diff --git a/.gitignore b/.gitignore
index 574eed2..824b8de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,5 @@ node_modules/
 .DS_Store
 .env
 *.csv
-dist/
\ No newline at end of file
+dist/
+diff.txt
diff --git a/web/package.json b/web/package.json
index 7006a99..53eadad 100644
--- a/web/package.json
+++ b/web/package.json
@@ -1,7 +1,7 @@
 {
 	"name": "web",
 	"private": true,
-	"version": "0.1.1",
+	"version": "0.2.0",
 	"type": "module",
 	"scripts": {
 		"dev": "vite dev",
@@ -16,6 +16,7 @@
 	"dependencies": {
 		"@atproto/api": "^0.18.13",
 		"@atproto/common-web": "^0.4.12",
+		"@atproto/oauth-client-browser": "^0.3.41",
 		"@lucide/svelte": "^0.575.0"
 	},
 	"devDependencies": {
diff --git a/web/pnpm-lock.yaml b/web/pnpm-lock.yaml
index c317bbe..1e9015a 100644
--- a/web/pnpm-lock.yaml
+++ b/web/pnpm-lock.yaml
@@ -14,6 +14,9 @@ importers:
       '@atproto/common-web':
         specifier: ^0.4.12
         version: 0.4.17
+      '@atproto/oauth-client-browser':
+        specifier: ^0.3.41
+        version: 0.3.41
       '@lucide/svelte':
         specifier: ^0.575.0
         version: 0.575.0(svelte@5.53.5)
@@ -57,12 +60,45 @@ importers:
 
 packages:
 
+  '@atproto-labs/did-resolver@0.2.6':
+    resolution: {integrity: sha512-2K1bC04nI2fmgNcvof+yA28IhGlpWn2JKYlPa7To9JTKI45FINCGkQSGiL2nyXlyzDJJ34fZ1aq6/IRFIOIiqg==}
+
+  '@atproto-labs/fetch@0.2.3':
+    resolution: {integrity: sha512-NZtbJOCbxKUFRFKMpamT38PUQMY0hX0p7TG5AEYOPhZKZEP7dHZ1K2s1aB8MdVH0qxmqX7nQleNrrvLf09Zfdw==}
+
+  '@atproto-labs/handle-resolver@0.3.6':
+    resolution: {integrity: sha512-qnSTXvOBNj1EHhp2qTWSX8MS5q3AwYU5LKlt5fBvSbCjgmTr2j0URHCv+ydrwO55KvsojIkTMgeMOh4YuY4fCA==}
+
+  '@atproto-labs/identity-resolver@0.3.6':
+    resolution: {integrity: sha512-qoWqBDRobln0NR8L8dQjSp79E0chGkBhibEgxQa2f9WD+JbJdjQ0YvwwO5yeQn05pJoJmAwmI2wyJ45zjU7aWg==}
+
+  '@atproto-labs/pipe@0.1.1':
+    resolution: {integrity: sha512-hdNw2oUs2B6BN1lp+32pF7cp8EMKuIN5Qok2Vvv/aOpG/3tNSJ9YkvfI0k6Zd188LeDDYRUpYpxcoFIcGH/FNg==}
+
+  '@atproto-labs/simple-store-memory@0.1.4':
+    resolution: {integrity: sha512-3mKY4dP8I7yKPFj9VKpYyCRzGJOi5CEpOLPlRhoJyLmgs3J4RzDrjn323Oakjz2Aj2JzRU/AIvWRAZVhpYNJHw==}
+
+  '@atproto-labs/simple-store@0.3.0':
+    resolution: {integrity: sha512-nOb6ONKBRJHRlukW1sVawUkBqReLlLx6hT35VS3imaNPwiXDxLnTK7lxw3Lrl9k5yugSBDQAkZAq3MPTEFSUBQ==}
+
   '@atproto/api@0.18.21':
     resolution: {integrity: sha512-s35MIJerGT/pKe2xJtKKswqlIr/ola2r2iURBKBL0Mk1OKe6jP4YvTMh1N2d2PEANFzNNTbKoDaLfJPo2Uvc/w==}
 
   '@atproto/common-web@0.4.17':
     resolution: {integrity: sha512-sfxD8NGxyoxhxmM9EUshEFbWcJ3+JHEOZF4Quk6HsCh1UxpHBmLabT/vEsAkDWl+C/8U0ine0+c/gHyE/OZiQQ==}
 
+  '@atproto/did@0.3.0':
+    resolution: {integrity: sha512-raUPzUGegtW/6OxwCmM8bhZvuIMzxG5t9oWsth6Tp91Kb5fTnHV2h/KKNF1C82doeA4BdXCErTyg7ISwLbQkzA==}
+
+  '@atproto/jwk-jose@0.1.11':
+    resolution: {integrity: sha512-i4Fnr2sTBYmMmHXl7NJh8GrCH+tDQEVWrcDMDnV5DjJfkgT17wIqvojIw9SNbSL4Uf0OtfEv6AgG0A+mgh8b5Q==}
+
+  '@atproto/jwk-webcrypto@0.2.0':
+    resolution: {integrity: sha512-UmgRrrEAkWvxwhlwe30UmDOdTEFidlIzBC7C3cCbeJMcBN1x8B3KH+crXrsTqfWQBG58mXgt8wgSK3Kxs2LhFg==}
+
+  '@atproto/jwk@0.6.0':
+    resolution: {integrity: sha512-bDoJPvt7TrQVi/rBfBrSSpGykhtIriKxeYCYQTiPRKFfyRhbgpElF0wPXADjIswnbzZdOwbY63az4E/CFVT3Tw==}
+
   '@atproto/lex-data@0.0.12':
     resolution: {integrity: sha512-aekJudcK1p6sbTqUv2bJMJBAGZaOJS0mgDclpK3U6VuBREK/au4B6ffunBFWgrDfg0Vwj2JGyEA7E51WZkJcRw==}
 
@@ -72,6 +108,15 @@ packages:
   '@atproto/lexicon@0.6.1':
     resolution: {integrity: sha512-/vI1kVlY50Si+5MXpvOucelnYwb0UJ6Qto5mCp+7Q5C+Jtp+SoSykAPVvjVtTnQUH2vrKOFOwpb3C375vSKzXw==}
 
+  '@atproto/oauth-client-browser@0.3.41':
+    resolution: {integrity: sha512-4QTm8zPgm08vl53flrVmL+MS5IOhvWWctNZmEnPbvQ2t1ISw9Q5m815m2Sszi5ULMFjOqvT7lhKB7zQUn5gq5g==}
+
+  '@atproto/oauth-client@0.6.0':
+    resolution: {integrity: sha512-F7ZTKzFptXgyihMkd7QTdRSkrh4XqrS+qTw+V81k5Q6Bh3MB1L3ypvfSJ6v7SSUJa6XxoZYJTCahHC1e+ndE6Q==}
+
+  '@atproto/oauth-types@0.6.3':
+    resolution: {integrity: sha512-jdKuoPknJuh/WjI+mYk7agSbx9mNVMbS6Dr3k1z2YMY2oRiCQjxYBuo4MLKATbxj05nMQaZRWlHRUazoAu5Cng==}
+
   '@atproto/syntax@0.4.3':
     resolution: {integrity: sha512-YoZUz40YAJr5nPwvCDWgodEOlt5IftZqPJvA0JDWjuZKD8yXddTwSzXSaKQAzGOpuM+/A3uXRtPzJJqlScc+iA==}
 
@@ -769,6 +814,9 @@ packages:
     resolution: {integrity: sha512-U71cyTamuh1CRNCfpGY6to28lxvNwPG4Guz/EVjgf3Jmzv0vlDp1atT9eS5dDjMYHucpHbWns6Lwf3BKz6svdw==}
     engines: {node: '>= 0.6'}
 
+  core-js@3.48.0:
+    resolution: {integrity: sha512-zpEHTy1fjTMZCKLHUZoVeylt9XrzaIN2rbPXEt0k+q7JE5CkCZdo6bNq55bn24a69CH7ErAVLKijxJja4fw+UQ==}
+
   debug@4.4.3:
     resolution: {integrity: sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA==}
     engines: {node: '>=6.0'}
@@ -850,6 +898,9 @@ packages:
     resolution: {integrity: sha512-ekilCSN1jwRvIbgeg/57YFh8qQDNbwDb9xT/qu2DAHbFFZUicIl4ygVaAvzveMhMVr3LnpSKTNnwt8PoOfmKhQ==}
     hasBin: true
 
+  jose@5.10.0:
+    resolution: {integrity: sha512-s+3Al/p9g32Iq+oqXxkW//7jk2Vig6FF1CFqzVXoTUXt2qz89YWbL+OwS17NFYEvxC35n0FKeGO2LGYSxeM2Gg==}
+
   kleur@4.1.5:
     resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
     engines: {node: '>=6'}
@@ -927,6 +978,9 @@ packages:
   locate-character@3.0.0:
     resolution: {integrity: sha512-SW13ws7BjaeJ6p7Q6CO2nchbYEc3X3J6WrmTTDto7yMPqVSZTUyY5Tjbid+Ab8gLnATtygYtiDIJGQRRn2ZOiA==}
 
+  lru-cache@10.4.3:
+    resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
+
   lru-cache@11.2.6:
     resolution: {integrity: sha512-ESL2CrkS/2wTPfuend7Zhkzo2u0daGJ/A2VucJOgQ/C48S/zB8MMeMHSGKYpXhIjbPxfuezITkaBH1wqv00DDQ==}
     engines: {node: 20 || >=22}
@@ -969,7 +1023,7 @@ packages:
     resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
     engines: {node: 4.x || >=6.0.0}
     peerDependencies:
-      encoding: ^0.1.1
+      encoding: ^0.1.0
     peerDependenciesMeta:
       encoding:
         optional: true
@@ -1218,6 +1272,40 @@ packages:
 
 snapshots:
 
+  '@atproto-labs/did-resolver@0.2.6':
+    dependencies:
+      '@atproto-labs/fetch': 0.2.3
+      '@atproto-labs/pipe': 0.1.1
+      '@atproto-labs/simple-store': 0.3.0
+      '@atproto-labs/simple-store-memory': 0.1.4
+      '@atproto/did': 0.3.0
+      zod: 3.25.76
+
+  '@atproto-labs/fetch@0.2.3':
+    dependencies:
+      '@atproto-labs/pipe': 0.1.1
+
+  '@atproto-labs/handle-resolver@0.3.6':
+    dependencies:
+      '@atproto-labs/simple-store': 0.3.0
+      '@atproto-labs/simple-store-memory': 0.1.4
+      '@atproto/did': 0.3.0
+      zod: 3.25.76
+
+  '@atproto-labs/identity-resolver@0.3.6':
+    dependencies:
+      '@atproto-labs/did-resolver': 0.2.6
+      '@atproto-labs/handle-resolver': 0.3.6
+
+  '@atproto-labs/pipe@0.1.1': {}
+
+  '@atproto-labs/simple-store-memory@0.1.4':
+    dependencies:
+      '@atproto-labs/simple-store': 0.3.0
+      lru-cache: 10.4.3
+
+  '@atproto-labs/simple-store@0.3.0': {}
+
   '@atproto/api@0.18.21':
     dependencies:
       '@atproto/common-web': 0.4.17
@@ -1236,6 +1324,26 @@ snapshots:
       '@atproto/syntax': 0.4.3
       zod: 3.25.76
 
+  '@atproto/did@0.3.0':
+    dependencies:
+      zod: 3.25.76
+
+  '@atproto/jwk-jose@0.1.11':
+    dependencies:
+      '@atproto/jwk': 0.6.0
+      jose: 5.10.0
+
+  '@atproto/jwk-webcrypto@0.2.0':
+    dependencies:
+      '@atproto/jwk': 0.6.0
+      '@atproto/jwk-jose': 0.1.11
+      zod: 3.25.76
+
+  '@atproto/jwk@0.6.0':
+    dependencies:
+      multiformats: 9.9.0
+      zod: 3.25.76
+
   '@atproto/lex-data@0.0.12':
     dependencies:
       multiformats: 9.9.0
@@ -1256,6 +1364,40 @@ snapshots:
       multiformats: 9.9.0
       zod: 3.25.76
 
+  '@atproto/oauth-client-browser@0.3.41':
+    dependencies:
+      '@atproto-labs/did-resolver': 0.2.6
+      '@atproto-labs/handle-resolver': 0.3.6
+      '@atproto-labs/simple-store': 0.3.0
+      '@atproto/did': 0.3.0
+      '@atproto/jwk': 0.6.0
+      '@atproto/jwk-webcrypto': 0.2.0
+      '@atproto/oauth-client': 0.6.0
+      '@atproto/oauth-types': 0.6.3
+      core-js: 3.48.0
+
+  '@atproto/oauth-client@0.6.0':
+    dependencies:
+      '@atproto-labs/did-resolver': 0.2.6
+      '@atproto-labs/fetch': 0.2.3
+      '@atproto-labs/handle-resolver': 0.3.6
+      '@atproto-labs/identity-resolver': 0.3.6
+      '@atproto-labs/simple-store': 0.3.0
+      '@atproto-labs/simple-store-memory': 0.1.4
+      '@atproto/did': 0.3.0
+      '@atproto/jwk': 0.6.0
+      '@atproto/oauth-types': 0.6.3
+      '@atproto/xrpc': 0.7.7
+      core-js: 3.48.0
+      multiformats: 9.9.0
+      zod: 3.25.76
+
+  '@atproto/oauth-types@0.6.3':
+    dependencies:
+      '@atproto/did': 0.3.0
+      '@atproto/jwk': 0.6.0
+      zod: 3.25.76
+
   '@atproto/syntax@0.4.3':
     dependencies:
       tslib: 2.8.1
@@ -1732,6 +1874,8 @@ snapshots:
 
   cookie@0.6.0: {}
 
+  core-js@3.48.0: {}
+
   debug@4.4.3:
     dependencies:
       ms: 2.1.3
@@ -1845,6 +1989,8 @@ snapshots:
 
   jiti@2.6.1: {}
 
+  jose@5.10.0: {}
+
   kleur@4.1.5: {}
 
   lightningcss-android-arm64@1.31.1:
@@ -1898,6 +2044,8 @@ snapshots:
 
   locate-character@3.0.0: {}
 
+  lru-cache@10.4.3: {}
+
   lru-cache@11.2.6: {}
 
   magic-string@0.30.21:
diff --git a/web/pnpm-workspace.yaml b/web/pnpm-workspace.yaml
index efc037a..3e94409 100644
--- a/web/pnpm-workspace.yaml
+++ b/web/pnpm-workspace.yaml
@@ -1,2 +1,3 @@
 onlyBuiltDependencies:
+  - core-js
   - esbuild
diff --git a/web/src/lib/components/steps/AuthStep.svelte b/web/src/lib/components/steps/AuthStep.svelte
index 7cbab51..1b78863 100644
--- a/web/src/lib/components/steps/AuthStep.svelte
+++ b/web/src/lib/components/steps/AuthStep.svelte
@@ -1,16 +1,41 @@
 <script lang="ts">
   import { Eye, EyeOff } from '@lucide/svelte';
   import { login } from '$lib/core/auth.js';
-  import type { AtpAgent } from '@atproto/api';
+  import { signInWithOAuth } from '$lib/core/oauth.js';
+  import type { Agent } from '@atproto/api';
 
   let {
     onauth,
     onback,
   }: {
-    onauth: (agent: AtpAgent) => void;
+    onauth: (agent: Agent) => void;
     onback: () => void;
   } = $props();
 
+  // ─── tab ─────────────────────────────────────────────────────────────────────
+
+  let tab = $state<'oauth' | 'password'>('oauth');
+
+  // ─── OAuth state ─────────────────────────────────────────────────────────────
+
+  let oauthHandle  = $state('');
+  let oauthLoading = $state(false);
+  let oauthError   = $state<string | null>(null);
+
+  async function doOAuth() {
+    oauthError   = null;
+    oauthLoading = true;
+    try {
+      await signInWithOAuth(oauthHandle.trim());
+      // Never reached — signInWithOAuth redirects away.
+    } catch (err: any) {
+      oauthError   = err.message ?? 'OAuth sign-in failed';
+      oauthLoading = false;
+    }
+  }
+
+  // ─── App-password state ───────────────────────────────────────────────────────
+
   let handle      = $state('');
   let password    = $state('');
   let pdsOverride = $state('');
@@ -36,81 +61,173 @@
 <section class="card-section">
   <button class="back-btn" onclick={onback}>← Back</button>
   <h2 class="section-title">Sign in to ATProto</h2>
-  <p class="section-sub">
-    Use your Bluesky handle and an
-    <a href="https://bsky.app/settings/app-passwords" target="_blank" rel="noopener">app password</a>.
-  </p>
-
-  <div class="form">
-    <label class="field">
-      <span class="field-label">Handle</span>
-      <input
-        type="text"
-        bind:value={handle}
-        placeholder="you.bsky.social"
-        autocomplete="username"
-        spellcheck="false"
-      />
-    </label>
-
-    <label class="field">
-      <span class="field-label">App password</span>
-      <div class="password-wrap">
+
+  <div class="tabs">
+    <button class:active={tab === 'oauth'}    onclick={() => (tab = 'oauth')}>OAuth <span class="badge-tab">Recommended</span></button>
+    <button class:active={tab === 'password'} onclick={() => (tab = 'password')}>App password</button>
+  </div>
+
+  {#if tab === 'oauth'}
+    <p class="section-sub">
+      Sign in securely through your PDS — no password is ever shared with Malachite.
+    </p>
+
+    <div class="form">
+      <label class="field">
+        <span class="field-label">Handle</span>
         <input
-          type={showPassword ? 'text' : 'password'}
-          bind:value={password}
-          placeholder="xxxx-xxxx-xxxx-xxxx"
-          autocomplete="current-password"
+          type="text"
+          bind:value={oauthHandle}
+          placeholder="you.bsky.social"
+          autocomplete="username"
+          spellcheck="false"
+          onkeydown={(e) => e.key === 'Enter' && !oauthLoading && oauthHandle && doOAuth()}
         />
-        <button
-          class="pw-toggle"
-          onclick={() => (showPassword = !showPassword)}
-          type="button"
-          aria-label={showPassword ? 'Hide password' : 'Show password'}
-        >
-          {#if showPassword}<EyeOff size={14} />{:else}<Eye size={14} />{/if}
-        </button>
-      </div>
-    </label>
-
-    <button
-      class="expand-btn"
-      onclick={() => (showAdvanced = !showAdvanced)}
-      type="button"
-    >
-      {showAdvanced ? '▾' : '▸'} Advanced options
-    </button>
-
-    {#if showAdvanced}
+      </label>
+
+      {#if oauthError}
+        <div class="alert alert-error">{oauthError}</div>
+      {/if}
+
+      <button
+        class="btn-primary"
+        onclick={doOAuth}
+        disabled={oauthLoading || !oauthHandle}
+      >
+        {#if oauthLoading}<span class="spinner"></span> Redirecting…{:else}Continue with ATProto →{/if}
+      </button>
+
+      <p class="oauth-note">
+        You'll be sent to your PDS to approve access, then returned here automatically.
+      </p>
+    </div>
+
+  {:else}
+    <p class="section-sub">
+      Use your Bluesky handle and an
+      <a href="https://bsky.app/settings/app-passwords" target="_blank" rel="noopener">app password</a>.
+    </p>
+
+    <div class="form">
       <label class="field">
-        <span class="field-label">PDS URL override <span class="badge">optional</span></span>
+        <span class="field-label">Handle</span>
         <input
-          type="url"
-          bind:value={pdsOverride}
-          placeholder="https://your.pds.example"
+          type="text"
+          bind:value={handle}
+          placeholder="you.bsky.social"
+          autocomplete="username"
           spellcheck="false"
         />
-        <span class="field-hint">
-          Skip Slingshot identity resolution and connect directly to your PDS.
-        </span>
       </label>
-    {/if}
-
-    {#if authError}
-      <div class="alert alert-error">{authError}</div>
-    {/if}
-
-    <button
-      class="btn-primary"
-      onclick={doAuth}
-      disabled={authLoading || !handle || !password}
-    >
-      {#if authLoading}<span class="spinner"></span> Signing in…{:else}Sign in →{/if}
-    </button>
-  </div>
+
+      <label class="field">
+        <span class="field-label">App password</span>
+        <div class="password-wrap">
+          <input
+            type={showPassword ? 'text' : 'password'}
+            bind:value={password}
+            placeholder="xxxx-xxxx-xxxx-xxxx"
+            autocomplete="current-password"
+          />
+          <button
+            class="pw-toggle"
+            onclick={() => (showPassword = !showPassword)}
+            type="button"
+            aria-label={showPassword ? 'Hide password' : 'Show password'}
+          >
+            {#if showPassword}<EyeOff size={14} />{:else}<Eye size={14} />{/if}
+          </button>
+        </div>
+      </label>
+
+      <button
+        class="expand-btn"
+        onclick={() => (showAdvanced = !showAdvanced)}
+        type="button"
+      >
+        {showAdvanced ? '▾' : '▸'} Advanced options
+      </button>
+
+      {#if showAdvanced}
+        <label class="field">
+          <span class="field-label">PDS URL override <span class="badge">optional</span></span>
+          <input
+            type="url"
+            bind:value={pdsOverride}
+            placeholder="https://your.pds.example"
+            spellcheck="false"
+          />
+          <span class="field-hint">
+            Skip Slingshot identity resolution and connect directly to your PDS.
+          </span>
+        </label>
+      {/if}
+
+      {#if authError}
+        <div class="alert alert-error">{authError}</div>
+      {/if}
+
+      <button
+        class="btn-primary"
+        onclick={doAuth}
+        disabled={authLoading || !handle || !password}
+      >
+        {#if authLoading}<span class="spinner"></span> Signing in…{:else}Sign in →{/if}
+      </button>
+    </div>
+  {/if}
 </section>
 
 <style>
+  /* ── Tabs ─────────────────────────────────────────────────────────────────── */
+  .tabs {
+    display: flex;
+    gap: 0.5rem;
+    margin-bottom: 1.5rem;
+  }
+
+  .tabs button {
+    flex: 1;
+    display: flex;
+    align-items: center;
+    justify-content: center;
+    gap: 0.4rem;
+    padding: 0.55rem 0.75rem;
+    border-radius: 6px;
+    border: 1px solid var(--border);
+    background: var(--surface);
+    color: var(--muted);
+    cursor: pointer;
+    font-size: 0.85rem;
+    transition: border-color 0.15s, color 0.15s;
+  }
+
+  .tabs button.active {
+    border-color: var(--accent);
+    color: var(--text);
+  }
+
+  .badge-tab {
+    font-size: 0.65rem;
+    font-family: 'JetBrains Mono', monospace;
+    color: var(--accent);
+    background: color-mix(in srgb, var(--accent) 12%, transparent);
+    padding: 0.1rem 0.35rem;
+    border-radius: 3px;
+    text-transform: uppercase;
+    letter-spacing: 0.04em;
+  }
+
+  /* ── OAuth note ───────────────────────────────────────────────────────────── */
+  .oauth-note {
+    font-size: 0.775rem;
+    color: var(--muted);
+    text-align: center;
+    margin: 0;
+    line-height: 1.5;
+  }
+
+  /* ── Password field ───────────────────────────────────────────────────────── */
   .pw-toggle {
     position: absolute;
     right: 0.75rem;
diff --git a/web/src/lib/components/steps/OptionsStep.svelte b/web/src/lib/components/steps/OptionsStep.svelte
index 814cc15..d9ba39b 100644
--- a/web/src/lib/components/steps/OptionsStep.svelte
+++ b/web/src/lib/components/steps/OptionsStep.svelte
@@ -20,13 +20,13 @@
 
 <section class="card-section">
   <button class="back-btn" onclick={onback}>← Back</button>
-  <h2 class="section-title">Import options</h2>
+  <h2 class="section-title">{mode === 'deduplicate' ? 'Deduplication options' : 'Import options'}</h2>
 
   <div class="options">
     <div class="option-row">
       <div class="option-info">
         <span class="option-name">Dry run</span>
-        <span class="option-desc">Preview what would be imported without making changes</span>
+        <span class="option-desc">{mode === 'deduplicate' ? 'Preview duplicates that would be removed without making changes' : 'Preview what would be imported without making changes'}</span>
       </div>
       <button
         class="toggle"
@@ -82,7 +82,11 @@
   {/if}
 
   <button class="btn-primary" onclick={onstartimport}>
-    {dryRun ? 'Preview import →' : 'Start import →'}
+    {#if mode === 'deduplicate'}
+      {dryRun ? 'Preview duplicates →' : 'Start deduplication →'}
+    {:else}
+      {dryRun ? 'Preview import →' : 'Start import →'}
+    {/if}
   </button>
 </section>
 
diff --git a/web/src/lib/core/auth.ts b/web/src/lib/core/auth.ts
index 83995c8..ef471cc 100644
--- a/web/src/lib/core/auth.ts
+++ b/web/src/lib/core/auth.ts
@@ -3,7 +3,7 @@
  * No CLI prompts — credentials come from the web form.
  */
 
-import { AtpAgent } from '@atproto/api';
+import { Agent, AtpAgent } from '@atproto/api';
 import { SLINGSHOT_RESOLVER } from '../config.js';
 
 interface ResolvedIdentity {
@@ -29,7 +29,7 @@ export async function login(
   identifier: string,
   password: string,
   pdsOverride?: string
-): Promise<AtpAgent> {
+): Promise<Agent> {
   if (pdsOverride) {
     const agent = new AtpAgent({ service: pdsOverride });
     await agent.login({ identifier, password });
diff --git a/web/src/lib/core/import.ts b/web/src/lib/core/import.ts
index 9274659..90689ae 100644
--- a/web/src/lib/core/import.ts
+++ b/web/src/lib/core/import.ts
@@ -3,7 +3,7 @@
  * Handles all five ImportMode flows with progress + cancellation callbacks.
  */
 
-import type { AtpAgent } from '@atproto/api';
+import type { Agent } from '@atproto/api';
 import type { ImportMode, LogEntry, PlayRecord } from '../types.js';
 import { parseLastFmFile, convertToPlayRecord } from './csv.js';
 import { parseSpotifyFiles, convertSpotifyToPlayRecord } from './spotify.js';
@@ -38,7 +38,7 @@ export interface ImportCallbacks {
 }
 
 export async function runImport(
-  agent: AtpAgent,
+  agent: Agent,
   mode: ImportMode,
   lastfmFiles: File[],
   spotifyFiles: File[],
diff --git a/web/src/lib/core/oauth.ts b/web/src/lib/core/oauth.ts
new file mode 100644
index 0000000..9e8ee6f
--- /dev/null
+++ b/web/src/lib/core/oauth.ts
@@ -0,0 +1,66 @@
+/**
+ * ATProto OAuth client — browser-only.
+ * Wraps @atproto/oauth-client-browser for use across the app.
+ */
+
+import { BrowserOAuthClient } from '@atproto/oauth-client-browser';
+import { Agent } from '@atproto/api';
+
+// The loopback redirect_uri must use 127.0.0.1, not localhost — RFC 8252
+// explicitly disallows the localhost hostname in loopback redirect URIs.
+//
+// In dev, BrowserOAuthClient.load() calls atprotoLoopbackClientMetadata()
+// with our constructed client_id to generate virtual client metadata.
+// The client_id must be http://localhost with no path (query params are fine).
+//
+// In production, load() fetches the metadata from the https:// URL.
+const CLIENT_ID = import.meta.env.DEV
+  ? `http://localhost?${new URLSearchParams([
+      ['redirect_uri', 'http://127.0.0.1:5173/import'],
+      ['scope', 'atproto transition:generic'],
+    ])}`
+  : 'https://malachite.ewancroft.uk/client-metadata.json';
+
+// Singleton promise — BrowserOAuthClient.load() is async.
+let _client: Promise<BrowserOAuthClient> | null = null;
+
+function getClient(): Promise<BrowserOAuthClient> {
+  if (!_client) {
+    // load() accepts clientId and dispatches correctly:
+    //   http:  → atprotoLoopbackClientMetadata(clientId) for dev
+    //   https: → fetches the metadata document for production
+    _client = BrowserOAuthClient.load({
+      clientId: CLIENT_ID,
+      handleResolver: 'https://bsky.social',
+    });
+  }
+  return _client;
+}
+
+/**
+ * Call once on mount on the /import page.
+ * Processes any OAuth callback params in the URL and restores stored sessions.
+ * Returns `{ session, agent }` if a session is active, or `null` if the user
+ * still needs to sign in.
+ */
+/**
+ * Call once on mount on the /import page.
+ * Returns an Agent if a session was restored or a callback was processed,
+ * or null if the user still needs to sign in.
+ */
+export async function initOAuth(): Promise<Agent | null> {
+  const client = await getClient();
+  const result = await client.init();
+  if (!result) return null;
+  return new Agent(result.session);
+}
+
+/**
+ * Kicks off the OAuth sign-in flow for the given handle.
+ * Redirects the browser away — this never resolves normally.
+ */
+export async function signInWithOAuth(handle: string): Promise<never> {
+  const client = await getClient();
+  await client.signIn(handle, { scope: 'atproto transition:generic' });
+  throw new Error('redirect should have occurred');
+}
diff --git a/web/src/lib/core/publisher.ts b/web/src/lib/core/publisher.ts
index a8c1c03..454e459 100644
--- a/web/src/lib/core/publisher.ts
+++ b/web/src/lib/core/publisher.ts
@@ -4,7 +4,7 @@
  * Uses in-memory rate limiting and progress callbacks instead of console.log.
  */
 
-import type { AtpAgent } from '@atproto/api';
+import type { Agent } from '@atproto/api';
 import type { PlayRecord } from '../types.js';
 import { RECORD_TYPE, MAX_PDS_BATCH_SIZE, POINTS_PER_RECORD } from '../config.js';
 import { BrowserRateLimiter } from './rate-limiter.js';
@@ -53,7 +53,7 @@ function normalizeResponseHeaders(response: any): Record<string, string> {
 }
 
 export async function publishRecords(
-  agent: AtpAgent,
+  agent: Agent,
   records: PlayRecord[],
   dryRun: boolean,
   callbacks: PublisherCallbacks
@@ -127,7 +127,7 @@ export async function publishRecords(
 
     try {
       const response = await agent.com.atproto.repo.applyWrites(
-        { repo: agent.session?.did ?? '', writes: writes as any },
+        { repo: agent.did ?? '', writes: writes as any },
         { signal: ac.signal }
       );
 
diff --git a/web/src/lib/core/sync.ts b/web/src/lib/core/sync.ts
index 9a140b9..62544ad 100644
--- a/web/src/lib/core/sync.ts
+++ b/web/src/lib/core/sync.ts
@@ -3,7 +3,7 @@
  * Fetches existing records from ATProto and filters for new ones.
  */
 
-import type { AtpAgent } from '@atproto/api';
+import type { Agent } from '@atproto/api';
 import type { PlayRecord } from '../types.js';
 import { RECORD_TYPE } from '../config.js';
 
@@ -22,12 +22,12 @@ function recordKey(r: PlayRecord): string {
 const sessionCache = new Map<string, Map<string, ExistingRecord>>();
 
 export async function fetchExistingRecords(
-  agent: AtpAgent,
+  agent: Agent,
   onProgress?: (fetched: number) => void,
   forceRefresh = false,
   signal?: AbortSignal
 ): Promise<Map<string, ExistingRecord>> {
-  const did = agent.session?.did;
+  const did = agent.did;
   if (!did) throw new Error('No authenticated session');
 
   if (!forceRefresh && sessionCache.has(did)) {
@@ -73,11 +73,11 @@ export function filterNewRecords(
 }
 
 export async function fetchAllRecordsForDedup(
-  agent: AtpAgent,
+  agent: Agent,
   onProgress?: (fetched: number) => void,
   signal?: AbortSignal
 ): Promise<ExistingRecord[]> {
-  const did = agent.session?.did;
+  const did = agent.did;
   if (!did) throw new Error('No authenticated session');
 
   const all: ExistingRecord[] = [];
@@ -127,7 +127,7 @@ export function findDuplicateGroups(records: ExistingRecord[]): DedupGroup[] {
 }
 
 export async function removeDuplicateRecords(
-  agent: AtpAgent,
+  agent: Agent,
   groups: DedupGroup[],
   onProgress?: (removed: number) => void,
   signal?: AbortSignal
@@ -138,7 +138,7 @@ export async function removeDuplicateRecords(
       signal?.throwIfAborted();
       try {
         await agent.com.atproto.repo.deleteRecord(
-          { repo: agent.session?.did ?? '', collection: RECORD_TYPE, rkey: rec.uri.split('/').pop()! },
+          { repo: agent.did ?? '', collection: RECORD_TYPE, rkey: rec.uri.split('/').pop()! },
           { signal }
         );
         removed++;
diff --git a/web/src/routes/import/+page.svelte b/web/src/routes/import/+page.svelte
index ce2d783..6edff13 100644
--- a/web/src/routes/import/+page.svelte
+++ b/web/src/routes/import/+page.svelte
@@ -1,8 +1,10 @@
 <script lang="ts">
+  import { onMount } from 'svelte';
   import { fly } from 'svelte/transition';
   import { cubicOut } from 'svelte/easing';
-  import type { AtpAgent } from '@atproto/api';
+  import type { Agent } from '@atproto/api';
 
+  import { initOAuth } from '$lib/core/oauth.js';
   import { modeNeeds, stepLabelsFor } from '$lib/modes.js';
   import { runImport, type PublishProgress } from '$lib/core/import.js';
   import type { ImportMode, LogEntry } from '$lib/types.js';
@@ -14,13 +16,23 @@
   import OptionsStep   from '$lib/components/steps/OptionsStep.svelte';
   import RunStep       from '$lib/components/steps/RunStep.svelte';
 
+  // ─── persistence keys ────────────────────────────────────────────────────────
+
+  const KEY_MODE = 'malachite:mode';
+  const KEY_STEP = 'malachite:step';
+
   // ─── wizard state ────────────────────────────────────────────────────────────
+  // Read synchronously from sessionStorage — safe because ssr = false.
+  // This eliminates FOUC: the component renders immediately into the right step.
+
+  const _initMode = sessionStorage.getItem(KEY_MODE) as ImportMode | null;
+  const _initStep = Number(sessionStorage.getItem(KEY_STEP)) || 0;
 
-  let step     = $state(0);
-  let prevStep = $state(0);
-  let mode     = $state<ImportMode | null>(null);
+  let step     = $state(_initStep);
+  let prevStep = $state(_initStep);
+  let mode     = $state<ImportMode | null>(_initMode);
 
-  let agent        = $state<AtpAgent | null>(null);
+  let agent        = $state<Agent | null>(null);
   let lastfmFiles  = $state<File[]>([]);
   let spotifyFiles = $state<File[]>([]);
 
@@ -48,16 +60,24 @@
 
   // ─── navigation ──────────────────────────────────────────────────────────────
 
-  function goTo(n: number) { prevStep = step; step = n; }
+  function goTo(n: number) {
+    prevStep = step;
+    step = n;
+    sessionStorage.setItem(KEY_STEP, String(n));
+  }
 
-  function handleSelectMode(m: ImportMode) { mode = m; goTo(1); }
+  function handleSelectMode(m: ImportMode) {
+    mode = m;
+    sessionStorage.setItem(KEY_MODE, m);
+    goTo(1);
+  }
 
   function handleBack() {
     if (step === 3 && mode === 'deduplicate') { goTo(1); return; }
     goTo(Math.max(0, step - 1));
   }
 
-  function handleAuth(a: AtpAgent) {
+  function handleAuth(a: Agent) {
     agent = a;
     goTo(needs.files ? 2 : 3);
   }
@@ -107,7 +127,27 @@
     }
   }
 
+  // ─── OAuth callback ────────────────────────────────────────────────────────
+
+  onMount(async () => {
+    // If the URL contains an OAuth callback (?code=…&state=…), init() processes
+    // it and returns the new session. If a session was already stored from a
+    // previous visit it also comes back here.
+    try {
+      const oauthAgent = await initOAuth();
+      if (oauthAgent) {
+        agent = oauthAgent;
+        // mode is already restored synchronously from sessionStorage above.
+        goTo(modeNeeds(mode).files ? 2 : 3);
+      }
+    } catch (err: any) {
+      console.error('OAuth init error:', err);
+    }
+  });
+
   function handleReset() {
+    sessionStorage.removeItem(KEY_MODE);
+    sessionStorage.removeItem(KEY_STEP);
     prevStep = step; step = 0; mode = null; agent = null;
     lastfmFiles = []; spotifyFiles = [];
     dryRun = false; reverseOrder = false; fresh = false;
diff --git a/web/static/client-metadata.json b/web/static/client-metadata.json
new file mode 100644
index 0000000..692d583
--- /dev/null
+++ b/web/static/client-metadata.json
@@ -0,0 +1,15 @@
+{
+  "client_id": "https://malachite.ewancroft.uk/client-metadata.json",
+  "client_name": "Malachite",
+  "client_uri": "https://malachite.ewancroft.uk",
+  "logo_uri": "https://malachite.ewancroft.uk/favicon.png",
+  "tos_uri": "https://malachite.ewancroft.uk/about",
+  "policy_uri": "https://malachite.ewancroft.uk/about",
+  "redirect_uris": ["https://malachite.ewancroft.uk/import"],
+  "grant_types": ["authorization_code", "refresh_token"],
+  "response_types": ["code"],
+  "scope": "atproto transition:generic",
+  "application_type": "web",
+  "token_endpoint_auth_method": "none",
+  "dpop_bound_access_tokens": true
+}