diff --git a/apps/twisted/.env.example b/apps/twisted/.env.example
index e53c663..ad64629 100644
--- a/apps/twisted/.env.example
+++ b/apps/twisted/.env.example
@@ -1 +1,6 @@
-VITE_TWISTER_API_BASE_URL=http://localhost:8080
+VITE_TWISTER_API_BASE_URL=http://127.0.0.1:8080
+
+# OAuth configuration
+# VITE_OAUTH_CLIENT_ID must be a publicly accessible URL (use a tunnel for local dev)
+# VITE_OAUTH_CLIENT_ID=https://your-tunnel.example.com/oauth/client-metadata.json
+VITE_OAUTH_REDIRECT_URI=http://127.0.0.1:5173/oauth-callback
diff --git a/apps/twisted/android/app/src/main/AndroidManifest.xml b/apps/twisted/android/app/src/main/AndroidManifest.xml
index b06ddbf..ad2cc51 100644
--- a/apps/twisted/android/app/src/main/AndroidManifest.xml
+++ b/apps/twisted/android/app/src/main/AndroidManifest.xml
@@ -22,6 +22,13 @@
                 <category android:name="android.intent.category.LAUNCHER" />
             </intent-filter>
 
+            <intent-filter android:autoVerify="true">
+                <action android:name="android.intent.action.VIEW" />
+                <category android:name="android.intent.category.DEFAULT" />
+                <category android:name="android.intent.category.BROWSABLE" />
+                <data android:scheme="io.ionic.starter" />
+            </intent-filter>
+
         </activity>
 
         <provider
diff --git a/apps/twisted/capacitor.config.ts b/apps/twisted/capacitor.config.ts
index a715ab2..2f5f32a 100644
--- a/apps/twisted/capacitor.config.ts
+++ b/apps/twisted/capacitor.config.ts
@@ -1,9 +1,11 @@
-import type { CapacitorConfig } from '@capacitor/cli';
+import type { CapacitorConfig } from "@capacitor/cli";
 
 const config: CapacitorConfig = {
-  appId: 'io.ionic.starter',
-  appName: 'Twisted',
-  webDir: 'dist'
+  appId: "io.ionic.starter",
+  appName: "Twisted",
+  webDir: "dist",
+  server: { androidScheme: "io.ionic.starter" },
+  plugins: { CapacitorHttp: { enabled: true } },
 };
 
 export default config;
diff --git a/apps/twisted/ios/App/App/Info.plist b/apps/twisted/ios/App/App/Info.plist
index 19f0f25..6d660fd 100644
--- a/apps/twisted/ios/App/App/Info.plist
+++ b/apps/twisted/ios/App/App/Info.plist
@@ -47,5 +47,14 @@
 	</array>
 	<key>UIViewControllerBasedStatusBarAppearance</key>
 	<true/>
+	<key>CFBundleURLTypes</key>
+	<array>
+		<dict>
+			<key>CFBundleURLSchemes</key>
+			<array>
+				<string>io.ionic.starter</string>
+			</array>
+		</dict>
+	</array>
 </dict>
 </plist>
diff --git a/apps/twisted/package.json b/apps/twisted/package.json
index 5d89f3c..bc9f717 100644
--- a/apps/twisted/package.json
+++ b/apps/twisted/package.json
@@ -15,6 +15,8 @@
   "dependencies": {
     "@atcute/bluesky": "^3.3.0",
     "@atcute/client": "^4.2.1",
+    "@atcute/identity-resolver": "^1.2.2",
+    "@atcute/lexicons": "^1.2.9",
     "@atcute/oauth-browser-client": "^3.0.0",
     "@atcute/tangled": "^1.0.17",
     "@capacitor/android": "^8.2.0",
diff --git a/apps/twisted/public/client-metadata.json b/apps/twisted/public/client-metadata.json
new file mode 100644
index 0000000..51ff0b9
--- /dev/null
+++ b/apps/twisted/public/client-metadata.json
@@ -0,0 +1,14 @@
+{
+  "client_id": "io.ionic.starter://client-metadata.json",
+  "client_name": "Twisted",
+  "client_uri": "https://tangled.org",
+  "logo_uri": "https://tangled.org/logo.png",
+  "tos_uri": "https://tangled.org/terms",
+  "policy_uri": "https://tangled.org/privacy",
+  "redirect_uris": ["io.ionic.starter://oauth-callback", "http://localhost:5173/oauth-callback"],
+  "scope": "atproto",
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "application_type": "native",
+  "dpop_bound_access_tokens": true
+}
diff --git a/apps/twisted/src/app/router/index.ts b/apps/twisted/src/app/router/index.ts
index c4c6523..d0c8a06 100644
--- a/apps/twisted/src/app/router/index.ts
+++ b/apps/twisted/src/app/router/index.ts
@@ -5,6 +5,8 @@ import TabsPage from "@/views/TabsPage.vue";
 
 const routes: RouteRecordRaw[] = [
   { path: "/", redirect: "/tabs/home" },
+  { path: "/login", component: () => import("@/features/auth/LoginPage.vue") },
+  { path: "/oauth-callback", component: () => import("@/features/auth/OAuthCallbackPage.vue") },
   {
     path: "/tabs/",
     component: TabsPage,
diff --git a/apps/twisted/src/core/auth/client.ts b/apps/twisted/src/core/auth/client.ts
new file mode 100644
index 0000000..e0aeaa9
--- /dev/null
+++ b/apps/twisted/src/core/auth/client.ts
@@ -0,0 +1,38 @@
+import { Client } from "@atcute/client";
+import type { OAuthUserAgent } from "@atcute/oauth-browser-client";
+import { useAuthStore } from "./store.ts";
+
+let authClient: Client | null = null;
+let currentUserAgent: OAuthUserAgent | null = null;
+
+export function getAuthClient(): Client | null {
+  const authStore = useAuthStore();
+  const userAgent = authStore.getUserAgent();
+
+  if (!userAgent) {
+    authClient = null;
+    currentUserAgent = null;
+    return null;
+  }
+
+  if (authClient && currentUserAgent === userAgent) {
+    return authClient;
+  }
+
+  authClient = new Client({ handler: userAgent });
+  currentUserAgent = userAgent;
+  return authClient;
+}
+
+export function requireAuthClient(): Client {
+  const client = getAuthClient();
+  if (!client) {
+    throw new Error("Authentication required");
+  }
+  return client;
+}
+
+export function clearAuthClient(): void {
+  authClient = null;
+  currentUserAgent = null;
+}
diff --git a/apps/twisted/src/core/auth/index.ts b/apps/twisted/src/core/auth/index.ts
new file mode 100644
index 0000000..af3e967
--- /dev/null
+++ b/apps/twisted/src/core/auth/index.ts
@@ -0,0 +1,3 @@
+export { initializeOAuth, clientId, redirectUri } from "./oauth-config.ts";
+export { useAuthStore, type AuthState } from "./store.ts";
+export { getAuthClient, requireAuthClient, clearAuthClient } from "./client.ts";
diff --git a/apps/twisted/src/core/auth/oauth-config.ts b/apps/twisted/src/core/auth/oauth-config.ts
new file mode 100644
index 0000000..e444607
--- /dev/null
+++ b/apps/twisted/src/core/auth/oauth-config.ts
@@ -0,0 +1,43 @@
+import { configureOAuth } from "@atcute/oauth-browser-client";
+import {
+  LocalActorResolver,
+  CompositeDidDocumentResolver,
+  CompositeHandleResolver,
+  PlcDidDocumentResolver,
+  WebDidDocumentResolver,
+  WellKnownHandleResolver,
+  DohJsonHandleResolver,
+} from "@atcute/identity-resolver";
+
+const isNative = typeof window !== "undefined" && !window.location.origin.startsWith("http");
+const baseUrl = isNative ? "io.ionic.starter://" : window.location.origin;
+const clientId =
+  (!isNative && import.meta.env.VITE_OAUTH_CLIENT_ID?.trim()) ||
+  `${baseUrl}/client-metadata.json`;
+const redirectUri =
+  (!isNative && import.meta.env.VITE_OAUTH_REDIRECT_URI?.trim()) ||
+  `${baseUrl}/oauth-callback`;
+
+const didResolver = new CompositeDidDocumentResolver({
+  methods: { plc: new PlcDidDocumentResolver(), web: new WebDidDocumentResolver() },
+});
+
+const handleResolver = new CompositeHandleResolver({
+  strategy: "race",
+  methods: {
+    http: new WellKnownHandleResolver(),
+    dns: new DohJsonHandleResolver({ dohUrl: "https://cloudflare-dns.com/dns-query" }),
+  },
+});
+
+const actorResolver = new LocalActorResolver({ didDocumentResolver: didResolver, handleResolver });
+
+export function initializeOAuth(): void {
+  configureOAuth({
+    metadata: { client_id: clientId, redirect_uri: redirectUri },
+    identityResolver: actorResolver,
+    storageName: "twisted-oauth",
+  });
+}
+
+export { clientId, redirectUri };
diff --git a/apps/twisted/src/core/auth/store.ts b/apps/twisted/src/core/auth/store.ts
new file mode 100644
index 0000000..f550c1e
--- /dev/null
+++ b/apps/twisted/src/core/auth/store.ts
@@ -0,0 +1,136 @@
+import { defineStore } from "pinia";
+import { ref, computed, Ref } from "vue";
+import type { Session } from "@atcute/oauth-browser-client";
+import { getSession, deleteStoredSession, listStoredSessions, OAuthUserAgent } from "@atcute/oauth-browser-client";
+import { initializeOAuth } from "./oauth-config.js";
+
+export type AuthState = "idle" | "restoring" | "authenticating" | "authenticated" | "error";
+
+export const useAuthStore = defineStore("auth", () => {
+  const state = ref<AuthState>("idle");
+  const session = ref<Session | null>(null);
+  const userAgent: Ref<OAuthUserAgent | null> = ref(null);
+  const error = ref<string | null>(null);
+  const accounts = ref<`did:${string}:${string}`[]>([]);
+
+  const isAuthenticated = computed(() => state.value === "authenticated" && session.value !== null);
+  const did = computed(() => session.value?.info.sub ?? null);
+  const pds = computed(() => session.value?.info.aud ?? null);
+
+  function initialize() {
+    initializeOAuth();
+    accounts.value = listStoredSessions();
+  }
+
+  async function restoreSession(preferredDid?: `did:${string}:${string}`): Promise<boolean> {
+    state.value = "restoring";
+    error.value = null;
+
+    try {
+      const dids = listStoredSessions();
+      if (dids.length === 0) {
+        state.value = "idle";
+        return false;
+      }
+
+      const targetDid = preferredDid && dids.includes(preferredDid) ? preferredDid : dids[0];
+      const restoredSession = await getSession(targetDid, { allowStale: true });
+
+      session.value = restoredSession;
+      userAgent.value = new OAuthUserAgent(restoredSession);
+      accounts.value = dids;
+      state.value = "authenticated";
+      return true;
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : "Failed to restore session";
+      state.value = "error";
+      return false;
+    }
+  }
+
+  async function switchAccount(targetDid: `did:${string}:${string}`): Promise<boolean> {
+    if (!accounts.value.includes(targetDid)) {
+      error.value = "Account not found";
+      return false;
+    }
+
+    return restoreSession(targetDid);
+  }
+
+  function setSession(newSession: Session) {
+    session.value = newSession;
+    userAgent.value = new OAuthUserAgent(newSession);
+    state.value = "authenticated";
+    error.value = null;
+    accounts.value = listStoredSessions();
+  }
+
+  async function refreshSession(): Promise<boolean> {
+    if (!session.value) return false;
+
+    try {
+      const refreshed = await getSession(session.value.info.sub, { noCache: true });
+      session.value = refreshed;
+      userAgent.value = new OAuthUserAgent(refreshed);
+      return true;
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : "Failed to refresh session";
+      return false;
+    }
+  }
+
+  async function logout(): Promise<void> {
+    if (userAgent.value) {
+      try {
+        await userAgent.value.signOut();
+      } catch {
+        if (session.value) {
+          deleteStoredSession(session.value.info.sub);
+        }
+      }
+    } else if (session.value) {
+      deleteStoredSession(session.value.info.sub);
+    }
+
+    session.value = null;
+    userAgent.value = null;
+    state.value = "idle";
+    error.value = null;
+    accounts.value = listStoredSessions();
+  }
+
+  async function logoutAll(): Promise<void> {
+    const dids = listStoredSessions();
+    for (const d of dids) {
+      deleteStoredSession(d);
+    }
+    session.value = null;
+    userAgent.value = null;
+    state.value = "idle";
+    error.value = null;
+    accounts.value = [];
+  }
+
+  function getUserAgent(): OAuthUserAgent | null {
+    return userAgent.value;
+  }
+
+  return {
+    state,
+    session,
+    userAgent,
+    error,
+    accounts,
+    isAuthenticated,
+    did,
+    pds,
+    initialize,
+    restoreSession,
+    switchAccount,
+    setSession,
+    refreshSession,
+    logout,
+    logoutAll,
+    getUserAgent,
+  };
+});
diff --git a/apps/twisted/src/features/auth/LoginPage.vue b/apps/twisted/src/features/auth/LoginPage.vue
new file mode 100644
index 0000000..d82a47b
--- /dev/null
+++ b/apps/twisted/src/features/auth/LoginPage.vue
@@ -0,0 +1,185 @@
+<template>
+  <ion-page>
+    <ion-header :translucent="true">
+      <ion-toolbar>
+        <ion-buttons slot="start">
+          <ion-back-button default-href="/tabs/profile" />
+        </ion-buttons>
+        <ion-title>Sign In</ion-title>
+      </ion-toolbar>
+    </ion-header>
+
+    <ion-content :fullscreen="true">
+      <div class="login-container">
+        <div class="brand-icon">
+          <ion-icon :icon="codeSlashOutline" />
+        </div>
+
+        <h2 class="login-title">Sign in to Tangled</h2>
+        <p class="login-subtitle">Enter your AT Protocol handle to sign in with OAuth.</p>
+
+        <form @submit.prevent="handleSignIn">
+          <ion-item class="handle-input" lines="none">
+            <ion-input
+              v-model="handle"
+              type="text"
+              placeholder="username.bsky.social"
+              :disabled="isLoading"
+              autocomplete="username"
+              enterkeyhint="go" />
+          </ion-item>
+
+          <ion-button class="login-btn" expand="block" type="submit" :disabled="!handle.trim() || isLoading">
+            <ion-icon v-if="!isLoading" slot="start" :icon="logInOutline" />
+            <ion-spinner v-else slot="start" name="crescent" />
+            {{ isLoading ? "Signing in..." : "Continue with OAuth" }}
+          </ion-button>
+        </form>
+
+        <p v-if="error" class="login-error">{{ error }}</p>
+
+        <p class="login-hint">
+          Don't have a handle?
+          <a href="https://bsky.app" target="_blank" rel="noopener">Get one at bsky.app</a>
+        </p>
+      </div>
+    </ion-content>
+  </ion-page>
+</template>
+
+<script setup lang="ts">
+  import { ref } from "vue";
+  import {
+    IonPage,
+    IonHeader,
+    IonToolbar,
+    IonTitle,
+    IonContent,
+    IonButton,
+    IonIcon,
+    IonButtons,
+    IonBackButton,
+    IonItem,
+    IonInput,
+    IonSpinner,
+    toastController,
+  } from "@ionic/vue";
+  import { codeSlashOutline, logInOutline } from "ionicons/icons";
+  import { createAuthorizationUrl } from "@atcute/oauth-browser-client";
+  import { useAuthStore } from "@/core/auth/store.js";
+  import type { Handle } from "@atcute/lexicons/syntax";
+
+  const authStore = useAuthStore();
+
+  const handle = ref("");
+  const isLoading = ref(false);
+  const error = ref<string | null>(null);
+
+  async function handleSignIn() {
+    const trimmedHandle = handle.value.trim() as Handle;
+    if (!trimmedHandle) return;
+
+    isLoading.value = true;
+    error.value = null;
+    authStore.state = "authenticating";
+
+    try {
+      const authUrl = await createAuthorizationUrl({
+        target: { type: "account", identifier: trimmedHandle },
+        scope: "atproto",
+      });
+
+      window.location.href = authUrl.toString();
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : "Failed to start sign in";
+      authStore.state = "error";
+      isLoading.value = false;
+
+      const toast = await toastController.create({ message: error.value, duration: 3000, color: "danger" });
+      await toast.present();
+    }
+  }
+</script>
+
+<style scoped>
+  .login-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    min-height: 70vh;
+    padding: 32px 28px;
+    text-align: center;
+    gap: 14px;
+  }
+
+  .brand-icon {
+    width: 72px;
+    height: 72px;
+    border-radius: var(--t-radius-lg);
+    background: var(--t-accent-dim);
+    border: 1px solid var(--t-border-strong);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 30px;
+    color: var(--t-accent);
+    margin-bottom: 4px;
+  }
+
+  .login-title {
+    font-size: 22px;
+    font-weight: 700;
+    color: var(--t-text-primary);
+    margin: 0;
+    line-height: 1.2;
+  }
+
+  .login-subtitle {
+    font-size: 14px;
+    color: var(--t-text-secondary);
+    margin: 0;
+    line-height: 1.55;
+    max-width: 280px;
+  }
+
+  .handle-input {
+    --background: var(--ion-color-light);
+    --border-radius: var(--t-radius-md);
+    --padding-start: 16px;
+    --padding-end: 16px;
+    width: 100%;
+    max-width: 320px;
+    margin-bottom: 8px;
+  }
+
+  .login-btn {
+    --background: var(--t-accent);
+    --background-activated: var(--t-accent);
+    --color: #0d1117;
+    --border-radius: var(--t-radius-md);
+    width: 100%;
+    max-width: 320px;
+    font-weight: 600;
+    font-size: 15px;
+    margin-top: 6px;
+  }
+
+  .login-error {
+    font-size: 13px;
+    color: var(--ion-color-danger);
+    margin: 8px 0 0;
+    max-width: 280px;
+  }
+
+  .login-hint {
+    font-size: 13px;
+    color: var(--t-text-muted);
+    margin: 4px 0 0;
+  }
+
+  .login-hint a {
+    color: var(--t-accent);
+    text-decoration: none;
+  }
+</style>
diff --git a/apps/twisted/src/features/auth/OAuthCallbackPage.vue b/apps/twisted/src/features/auth/OAuthCallbackPage.vue
new file mode 100644
index 0000000..029f65c
--- /dev/null
+++ b/apps/twisted/src/features/auth/OAuthCallbackPage.vue
@@ -0,0 +1,81 @@
+<template>
+  <ion-page>
+    <ion-content :fullscreen="true" class="callback-content">
+      <div class="callback-container">
+        <ion-spinner name="crescent" class="callback-spinner" />
+        <p class="callback-text">{{ statusMessage }}</p>
+      </div>
+    </ion-content>
+  </ion-page>
+</template>
+
+<script setup lang="ts">
+  import { onMounted, ref } from "vue";
+  import { useRouter } from "vue-router";
+  import { IonPage, IonContent, IonSpinner, toastController } from "@ionic/vue";
+  import { finalizeAuthorization } from "@atcute/oauth-browser-client";
+  import { useAuthStore } from "@/core/auth/store.js";
+
+  const router = useRouter();
+  const authStore = useAuthStore();
+
+  const statusMessage = ref("Completing sign in...");
+
+  onMounted(async () => {
+    try {
+      const params = new URLSearchParams(window.location.hash.slice(1));
+      const result = await finalizeAuthorization(params);
+
+      authStore.setSession(result.session);
+      statusMessage.value = "Signed in successfully!";
+
+      const toast = await toastController.create({
+        message: "Signed in successfully!",
+        duration: 2000,
+        color: "success",
+      });
+      await toast.present();
+
+      router.replace("/tabs/profile");
+    } catch (e) {
+      const message = e instanceof Error ? e.message : "Sign in failed";
+      statusMessage.value = message;
+      authStore.state = "error";
+      authStore.error = message;
+
+      const toast = await toastController.create({ message, duration: 3000, color: "danger" });
+      await toast.present();
+
+      setTimeout(() => {
+        router.replace("/tabs/profile");
+      }, 1500);
+    }
+  });
+</script>
+
+<style scoped>
+  .callback-content {
+    --background: var(--ion-background-color);
+  }
+
+  .callback-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    min-height: 100vh;
+    gap: 20px;
+  }
+
+  .callback-spinner {
+    width: 48px;
+    height: 48px;
+    color: var(--t-accent);
+  }
+
+  .callback-text {
+    font-size: 16px;
+    color: var(--t-text-secondary);
+    margin: 0;
+  }
+</style>
diff --git a/apps/twisted/src/features/profile/ProfilePage.vue b/apps/twisted/src/features/profile/ProfilePage.vue
index 4bf2b5a..ec80c0f 100644
--- a/apps/twisted/src/features/profile/ProfilePage.vue
+++ b/apps/twisted/src/features/profile/ProfilePage.vue
@@ -2,113 +2,595 @@
   <ion-page>
     <ion-header :translucent="true">
       <ion-toolbar>
-        <ion-title>Profile</ion-title>
+        <ion-title class="profile-title mono">{{ profile?.handle || "Profile" }}</ion-title>
+        <ion-buttons v-if="authStore.isAuthenticated" slot="end">
+          <ion-button @click="goToSettings">
+            <ion-icon slot="icon-only" :icon="settingsOutline" />
+          </ion-button>
+          <ion-button @click="handleLogout">
+            <ion-icon slot="icon-only" :icon="logOutOutline" color="danger" />
+          </ion-button>
+        </ion-buttons>
       </ion-toolbar>
     </ion-header>
 
     <ion-content :fullscreen="true">
-      <ion-header collapse="condense">
-        <ion-toolbar>
-          <ion-title size="large">Profile</ion-title>
-        </ion-toolbar>
-      </ion-header>
-
-      <div class="signin-container">
-        <div class="brand-icon">
-          <ion-icon :icon="codeSlashOutline" />
+      <template v-if="authStore.state === 'restoring'">
+        <SkeletonLoader variant="profile" />
+        <SkeletonLoader v-for="n in 3" :key="n" variant="card" />
+      </template>
+
+      <template v-else-if="authStore.isAuthenticated">
+        <div class="profile-header">
+          <ion-avatar class="avatar">
+            <img v-if="profile?.avatar" :src="profile.avatar" :alt="`${profile.handle} avatar`" class="avatar-image" />
+            <div v-else class="avatar-fallback" :style="{ background: avatarColor(profile?.handle || '') }">
+              {{ initials(profile?.handle || '') }}
+            </div>
+          </ion-avatar>
+
+          <div class="profile-info">
+            <div class="profile-handle mono">{{ profile?.handle || authStore.did }}</div>
+            <div v-if="profile?.displayName" class="profile-name">{{ profile.displayName }}</div>
+          </div>
+        </div>
+
+        <div v-if="profile?.bio" class="profile-bio">{{ profile.bio }}</div>
+
+        <div v-if="(profile as any)?.location || (profile as any)?.pronouns" class="profile-meta">
+          <span v-if="(profile as any).location" class="meta-item">
+            <ion-icon :icon="locationOutline" class="meta-icon" />
+            {{ (profile as any).location }}
+          </span>
+          <span v-if="(profile as any).pronouns" class="meta-item">
+            <ion-icon :icon="personOutline" class="meta-icon" />
+            {{ (profile as any).pronouns }}
+          </span>
+        </div>
+
+        <div v-if="(profile as any)?.links?.length" class="profile-links">
+          <a
+            v-for="link in (profile as any).links"
+            :key="link"
+            :href="link"
+            class="profile-link"
+            target="_blank"
+            rel="noopener noreferrer">
+            <ion-icon :icon="linkOutline" class="link-icon" />
+            {{ displayLink(link) }}
+          </a>
+        </div>
+
+        <div class="stats-row">
+          <div v-for="stat in stats" :key="stat.label" class="stat-pill">
+            <span class="stat-value">{{ stat.value }}</span>
+            <span class="stat-label">{{ stat.label }}</span>
+          </div>
         </div>
 
-        <h2 class="signin-title">Sign in to Tangled</h2>
-        <p class="signin-subtitle">
-          Use your AT Protocol handle to sign in and access your starred repos, follow developers, and get a
-          personalized activity feed.
-        </p>
-
-        <ion-button class="signin-btn" expand="block" @click="handleSignIn">
-          <ion-icon slot="start" :icon="logInOutline" />
-          Sign in with AT Protocol
-        </ion-button>
-
-        <p class="signin-hint">
-          Don't have a handle?
-          <span class="signin-link">Get one at bsky.app</span>
-        </p>
-      </div>
+        <ion-segment v-model="section" class="profile-segment" scrollable>
+          <ion-segment-button value="repos">Repos</ion-segment-button>
+          <ion-segment-button value="strings">Strings</ion-segment-button>
+          <ion-segment-button value="issues">Issues</ion-segment-button>
+          <ion-segment-button value="prs">PRs</ion-segment-button>
+          <ion-segment-button value="following">Following</ion-segment-button>
+        </ion-segment>
+
+        <template v-if="section === 'repos'">
+          <template v-if="pinnedRepos.length">
+            <h3 class="section-label">Pinned</h3>
+            <RepoCard
+              v-for="repo in pinnedRepos"
+              :key="repo.atUri"
+              :repo="repo"
+              @click="navigateToRepo(repo)"
+              @owner-click="navigateToUser(repo.ownerHandle)" />
+          </template>
+
+          <h3 class="section-label">Repositories</h3>
+          <template v-if="reposQuery.isPending.value">
+            <SkeletonLoader v-for="n in 3" :key="n" variant="card" />
+          </template>
+          <template v-else-if="otherRepos.length">
+            <RepoCard
+              v-for="repo in otherRepos"
+              :key="repo.atUri"
+              :repo="repo"
+              @click="navigateToRepo(repo)"
+              @owner-click="navigateToUser(repo.ownerHandle)" />
+          </template>
+          <EmptyState
+            v-else-if="!pinnedRepos.length"
+            :icon="codeSlashOutline"
+            title="No repositories"
+            message="You haven't created any repositories yet." />
+        </template>
+
+        <UserStrings v-else-if="section === 'strings'" :strings="strings" :is-loading="stringsQuery.isPending.value" />
+
+        <RepoIssues
+          v-else-if="section === 'issues'"
+          :issues="issues"
+          :is-loading="issuesQuery.isPending.value"
+          @select="navigateToIssue" />
+
+        <RepoPRs
+          v-else-if="section === 'prs'"
+          :prs="pullRequests"
+          :is-loading="pullRequestsQuery.isPending.value"
+          @select="navigateToPullRequest" />
+
+        <template v-else>
+          <template v-if="followingQuery.isPending.value">
+            <SkeletonLoader v-for="n in 3" :key="n" variant="list-item" />
+          </template>
+          <template v-else-if="following.length">
+            <UserCard
+              v-for="user in following"
+              :key="user.followAtUri"
+              :user="user"
+              @click="navigateToUser(user.handle)" />
+          </template>
+          <EmptyState
+            v-else
+            :icon="peopleOutline"
+            title="Not following anyone"
+            message="You aren't following any profiles yet." />
+        </template>
+
+        <ion-list v-if="authStore.accounts.length > 1" class="account-list" lines="none">
+          <ion-list-header>
+            <ion-label>Switch Account</ion-label>
+          </ion-list-header>
+          <ion-item
+            v-for="accountDid in authStore.accounts"
+            :key="accountDid"
+            button
+            :disabled="accountDid === authStore.did"
+            @click="switchToAccount(accountDid)">
+            <ion-label>{{ accountDid }}</ion-label>
+            <ion-icon v-if="accountDid === authStore.did" :icon="checkmarkOutline" slot="end" color="primary" />
+          </ion-item>
+        </ion-list>
+      </template>
+
+      <template v-else>
+        <div class="signin-container">
+          <div class="brand-icon">
+            <ion-icon :icon="codeSlashOutline" />
+          </div>
+
+          <h2 class="signin-title">Sign in to Tangled</h2>
+          <p class="signin-subtitle">
+            Use your AT Protocol handle to sign in and access your starred repos, follow developers, and get a
+            personalized activity feed.
+          </p>
+
+          <ion-button class="signin-btn" expand="block" @click="handleSignIn">
+            <ion-icon slot="start" :icon="logInOutline" />
+            Sign in with AT Protocol
+          </ion-button>
+
+          <p class="signin-hint">
+            Don't have a handle?
+            <a href="https://bsky.app" target="_blank" rel="noopener">Get one at bsky.app</a>
+          </p>
+        </div>
+      </template>
     </ion-content>
   </ion-page>
 </template>
 
 <script setup lang="ts">
-import { IonPage, IonHeader, IonToolbar, IonTitle, IonContent, IonButton, IonIcon } from "@ionic/vue";
-import { codeSlashOutline, logInOutline } from "ionicons/icons";
+  import { ref, computed } from "vue";
+  import { useRouter } from "vue-router";
+  import {
+    IonPage,
+    IonHeader,
+    IonToolbar,
+    IonTitle,
+    IonContent,
+    IonButton,
+    IonIcon,
+    IonButtons,
+    IonAvatar,
+    IonList,
+    IonItem,
+    IonLabel,
+    IonListHeader,
+    IonSegment,
+    IonSegmentButton,
+    alertController,
+    toastController,
+  } from "@ionic/vue";
+  import {
+    codeSlashOutline,
+    logInOutline,
+    logOutOutline,
+    settingsOutline,
+    personOutline,
+    locationOutline,
+    linkOutline,
+    checkmarkOutline,
+    peopleOutline,
+  } from "ionicons/icons";
+  import SkeletonLoader from "@/components/common/SkeletonLoader.vue";
+  import EmptyState from "@/components/common/EmptyState.vue";
+  import RepoCard from "@/components/common/RepoCard.vue";
+  import UserCard from "@/components/common/UserCard.vue";
+  import RepoIssues from "@/features/repo/RepoIssues.vue";
+  import RepoPRs from "@/features/repo/RepoPRs.vue";
+  import UserStrings from "@/features/profile/UserStrings.vue";
+  import { useAuthStore } from "@/core/auth/store.js";
+  import {
+    useActorProfile,
+    useUserRepos,
+    useUserStrings,
+    useUserIssues,
+    useUserPullRequests,
+    useUserFollowing,
+  } from "@/services/tangled/queries.js";
+  import { useIndexedProfileSummary } from "@/services/project-api/queries.js";
+  import type { IssueSummary } from "@/domain/models/issue.js";
+  import type { PullRequestSummary } from "@/domain/models/pull-request.js";
+  import type { RepoSummary } from "@/domain/models/repo.js";
+
+  const router = useRouter();
+  const authStore = useAuthStore();
+
+  const identifier = computed(() => authStore.did ?? "");
+  const isReady = computed(() => !!authStore.did);
+  const section = ref<"repos" | "strings" | "issues" | "prs" | "following">("repos");
+
+  const profileQuery = useActorProfile(identifier, undefined, { enabled: isReady });
+  const reposQuery = useUserRepos(identifier, { enabled: isReady });
+  const stringsQuery = useUserStrings(identifier, { enabled: isReady });
+  const issuesQuery = useUserIssues(identifier, { enabled: isReady });
+  const pullRequestsQuery = useUserPullRequests(identifier, { enabled: isReady });
+  const followingQuery = useUserFollowing(identifier, { enabled: isReady });
+  const indexedProfileSummaryQuery = useIndexedProfileSummary(identifier, { enabled: isReady });
+
+  const profile = computed(() => profileQuery.data.value);
+  const repos = computed(() => reposQuery.data.value ?? []);
+  const strings = computed(() => stringsQuery.data.value ?? []);
+  const issues = computed(() => issuesQuery.data.value ?? []);
+  const pullRequests = computed(() => pullRequestsQuery.data.value ?? []);
+  const following = computed(() => followingQuery.data.value ?? []);
+  const indexedProfileSummary = computed(() => indexedProfileSummaryQuery.data.value);
+
+  const pinnedUris = computed(() => (profile.value as { pinnedRepos?: string[] } | undefined)?.pinnedRepos ?? []);
+  const pinnedRepos = computed(() => repos.value.filter((r) => pinnedUris.value.includes(r.atUri)));
+  const otherRepos = computed(() => repos.value.filter((r) => !pinnedUris.value.includes(r.atUri)));
+
+  const stats = computed(() => {
+    const values = [
+      { label: "repos", value: repos.value.length },
+      { label: "strings", value: strings.value.length },
+      { label: "issues", value: issues.value.length },
+      { label: "prs", value: pullRequests.value.length },
+    ];
+
+    if (indexedProfileSummary.value?.followerCount != null) {
+      values.splice(1, 0, { label: "followers", value: indexedProfileSummary.value.followerCount });
+    }
+
+    values.splice(indexedProfileSummary.value?.followerCount != null ? 2 : 1, 0, {
+      label: "following",
+      value: indexedProfileSummary.value?.followingCount ?? following.value.length,
+    });
+
+    return values;
+  });
+
+  function handleSignIn() {
+    router.push("/login");
+  }
+
+  async function handleLogout() {
+    const alert = await alertController.create({
+      header: "Sign Out",
+      message: "Are you sure you want to sign out?",
+      buttons: [
+        { text: "Cancel", role: "cancel" },
+        {
+          text: "Sign Out",
+          role: "destructive",
+          handler: async () => {
+            await authStore.logout();
+            const toast = await toastController.create({
+              message: "Signed out successfully",
+              duration: 2000,
+              color: "success",
+            });
+            await toast.present();
+          },
+        },
+      ],
+    });
+    await alert.present();
+  }
+
+  function goToSettings() {
+    router.push("/tabs/settings");
+  }
+
+  async function switchToAccount(did: `did:${string}:${string}`) {
+    if (did === authStore.did) return;
+
+    const success = await authStore.switchAccount(did);
+    if (!success) {
+      const toast = await toastController.create({
+        message: "Failed to switch account",
+        duration: 2000,
+        color: "danger",
+      });
+      await toast.present();
+    }
+  }
+
+  function navigateToRepo(repo: RepoSummary) {
+    router.push(`/tabs/home/repo/${repo.ownerHandle}/${repo.name}`);
+  }
 
-function handleSignIn() {
-  // TODO: AT Protocol OAuth flow
-}
+  function navigateToUser(handle: string) {
+    router.push(`/tabs/home/user/${handle}`);
+  }
+
+  function navigateToIssue(issue: IssueSummary) {
+    const repoName = repos.value.find((r) => r.atUri === issue.repoAtUri)?.name;
+    if (!repoName) return;
+    router.push(`/tabs/home/repo/${profile.value?.handle ?? identifier.value}/${repoName}/issues/${issue.rkey}`);
+  }
+
+  function navigateToPullRequest(pr: PullRequestSummary) {
+    const repoName = repos.value.find((r) => r.atUri === pr.targetRepoAtUri)?.name;
+    if (!repoName) return;
+    router.push(`/tabs/home/repo/${profile.value?.handle ?? identifier.value}/${repoName}/pulls/${pr.rkey}`);
+  }
+
+  function displayLink(url: string): string {
+    return url.trim().replace(/^[a-z]+:\/\//i, "");
+  }
+
+  const PALETTE = ["#22d3ee", "#a78bfa", "#34d399", "#fbbf24", "#f87171", "#fb923c", "#60a5fa"];
+
+  function avatarColor(h: string): string {
+    let hash = 0;
+    for (const ch of h) hash = (hash * 31 + ch.charCodeAt(0)) & 0xffffffff;
+    return PALETTE[Math.abs(hash) % PALETTE.length];
+  }
+
+  function initials(h: string): string {
+    return h.split(".")[0].slice(0, 2).toUpperCase();
+  }
 </script>
 
 <style scoped>
-.signin-container {
-  display: flex;
-  flex-direction: column;
-  align-items: center;
-  justify-content: center;
-  min-height: 70vh;
-  padding: 32px 28px;
-  text-align: center;
-  gap: 14px;
-}
-
-.brand-icon {
-  width: 72px;
-  height: 72px;
-  border-radius: var(--t-radius-lg);
-  background: var(--t-accent-dim);
-  border: 1px solid var(--t-border-strong);
-  display: flex;
-  align-items: center;
-  justify-content: center;
-  font-size: 30px;
-  color: var(--t-accent);
-  margin-bottom: 4px;
-}
-
-.signin-title {
-  font-size: 22px;
-  font-weight: 700;
-  color: var(--t-text-primary);
-  margin: 0;
-  line-height: 1.2;
-}
-
-.signin-subtitle {
-  font-size: 14px;
-  color: var(--t-text-secondary);
-  margin: 0;
-  line-height: 1.55;
-  max-width: 280px;
-}
-
-.signin-btn {
-  --background: var(--t-accent);
-  --background-activated: var(--t-accent);
-  --color: #0d1117;
-  --border-radius: var(--t-radius-md);
-  width: 100%;
-  max-width: 320px;
-  font-weight: 600;
-  font-size: 15px;
-  margin-top: 6px;
-}
-
-.signin-hint {
-  font-size: 13px;
-  color: var(--t-text-muted);
-  margin: 4px 0 0;
-}
-
-.signin-link {
-  color: var(--t-accent);
-  cursor: pointer;
-}
+  .profile-title {
+    font-family: var(--t-mono);
+    font-size: 14px;
+  }
+
+  .mono {
+    font-family: var(--t-mono);
+  }
+
+  .profile-header {
+    display: flex;
+    align-items: center;
+    gap: 16px;
+    padding: 20px 16px 12px;
+  }
+
+  .avatar {
+    width: 64px;
+    height: 64px;
+    flex-shrink: 0;
+    border-radius: var(--t-radius-md);
+    overflow: hidden;
+  }
+
+  .avatar-image {
+    width: 100%;
+    height: 100%;
+    object-fit: cover;
+    display: block;
+  }
+
+  .avatar-fallback {
+    width: 100%;
+    height: 100%;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-family: var(--t-mono);
+    font-size: 18px;
+    font-weight: 700;
+    color: #0d1117;
+  }
+
+  .profile-info {
+    flex: 1;
+    min-width: 0;
+  }
+
+  .profile-handle {
+    font-family: var(--t-mono);
+    font-size: 15px;
+    font-weight: 600;
+    color: var(--t-accent);
+    line-height: 1.3;
+  }
+
+  .profile-name {
+    font-size: 14px;
+    font-weight: 500;
+    color: var(--t-text-primary);
+    margin-top: 2px;
+  }
+
+  .profile-bio {
+    font-size: 14px;
+    color: var(--t-text-secondary);
+    line-height: 1.55;
+    padding: 0 16px 12px;
+  }
+
+  .profile-meta {
+    display: flex;
+    flex-wrap: wrap;
+    gap: 12px;
+    padding: 0 16px 12px;
+  }
+
+  .meta-item {
+    display: flex;
+    align-items: center;
+    gap: 5px;
+    font-size: 13px;
+    color: var(--t-text-muted);
+  }
+
+  .meta-icon {
+    font-size: 14px;
+  }
+
+  .profile-links {
+    display: flex;
+    flex-direction: column;
+    gap: 6px;
+    padding: 0 16px 14px;
+  }
+
+  .profile-link {
+    display: flex;
+    align-items: center;
+    gap: 6px;
+    font-size: 13px;
+    color: var(--t-accent);
+    text-decoration: none;
+  }
+
+  .link-icon {
+    font-size: 14px;
+    flex-shrink: 0;
+  }
+
+  .stats-row {
+    display: flex;
+    gap: 8px;
+    padding: 0 16px 16px;
+    overflow-x: auto;
+    scrollbar-width: none;
+  }
+
+  .stats-row::-webkit-scrollbar {
+    display: none;
+  }
+
+  .stat-pill {
+    display: inline-flex;
+    align-items: baseline;
+    gap: 6px;
+    padding: 10px 12px;
+    border-radius: 999px;
+    border: 1px solid var(--t-border);
+    background: var(--t-surface-raised);
+    flex-shrink: 0;
+  }
+
+  .stat-value {
+    font-family: var(--t-mono);
+    font-size: 12px;
+    font-weight: 700;
+    color: var(--t-text-primary);
+  }
+
+  .stat-label {
+    font-size: 12px;
+    color: var(--t-text-muted);
+    text-transform: lowercase;
+  }
+
+  .profile-segment {
+    padding: 0 12px 8px;
+  }
+
+  .section-label {
+    font-size: 11px;
+    font-weight: 600;
+    text-transform: uppercase;
+    letter-spacing: 0.07em;
+    color: var(--t-text-muted);
+    margin: 16px 16px 8px;
+  }
+
+  .account-list {
+    padding: 0 16px;
+    margin-top: 24px;
+  }
+
+  .signin-container {
+    display: flex;
+    flex-direction: column;
+    align-items: center;
+    justify-content: center;
+    min-height: 70vh;
+    padding: 32px 28px;
+    text-align: center;
+    gap: 14px;
+  }
+
+  .brand-icon {
+    width: 72px;
+    height: 72px;
+    border-radius: var(--t-radius-lg);
+    background: var(--t-accent-dim);
+    border: 1px solid var(--t-border-strong);
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    font-size: 30px;
+    color: var(--t-accent);
+    margin-bottom: 4px;
+  }
+
+  .signin-title {
+    font-size: 22px;
+    font-weight: 700;
+    color: var(--t-text-primary);
+    margin: 0;
+    line-height: 1.2;
+  }
+
+  .signin-subtitle {
+    font-size: 14px;
+    color: var(--t-text-secondary);
+    margin: 0;
+    line-height: 1.55;
+    max-width: 280px;
+  }
+
+  .signin-btn {
+    --background: var(--t-accent);
+    --background-activated: var(--t-accent);
+    --color: #0d1117;
+    --border-radius: var(--t-radius-md);
+    width: 100%;
+    max-width: 320px;
+    font-weight: 600;
+    font-size: 15px;
+    margin-top: 6px;
+  }
+
+  .signin-hint {
+    font-size: 13px;
+    color: var(--t-text-muted);
+    margin: 4px 0 0;
+  }
+
+  .signin-hint a {
+    color: var(--t-accent);
+    text-decoration: none;
+  }
 </style>
diff --git a/apps/twisted/src/main.ts b/apps/twisted/src/main.ts
index 67d6d94..602ad61 100644
--- a/apps/twisted/src/main.ts
+++ b/apps/twisted/src/main.ts
@@ -9,6 +9,7 @@ import { queryClient } from "./core/query/client.js";
 import { persistQueryClient } from "@tanstack/query-persist-client-core";
 import { createIdbPersister } from "./core/query/persister.js";
 import { initializeThemePreference } from "./core/theme/preferences.js";
+import { useAuthStore } from "./core/auth/store.js";
 
 import "@ionic/vue/css/core.css";
 import "@ionic/vue/css/normalize.css";
@@ -42,8 +43,13 @@ if (import.meta.env.DEV) {
   persistQueryClient({ queryClient: queryClient as any, persister: createIdbPersister(), maxAge: 30 * 60 * 1000 });
 }
 
-const app = createApp(App).use(IonicVue).use(router).use(createPinia()).use(VueQueryPlugin, { queryClient });
+const pinia = createPinia();
+const app = createApp(App).use(IonicVue).use(router).use(pinia).use(VueQueryPlugin, { queryClient });
 
-router.isReady().then(() => {
+const authStore = useAuthStore(pinia);
+authStore.initialize();
+
+router.isReady().then(async () => {
+  await authStore.restoreSession();
   app.mount("#app");
 });
diff --git a/apps/twisted/vite.config.ts b/apps/twisted/vite.config.ts
index 1f3a26e..0e3d34c 100644
--- a/apps/twisted/vite.config.ts
+++ b/apps/twisted/vite.config.ts
@@ -9,5 +9,6 @@ import { defineConfig } from "vite";
 export default defineConfig({
   plugins: [vue(), legacy()],
   resolve: { alias: { "@": path.resolve(__dirname, "./src") } },
+  server: { host: "127.0.0.1", port: 5173 },
   test: { globals: true, environment: "jsdom", watch: false, ui: false },
 });
diff --git a/docs/roadmap.md b/docs/roadmap.md
index 8ca520e..4d323eb 100644
--- a/docs/roadmap.md
+++ b/docs/roadmap.md
@@ -67,11 +67,11 @@ Bluesky OAuth and authenticated actions.
 
 **Depends on:** App: Search & Discovery (for Constellation service), API: Constellation Integration
 
-- [ ] OAuth setup with `@atcute/oauth-browser-client`
-- [ ] Login page, OAuth flow, callback handling
-- [ ] Capacitor deep link configuration
-- [ ] Session management (restore, refresh, logout, account switcher)
-- [ ] Auth-aware XRPC client using dpopFetch
+- [x] OAuth setup with `@atcute/oauth-browser-client`
+- [x] Login page, OAuth flow, callback handling
+- [x] Capacitor deep link configuration
+- [x] Session management (restore, refresh, logout, account switcher)
+- [x] Auth-aware XRPC client using dpopFetch
 - [ ] Star repos (write to PDS, count from Constellation)
 - [ ] Follow users (write to PDS, count from Constellation)
 - [ ] React to content (write to PDS, count from Constellation)
diff --git a/packages/api/.env.example b/packages/api/.env.example
index 7447a37..cd33e11 100644
--- a/packages/api/.env.example
+++ b/packages/api/.env.example
@@ -25,3 +25,8 @@ LOG_LEVEL=info
 LOG_FORMAT=json
 ENABLE_ADMIN_ENDPOINTS=false
 # ADMIN_AUTH_TOKEN=
+
+# OAuth client configuration for the Twisted mobile app
+# VITE_OAUTH_CLIENT_ID must be a publicly accessible URL (use a tunnel for local dev)
+# OAUTH_CLIENT_ID=https://your-tunnel.example.com/oauth/client-metadata.json
+# OAUTH_REDIRECT_URIS=http://127.0.0.1:5173/oauth-callback,io.ionic.starter://oauth-callback
diff --git a/packages/api/internal/api/api.go b/packages/api/internal/api/api.go
index 9328588..1b22706 100644
--- a/packages/api/internal/api/api.go
+++ b/packages/api/internal/api/api.go
@@ -48,6 +48,7 @@ func (s *Server) Handler() http.Handler {
 
 	mux.HandleFunc("GET /healthz", s.handleHealthz)
 	mux.HandleFunc("GET /readyz", s.handleReadyz)
+	mux.HandleFunc("GET /oauth/client-metadata.json", s.handleOAuthClientMetadata)
 	mux.HandleFunc("GET /search", s.handleSearch)
 	mux.HandleFunc("GET /search/keyword", s.handleSearchKeyword)
 	mux.HandleFunc("GET /search/semantic", s.handleNotImplemented)
diff --git a/packages/api/internal/api/oauth.go b/packages/api/internal/api/oauth.go
new file mode 100644
index 0000000..116ff46
--- /dev/null
+++ b/packages/api/internal/api/oauth.go
@@ -0,0 +1,48 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+)
+
+type OAuthClientMetadata struct {
+	ClientID                      string   `json:"client_id"`
+	ClientName                    string   `json:"client_name"`
+	ClientURI                     string   `json:"client_uri,omitempty"`
+	LogoURI                       string   `json:"logo_uri,omitempty"`
+	TosURI                        string   `json:"tos_uri,omitempty"`
+	PolicyURI                     string   `json:"policy_uri,omitempty"`
+	RedirectURIs                  []string `json:"redirect_uris"`
+	Scope                         string   `json:"scope"`
+	GrantTypes                    []string `json:"grant_types"`
+	ResponseTypes                 []string `json:"response_types"`
+	ApplicationType               string   `json:"application_type"`
+	DpopBoundAccessTokens         bool     `json:"dpop_bound_access_tokens"`
+	TokenEndpointAuthMethod       string   `json:"token_endpoint_auth_method"`
+	DpopSigningAlgValuesSupported []string `json:"dpop_signing_alg_values_supported,omitempty"`
+}
+
+func (s *Server) handleOAuthClientMetadata(w http.ResponseWriter, r *http.Request) {
+	if s.cfg.OAuthClientID == "" {
+		writeJSON(w, http.StatusNotFound, errorBody("not_configured", "OAuth is not configured on this server"))
+		return
+	}
+
+	metadata := OAuthClientMetadata{
+		ClientID:                      s.cfg.OAuthClientID,
+		ClientName:                    "Twisted",
+		ClientURI:                     s.cfg.OAuthClientID,
+		RedirectURIs:                  s.cfg.OAuthRedirectURIs,
+		Scope:                         "atproto",
+		GrantTypes:                    []string{"authorization_code", "refresh_token"},
+		ResponseTypes:                 []string{"code"},
+		ApplicationType:               "native",
+		DpopBoundAccessTokens:         true,
+		TokenEndpointAuthMethod:       "none",
+		DpopSigningAlgValuesSupported: []string{"ES256"},
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Access-Control-Allow-Origin", "*")
+	_ = json.NewEncoder(w).Encode(metadata)
+}
diff --git a/packages/api/internal/config/config.go b/packages/api/internal/config/config.go
index d4dfb66..7c20947 100644
--- a/packages/api/internal/config/config.go
+++ b/packages/api/internal/config/config.go
@@ -12,27 +12,27 @@ import (
 )
 
 type Config struct {
-	TursoURL             string
-	TursoToken           string
-	TapURL               string
-	TapAuthPassword      string
-	IndexedCollections   string
-	SearchDefaultLimit   int
-	SearchMaxLimit       int
-	SearchDefaultMode    string
-	EmbeddingProvider    string
-	EmbeddingModel       string
-	EmbeddingAPIKey      string
-	EmbeddingAPIURL      string
-	EmbeddingDim         int
-	EmbeddingBatchSize   int
-	HybridKeywordWeight  float64
-	HybridSemanticWeight float64
-	HTTPBindAddr         string
-	IndexerHealthAddr    string
-	LogLevel             string
-	LogFormat            string
-	EnableAdminEndpoints    bool
+	TursoURL               string
+	TursoToken             string
+	TapURL                 string
+	TapAuthPassword        string
+	IndexedCollections     string
+	SearchDefaultLimit     int
+	SearchMaxLimit         int
+	SearchDefaultMode      string
+	EmbeddingProvider      string
+	EmbeddingModel         string
+	EmbeddingAPIKey        string
+	EmbeddingAPIURL        string
+	EmbeddingDim           int
+	EmbeddingBatchSize     int
+	HybridKeywordWeight    float64
+	HybridSemanticWeight   float64
+	HTTPBindAddr           string
+	IndexerHealthAddr      string
+	LogLevel               string
+	LogFormat              string
+	EnableAdminEndpoints   bool
 	AdminAuthToken         string
 	EnableIngestEnrichment bool
 	PLCDirectoryURL        string
@@ -42,6 +42,8 @@ type Config struct {
 	ConstellationUserAgent string
 	ConstellationTimeout   time.Duration
 	ConstellationCacheTTL  time.Duration
+	OAuthClientID          string
+	OAuthRedirectURIs      []string
 }
 
 type LoadOptions struct {
@@ -53,28 +55,28 @@ func Load(opts LoadOptions) (*Config, error) {
 	loadDotEnv()
 
 	cfg := &Config{
-		TursoURL:             os.Getenv("TURSO_DATABASE_URL"),
-		TursoToken:           os.Getenv("TURSO_AUTH_TOKEN"),
-		TapURL:               os.Getenv("TAP_URL"),
-		TapAuthPassword:      os.Getenv("TAP_AUTH_PASSWORD"),
-		IndexedCollections:   os.Getenv("INDEXED_COLLECTIONS"),
-		SearchDefaultMode:    envOrDefault("SEARCH_DEFAULT_MODE", "keyword"),
-		EmbeddingProvider:    os.Getenv("EMBEDDING_PROVIDER"),
-		EmbeddingModel:       os.Getenv("EMBEDDING_MODEL"),
-		EmbeddingAPIKey:      os.Getenv("EMBEDDING_API_KEY"),
-		EmbeddingAPIURL:      os.Getenv("EMBEDDING_API_URL"),
-		HTTPBindAddr:         envOrDefault("HTTP_BIND_ADDR", ":8080"),
-		IndexerHealthAddr:    envOrDefault("INDEXER_HEALTH_ADDR", ":9090"),
-		LogLevel:             envOrDefault("LOG_LEVEL", "info"),
-		LogFormat:            envOrDefault("LOG_FORMAT", "json"),
-		AdminAuthToken:       os.Getenv("ADMIN_AUTH_TOKEN"),
-		SearchDefaultLimit:   envInt("SEARCH_DEFAULT_LIMIT", 20),
-		SearchMaxLimit:       envInt("SEARCH_MAX_LIMIT", 100),
-		EmbeddingDim:         envInt("EMBEDDING_DIM", 768),
-		EmbeddingBatchSize:   envInt("EMBEDDING_BATCH_SIZE", 32),
-		HybridKeywordWeight:  envFloat("HYBRID_KEYWORD_WEIGHT", 0.65),
-		HybridSemanticWeight: envFloat("HYBRID_SEMANTIC_WEIGHT", 0.35),
-		EnableAdminEndpoints:    envBool("ENABLE_ADMIN_ENDPOINTS", false),
+		TursoURL:               os.Getenv("TURSO_DATABASE_URL"),
+		TursoToken:             os.Getenv("TURSO_AUTH_TOKEN"),
+		TapURL:                 os.Getenv("TAP_URL"),
+		TapAuthPassword:        os.Getenv("TAP_AUTH_PASSWORD"),
+		IndexedCollections:     os.Getenv("INDEXED_COLLECTIONS"),
+		SearchDefaultMode:      envOrDefault("SEARCH_DEFAULT_MODE", "keyword"),
+		EmbeddingProvider:      os.Getenv("EMBEDDING_PROVIDER"),
+		EmbeddingModel:         os.Getenv("EMBEDDING_MODEL"),
+		EmbeddingAPIKey:        os.Getenv("EMBEDDING_API_KEY"),
+		EmbeddingAPIURL:        os.Getenv("EMBEDDING_API_URL"),
+		HTTPBindAddr:           envOrDefault("HTTP_BIND_ADDR", ":8080"),
+		IndexerHealthAddr:      envOrDefault("INDEXER_HEALTH_ADDR", ":9090"),
+		LogLevel:               envOrDefault("LOG_LEVEL", "info"),
+		LogFormat:              envOrDefault("LOG_FORMAT", "json"),
+		AdminAuthToken:         os.Getenv("ADMIN_AUTH_TOKEN"),
+		SearchDefaultLimit:     envInt("SEARCH_DEFAULT_LIMIT", 20),
+		SearchMaxLimit:         envInt("SEARCH_MAX_LIMIT", 100),
+		EmbeddingDim:           envInt("EMBEDDING_DIM", 768),
+		EmbeddingBatchSize:     envInt("EMBEDDING_BATCH_SIZE", 32),
+		HybridKeywordWeight:    envFloat("HYBRID_KEYWORD_WEIGHT", 0.65),
+		HybridSemanticWeight:   envFloat("HYBRID_SEMANTIC_WEIGHT", 0.35),
+		EnableAdminEndpoints:   envBool("ENABLE_ADMIN_ENDPOINTS", false),
 		EnableIngestEnrichment: envBool("ENABLE_INGEST_ENRICHMENT", true),
 		PLCDirectoryURL:        envOrDefault("PLC_DIRECTORY_URL", "https://plc.directory"),
 		IdentityServiceURL:     envOrDefault("IDENTITY_SERVICE_URL", "https://public.api.bsky.app"),
@@ -83,6 +85,8 @@ func Load(opts LoadOptions) (*Config, error) {
 		ConstellationUserAgent: envOrDefault("CONSTELLATION_USER_AGENT", "twister/1.0 (https://tangled.sh; Owais <desertthunder.dev@gmail.com>)"),
 		ConstellationTimeout:   envDuration("CONSTELLATION_TIMEOUT", 10*time.Second),
 		ConstellationCacheTTL:  envDuration("CONSTELLATION_CACHE_TTL", 5*time.Minute),
+		OAuthClientID:          os.Getenv("OAUTH_CLIENT_ID"),
+		OAuthRedirectURIs:      envSlice("OAUTH_REDIRECT_URIS", nil),
 	}
 
 	if opts.Local {
@@ -200,3 +204,11 @@ func envBool(key string, def bool) bool {
 	}
 	return b
 }
+
+func envSlice(key string, def []string) []string {
+	v := os.Getenv(key)
+	if v == "" {
+		return def
+	}
+	return strings.Split(v, ",")
+}
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 2b1dddc..2e7db7b 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -16,6 +16,12 @@ importers:
       '@atcute/client':
         specifier: ^4.2.1
         version: 4.2.1
+      '@atcute/identity-resolver':
+        specifier: ^1.2.2
+        version: 1.2.2(@atcute/identity@1.1.4)
+      '@atcute/lexicons':
+        specifier: ^1.2.9
+        version: 1.2.9
       '@atcute/oauth-browser-client':
         specifier: ^3.0.0
         version: 3.0.0(@atcute/identity@1.1.4)