACCOUNT_URL || "https://account.vana.org"
+    openExternalUrl(accountUrl)
+  }, [])
 
   const setActiveSection = useCallback(
     (nextSection: SettingsSection) => {
diff --git a/src/services/accountApi.test.ts b/src/services/accountApi.test.ts
new file mode 100644
index 0000000..5378e6e
--- /dev/null
+++ b/src/services/accountApi.test.ts
@@ -0,0 +1,91 @@
+import { describe, expect, it, vi, beforeEach } from "vitest"
+import { signMessage, signTypedData } from "./accountApi"
+
+const mockFetch = vi.fn()
+
+vi.mock("@tauri-apps/plugin-http", () => ({
+  fetch: (...args: unknown[]) => mockFetch(...args),
+}))
+
+beforeEach(() => {
+  mockFetch.mockReset()
+})
+
+describe("signMessage", () => {
+  it("sends personal_sign request and returns signature", async () => {
+    mockFetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ signature: "0xsig123" }),
+    })
+
+    const sig = await signMessage("0xmasterkey", "vana-master-key-v1")
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      expect.stringContaining("/api/sign"),
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({
+          masterKeySignature: "0xmasterkey",
+          message: "vana-master-key-v1",
+          type: "personal_sign",
+        }),
+      })
+    )
+    expect(sig).toBe("0xsig123")
+  })
+
+  it("throws on non-ok response", async () => {
+    mockFetch.mockResolvedValue({
+      ok: false,
+      status: 401,
+      text: () => Promise.resolve("Unauthorized"),
+    })
+
+    await expect(signMessage("0xbad", "msg")).rejects.toThrow(
+      "Sign failed (401): Unauthorized"
+    )
+  })
+})
+
+describe("signTypedData", () => {
+  it("sends eth_signTypedData_v4 request and returns signature", async () => {
+    mockFetch.mockResolvedValue({
+      ok: true,
+      json: () => Promise.resolve({ signature: "0xtypedsig" }),
+    })
+
+    const typedData = {
+      primaryType: "ServerRegistration",
+      domain: { name: "Vana" },
+      types: {},
+      message: {},
+    }
+
+    const sig = await signTypedData("0xmasterkey", typedData)
+
+    expect(mockFetch).toHaveBeenCalledWith(
+      expect.stringContaining("/api/sign"),
+      expect.objectContaining({
+        method: "POST",
+        body: JSON.stringify({
+          masterKeySignature: "0xmasterkey",
+          typedData,
+          type: "eth_signTypedData_v4",
+        }),
+      })
+    )
+    expect(sig).toBe("0xtypedsig")
+  })
+
+  it("throws on non-ok response", async () => {
+    mockFetch.mockResolvedValue({
+      ok: false,
+      status: 500,
+      text: () => Promise.resolve("Internal error"),
+    })
+
+    await expect(signTypedData("0xbad", {})).rejects.toThrow(
+      "Sign failed (500): Internal error"
+    )
+  })
+})
diff --git a/src/services/accountApi.ts b/src/services/accountApi.ts
new file mode 100644
index 0000000..5cd123e
--- /dev/null
+++ b/src/services/accountApi.ts
@@ -0,0 +1,48 @@
+import { fetch as tauriFetch } from "@tauri-apps/plugin-http"
+
+const ACCOUNT_URL =
+  import.meta.env.VITE_ACCOUNT_URL || "https://account.vana.org"
+
+export async function signMessage(
+  masterKeySignature: string,
+  message: string
+): Promise<string> {
+  const res = await tauriFetch(`${ACCOUNT_URL}/api/sign`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      masterKeySignature,
+      message,
+      type: "personal_sign",
+    }),
+  })
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "")
+    throw new Error(`Sign failed (${res.status}): ${text}`)
+  }
+  const { signature } = await res.json()
+  return signature
+}
+
+export async function signTypedData(
+  masterKeySignature: string,
+  typedData: Record<string, unknown>
+): Promise<string> {
+  const res = await tauriFetch(`${ACCOUNT_URL}/api/sign`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify({
+      masterKeySignature,
+      typedData,
+      type: "eth_signTypedData_v4",
+    }),
+  })
+
+  if (!res.ok) {
+    const text = await res.text().catch(() => "")
+    throw new Error(`Sign failed (${res.status}): ${text}`)
+  }
+  const { signature } = await res.json()
+  return signature
+}
diff --git a/vite.auth.config.ts b/vite.auth.config.ts
deleted file mode 100644
index 2f60847..0000000
--- a/vite.auth.config.ts
+++ /dev/null
@@ -1,40 +0,0 @@
-import { defineConfig, type Plugin } from "vite"
-import react from "@vitejs/plugin-react"
-import tailwindcss from "@tailwindcss/vite"
-import path from "path"
-
-/**
- * Replace %PRIVY_APP_ID% / %PRIVY_CLIENT_ID% placeholders in index.html
- * with VITE_PRIVY_* env vars so `auth:dev` works standalone.
- * In production these are injected by the Rust backend (auth.rs).
- */
-function authHtmlPlaceholders(): Plugin {
-  return {
-    name: "auth-html-placeholders",
-    transformIndexHtml: {
-      order: "pre",
-      handler(html) {
-        return html
-          .replace("%PRIVY_APP_ID%", process.env.VITE_PRIVY_APP_ID || "%PRIVY_APP_ID%")
-          .replace("%PRIVY_CLIENT_ID%", process.env.VITE_PRIVY_CLIENT_ID || "%PRIVY_CLIENT_ID%")
-      },
-    },
-  }
-}
-
-export default defineConfig({
-  root: path.resolve(__dirname, "src/auth-page"),
-  base: "/",
-  publicDir: path.resolve(__dirname, "public"),
-  envDir: path.resolve(__dirname), // read .env.local from project root
-  plugins: [authHtmlPlaceholders(), react(), tailwindcss()],
-  resolve: {
-    alias: {
-      "@": path.resolve(__dirname, "src"),
-    },
-  },
-  build: {
-    emptyOutDir: true,
-    outDir: path.resolve(__dirname, "src-tauri/auth-page"),
-  },
-})