diff --git a/apps/example-sender/src/lib/config.ts b/apps/example-sender/src/lib/config.ts
index fae4c34..ae7d51b 100644
--- a/apps/example-sender/src/lib/config.ts
+++ b/apps/example-sender/src/lib/config.ts
@@ -19,15 +19,36 @@ export const APP_DESCRIPTION = 'Demo of how to integrate with atmo.pub.';
 export const RELAY_ORIGIN = dev ? 'http://localhost:8787' : 'https://relay.atmo.pub';
 export const RELAY_DID = 'did:web:relay.atmo.pub';
 
-/** The web dashboard where users approve apps + link Telegram (note: no "s"). */
-export const DASHBOARD_ORIGIN = 'https://atmo.pub';
+/**
+ * The web dashboard where users approve apps + link Telegram. In dev the webapp
+ * runs on Vite's default 5173, so cross-app login links point there.
+ */
+export const DASHBOARD_ORIGIN = dev ? 'http://localhost:5173' : 'https://atmo.pub';
+
+/** lxm for cross-app login (a convention NSID, not a published lexicon). */
+export const APPLOGIN_LXM = 'pub.atmo.auth';
 
 /**
- * OAuth scope: the sender app only needs `requestPermission` via the user's
- * session (`send` uses this app's own DID key, not the user's OAuth). Requested
- * as an individual `rpc` scope.
+ * OAuth scope. Each `rpc?lxm=…` entry lets this app mint a user service-auth
+ * token (via `com.atproto.server.getServiceAuth`) for that method:
+ *   - `requestPermission` — ask the user for notify permission.
+ *   - `pub.atmo.auth` — one-time login token to jump into atmo.pub signed in.
+ *   - `setRouting`/`getRouting`/`listNotifications`/`markRead` — the dual-auth
+ *     methods, where this user token rides in the body alongside our own app JWT.
+ * `send` is NOT here — it uses this app's own DID key, not the user's OAuth.
+ *
+ * Changing this scope means already-signed-in users must sign out and back in
+ * before the new tokens can be minted.
  */
-export const OAUTH_SCOPE = 'atproto rpc?lxm=pub.atmo.notify.requestPermission&aud=*';
+export const OAUTH_SCOPE = [
+	'atproto',
+	'rpc?lxm=pub.atmo.notify.requestPermission&aud=*',
+	'rpc?lxm=pub.atmo.auth&aud=*',
+	'rpc?lxm=pub.atmo.notify.setRouting&aud=*',
+	'rpc?lxm=pub.atmo.notify.getRouting&aud=*',
+	'rpc?lxm=pub.atmo.notify.listNotifications&aud=*',
+	'rpc?lxm=pub.atmo.notify.markRead&aud=*'
+].join(' ');
 
 /** Branding. */
 export const PROJECT_NAME = 'atmo.pub · example sender';
diff --git a/apps/example-sender/src/lib/relay.remote.ts b/apps/example-sender/src/lib/relay.remote.ts
index 44b342e..c28d76b 100644
--- a/apps/example-sender/src/lib/relay.remote.ts
+++ b/apps/example-sender/src/lib/relay.remote.ts
@@ -1,18 +1,36 @@
 // Remote command functions the page calls. requestNotifications goes through the
-// user's OAuth session; sendTest signs with this app's own key.
+// user's OAuth session; sendTest signs with this app's own key; the routing/inbox
+// commands carry both tokens (dual-auth).
 import { command, getRequestEvent } from '$app/server';
 import { error } from '@sveltejs/kit';
 import * as v from 'valibot';
 
 import { APP_DOMAIN } from '$lib/config';
-import { requestPermissionForUser, sendAsSender } from '$lib/server/relay';
+import {
+	getRoutingForUser,
+	listNotificationsForUser,
+	markAllReadForUser,
+	mintAppLoginUrl,
+	requestPermissionForUser,
+	sendAsSender,
+	setRoutingForUser
+} from '$lib/server/relay';
+import type { AppRoute, NotificationView, RoutingView } from '$lib/types';
 
-export const requestNotifications = command(async () => {
+/** The user's OAuth client, or a 401 if they're not signed in. */
+function requireClient() {
 	const { locals } = getRequestEvent();
 	if (!locals.client) {
 		error(401, 'Not signed in');
 	}
-	return requestPermissionForUser(locals.client);
+	return locals.client;
+}
+
+export const requestNotifications = command(() => requestPermissionForUser(requireClient()));
+
+/** Build a one-time link that signs the user into atmo.pub (cross-app login). */
+export const openInAtmo = command(async (): Promise<{ url: string }> => {
+	return { url: await mintAppLoginUrl(requireClient()) };
 });
 
 export type SendResult =
@@ -43,3 +61,22 @@ export const sendTest = command(
 		}
 	}
 );
+
+// --- Dual-auth: manage this app's own routing + inbox for the signed-in user ---
+
+export const getRouting = command((): Promise<RoutingView> => getRoutingForUser(requireClient()));
+
+export const setRouting = command(
+	v.object({ route: v.picklist(['push', 'telegram', 'push+telegram', 'off', 'default']) }),
+	({ route }): Promise<{ ok: boolean }> =>
+		setRoutingForUser(requireClient(), { route: route as AppRoute })
+);
+
+export const listNotifications = command(
+	(): Promise<{ notifications: NotificationView[]; cursor?: string }> =>
+		listNotificationsForUser(requireClient(), { limit: 25 })
+);
+
+export const markAllRead = command((): Promise<{ marked: number }> =>
+	markAllReadForUser(requireClient())
+);
diff --git a/apps/example-sender/src/lib/server/relay.ts b/apps/example-sender/src/lib/server/relay.ts
index 2076b6e..ffe6f37 100644
--- a/apps/example-sender/src/lib/server/relay.ts
+++ b/apps/example-sender/src/lib/server/relay.ts
@@ -1,10 +1,20 @@
 // The actual relay calls. Each endpoint uses a different auth path:
-//   requestPermission → user-OAuth (a JWT minted by the user's PDS)
-//   send              → sender-DID (a JWT signed by this app's own key)
+//   requestPermission                 → user-OAuth (JWT minted by the user's PDS)
+//   send                              → sender-DID (JWT signed by this app's key)
+//   setRouting/getRouting/list…/mark… → dual-auth (BOTH of the above per call)
 import '@atcute/atproto'; // ambient com.atproto.* types (getServiceAuth)
 import type { Did, Nsid } from '@atcute/lexicons';
 
-import { APP_DESCRIPTION, APP_TITLE, RELAY_DID, RELAY_ORIGIN, SENDER_DID } from '$lib/config';
+import {
+	APP_DESCRIPTION,
+	APP_TITLE,
+	APPLOGIN_LXM,
+	DASHBOARD_ORIGIN,
+	RELAY_DID,
+	RELAY_ORIGIN,
+	SENDER_DID
+} from '$lib/config';
+import type { AppRoute, CategoryRoute, NotificationView, RoutingView } from '$lib/types';
 
 import { mintSenderJwt } from './sender-auth';
 
@@ -33,6 +43,22 @@ async function postRelay(jwt: string, lxm: string, body: object): Promise<unknow
 	return data;
 }
 
+/**
+ * Mint a *user* service-auth JWT on the user's PDS, scoped to `lxm` and
+ * addressed to the relay. This is the user's proof-of-consent token — used on
+ * its own by `requestPermission`, and in the body alongside our app JWT by the
+ * dual-auth methods.
+ */
+async function mintUserToken(client: NonNullable<AppClient>, lxm: string): Promise<string> {
+	const auth = await client.get('com.atproto.server.getServiceAuth', {
+		params: { aud: RELAY_DID as Did, lxm: lxm as Nsid }
+	});
+	if (!auth.ok) {
+		throw new Error('Failed to mint a service-auth token from your PDS');
+	}
+	return auth.data.token;
+}
+
 /**
  * User-OAuth path. Mint a service-auth JWT on the user's PDS (proves the user
  * authorized this request), then call `requestPermission` naming this app as the
@@ -42,19 +68,26 @@ export async function requestPermissionForUser(
 	client: NonNullable<AppClient>
 ): Promise<{ id: string; status: 'pending' | 'alreadyGranted' }> {
 	const lxm = 'pub.atmo.notify.requestPermission';
-	const auth = await client.get('com.atproto.server.getServiceAuth', {
-		params: { aud: RELAY_DID as Did, lxm: lxm as Nsid }
-	});
-	if (!auth.ok) {
-		throw new Error('Failed to mint a service-auth token from your PDS');
-	}
-	return postRelay(auth.data.token, lxm, {
+	const token = await mintUserToken(client, lxm);
+	return postRelay(token, lxm, {
 		senderDid: SENDER_DID,
 		title: APP_TITLE,
 		description: APP_DESCRIPTION
 	}) as Promise<{ id: string; status: 'pending' | 'alreadyGranted' }>;
 }
 
+/**
+ * Cross-app login. Mint a one-time `pub.atmo.auth` service-auth token on the
+ * user's PDS and build a link that drops them into atmo.pub already signed in,
+ * deep-linked to THIS app's settings page. No login form, no PDS round-trip on
+ * atmo.pub's side. See CROSS-APP-AUTH.md.
+ */
+export async function mintAppLoginUrl(client: NonNullable<AppClient>): Promise<string> {
+	const token = encodeURIComponent(await mintUserToken(client, APPLOGIN_LXM));
+	const redirect = `/apps/${SENDER_DID}`;
+	return `${DASHBOARD_ORIGIN}/applogin?token=${token}&redirect=${encodeURIComponent(redirect)}`;
+}
+
 /**
  * Sender-DID path. Sign with this app's own key (no user OAuth) and send a
  * notification to `recipient`.
@@ -69,3 +102,49 @@ export async function sendAsSender(input: {
 	const jwt = await mintSenderJwt(lxm);
 	return postRelay(jwt, lxm, input) as Promise<{ id: string; delivered: number }>;
 }
+
+/**
+ * Dual-auth path (setRouting / getRouting / listNotifications / markRead).
+ * Carries TWO service-auth tokens: this app's own in the Authorization header
+ * (proves which app), and a fresh user-issued one as `userToken` in the body
+ * (proves the user consented to this exact call). The relay verifies both and
+ * scopes the effect to (user, this app) — it can't touch the account default,
+ * other apps, or channels.
+ */
+async function dualAuthCall(
+	client: NonNullable<AppClient>,
+	lxm: string,
+	body: object = {}
+): Promise<unknown> {
+	const [userToken, appJwt] = await Promise.all([mintUserToken(client, lxm), mintSenderJwt(lxm)]);
+	return postRelay(appJwt, lxm, { userToken, ...body });
+}
+
+/** Read how this app's notifications are currently routed for the user. */
+export function getRoutingForUser(client: NonNullable<AppClient>): Promise<RoutingView> {
+	return dualAuthCall(client, 'pub.atmo.notify.getRouting') as Promise<RoutingView>;
+}
+
+/** Change how this app's notifications are routed for the user. */
+export function setRoutingForUser(
+	client: NonNullable<AppClient>,
+	input: { route?: AppRoute; categories?: { id: string; route: CategoryRoute }[] }
+): Promise<{ ok: boolean }> {
+	return dualAuthCall(client, 'pub.atmo.notify.setRouting', input) as Promise<{ ok: boolean }>;
+}
+
+/** List the notifications this app has sent the user (read state + delivery). */
+export function listNotificationsForUser(
+	client: NonNullable<AppClient>,
+	input: { limit?: number; cursor?: string } = {}
+): Promise<{ notifications: NotificationView[]; cursor?: string }> {
+	return dualAuthCall(client, 'pub.atmo.notify.listNotifications', input) as Promise<{
+		notifications: NotificationView[];
+		cursor?: string;
+	}>;
+}
+
+/** Mark all of this app's notifications to the user as read. */
+export function markAllReadForUser(client: NonNullable<AppClient>): Promise<{ marked: number }> {
+	return dualAuthCall(client, 'pub.atmo.notify.markRead') as Promise<{ marked: number }>;
+}
diff --git a/apps/example-sender/src/lib/types.ts b/apps/example-sender/src/lib/types.ts
new file mode 100644
index 0000000..8e5fa55
--- /dev/null
+++ b/apps/example-sender/src/lib/types.ts
@@ -0,0 +1,28 @@
+// Response shapes for the relay's dual-auth routing/inbox methods. Kept out of
+// `$lib/server` so the component can import them too. A real integrator would
+// likely codegen these from the published lexicons; hand-typing keeps the demo
+// dependency-light.
+
+export type AlertRoute = 'push' | 'telegram' | 'push+telegram' | 'off';
+/** App-wide route; 'default' inherits the user's account default. */
+export type AppRoute = AlertRoute | 'default';
+/** Per-category route; 'app' inherits the app-wide route. */
+export type CategoryRoute = AlertRoute | 'app';
+
+export interface RoutingView {
+	route: AppRoute;
+	defaultRoute: AlertRoute;
+	categories: { id: string; description?: string; route: CategoryRoute }[];
+}
+
+export interface NotificationView {
+	id: string;
+	title: string;
+	body: string;
+	uri?: string;
+	category?: string;
+	createdAt: string;
+	read: boolean;
+	/** Number of channels this notification fanned out to (0 = recorded only). */
+	delivered?: number;
+}
diff --git a/apps/example-sender/src/routes/+page.svelte b/apps/example-sender/src/routes/+page.svelte
index b8fcae0..dc2ba24 100644
--- a/apps/example-sender/src/routes/+page.svelte
+++ b/apps/example-sender/src/routes/+page.svelte
@@ -8,7 +8,17 @@
 		PROJECT_NAME,
 		SENDER_DID
 	} from '$lib/config';
-	import { requestNotifications, sendTest, type SendResult } from '$lib/relay.remote';
+	import {
+		getRouting,
+		listNotifications,
+		markAllRead,
+		openInAtmo,
+		requestNotifications,
+		sendTest,
+		setRouting,
+		type SendResult
+	} from '$lib/relay.remote';
+	import type { AppRoute, NotificationView, RoutingView } from '$lib/types';
 	import type { PageServerData } from './$types';
 
 	let { data }: { data: PageServerData } = $props();
@@ -57,6 +67,28 @@
 		}
 	}
 
+	// --- cross-app login: jump into atmo.pub already signed in -------------
+	let openBusy = $state(false);
+	let openError = $state('');
+
+	async function openAtmo() {
+		openBusy = true;
+		openError = '';
+		// Open the tab synchronously on the click so the browser keeps the user
+		// gesture (no popup blocker), then point it at the link once minted.
+		const w = window.open('about:blank');
+		try {
+			const { url } = await openInAtmo();
+			if (w) w.location.href = url;
+			else window.location.href = url;
+		} catch (err) {
+			w?.close();
+			openError = err instanceof Error ? err.message : 'Failed to open atmo.pub';
+		} finally {
+			openBusy = false;
+		}
+	}
+
 	// --- step 2: send a test ----------------------------------------------
 	let title = $state('');
 	let body = $state('');
@@ -77,11 +109,69 @@
 		}
 	}
 
+	// --- step 3: manage routing + inbox (dual-auth) -----------------------
+	let manageBusy = $state(false);
+	let manageError = $state('');
+	let routing = $state<RoutingView | null>(null);
+	let notifs = $state<NotificationView[]>([]);
+	let routeChoice = $state<AppRoute>('default');
+	let loaded = $state(false);
+
+	// Remote-command errors arrive as { body: { message } }, not Error instances.
+	function errMsg(err: unknown, fallback: string): string {
+		const e = err as { body?: { message?: string }; message?: string };
+		return e?.body?.message ?? e?.message ?? fallback;
+	}
+
+	async function loadSettings() {
+		manageBusy = true;
+		manageError = '';
+		try {
+			const [r, list] = await Promise.all([getRouting(), listNotifications()]);
+			routing = r;
+			routeChoice = r.route;
+			notifs = list.notifications;
+			loaded = true;
+		} catch (err) {
+			manageError = errMsg(err, 'Failed to load settings');
+		} finally {
+			manageBusy = false;
+		}
+	}
+
+	async function changeRoute() {
+		manageBusy = true;
+		manageError = '';
+		try {
+			await setRouting({ route: routeChoice });
+			routing = await getRouting();
+		} catch (err) {
+			manageError = errMsg(err, 'Failed to update routing');
+		} finally {
+			manageBusy = false;
+		}
+	}
+
+	async function markRead() {
+		manageBusy = true;
+		manageError = '';
+		try {
+			await markAllRead();
+			notifs = (await listNotifications()).notifications;
+		} catch (err) {
+			manageError = errMsg(err, 'Failed to mark read');
+		} finally {
+			manageBusy = false;
+		}
+	}
+
 	const card = 'rounded-card border border-line bg-surface p-5';
 	const btnPrimary =
 		'rounded-md bg-accent px-4 py-2 text-sm font-medium text-accent-fg transition-opacity hover:opacity-90 disabled:opacity-50';
 	const inputCls =
 		'w-full rounded-md border border-line bg-surface px-3 py-2 text-sm text-fg placeholder:text-muted-2 focus:border-accent';
+	const selectCls =
+		'w-full rounded-md border border-line bg-surface px-3 py-2 text-sm text-fg focus:border-accent';
 	const noticeOk = 'mt-3 rounded-md border border-line bg-accent-soft px-3 py-2 text-sm text-fg';
 	const noticeWarn = 'mt-3 rounded-md border border-line px-3 py-2 text-sm text-warn';
 </script>
@@ -200,6 +290,84 @@
 			{/if}
 			{#if sendError}<p class="mt-3 text-sm text-danger" role="alert">{sendError}</p>{/if}
 		</section>
+
+		<section class={card}>
+			<h2 class="text-base font-semibold text-fg">Step 3 — Manage your settings (dual-auth)</h2>
+			<p class="mt-2 text-sm leading-relaxed text-muted">
+				Read and change how <em>this app's</em> notifications reach you — from inside this app. Each
+				call carries <strong class="text-fg">two</strong> service-auth tokens: one signed by this app
+				(proves which app), and a fresh one minted by your PDS (proves you consented). The relay
+				scopes every change to you&nbsp;+&nbsp;this app — it can't touch your account default or
+				other apps. Requires an approved grant (Step&nbsp;1).
+			</p>
+			<button onclick={loadSettings} disabled={manageBusy} class="{btnPrimary} mt-4">
+				{manageBusy ? 'Working…' : loaded ? 'Refresh' : 'Load my settings'}
+			</button>
+
+			{#if routing}
+				<div class="mt-5 space-y-5">
+					<label class="block text-sm">
+						<span class="font-medium text-fg">Route all of this app's notifications to</span>
+						<select
+							bind:value={routeChoice}
+							onchange={changeRoute}
+							disabled={manageBusy}
+							class="{selectCls} mt-1"
+						>
+							<option value="default">Account default ({routing.defaultRoute})</option>
+							<option value="push">Push</option>
+							<option value="telegram">Telegram</option>
+							<option value="push+telegram">Push + Telegram</option>
+							<option value="off">Off</option>
+						</select>
+					</label>
+
+					<div>
+						<div class="flex items-center justify-between">
+							<h3 class="text-sm font-medium text-fg">Notifications we've sent you</h3>
+							<button
+								onclick={markRead}
+								disabled={manageBusy || notifs.length === 0}
+								class="rounded-md border border-line px-3 py-1.5 text-xs font-medium text-fg hover:bg-surface-2 disabled:opacity-50"
+							>
+								Mark all read
+							</button>
+						</div>
+						{#if notifs.length === 0}
+							<p class="mt-2 text-sm text-muted">None yet — send one in Step 2, then Refresh.</p>
+						{:else}
+							<ul class="mt-2 divide-y divide-line text-sm">
+								{#each notifs as n (n.id)}
+									<li class="flex items-center justify-between gap-3 py-2">
+										<span class="min-w-0 truncate text-fg">{n.read ? '' : '• '}{n.title}</span>
+										<span class="shrink-0 text-xs text-muted-2">
+											delivered to {n.delivered ?? 0} · {n.read ? 'read' : 'unread'}
+										</span>
+									</li>
+								{/each}
+							</ul>
+						{/if}
+					</div>
+				</div>
+			{/if}
+			{#if manageError}<p class="mt-3 text-sm text-danger" role="alert">{manageError}</p>{/if}
+		</section>
+
+		<section class={card}>
+			<h2 class="text-base font-semibold text-fg">Cross-app login</h2>
+			<p class="mt-2 text-sm leading-relaxed text-muted">
+				Mints a one-time <code class="font-mono text-fg">pub.atmo.auth</code> token on your PDS and
+				opens
+				<a class="text-accent hover:underline" href={DASHBOARD_ORIGIN} target="_blank" rel="noreferrer"
+					>atmo.pub</a
+				>
+				<em>already signed in</em> — deep-linked to this app's settings. No login form.
+			</p>
+			<button onclick={openAtmo} disabled={openBusy} class="{btnPrimary} mt-4">
+				{openBusy ? 'Opening…' : 'Open in atmo.pub'}
+			</button>
+			{#if openError}<p class="mt-3 text-sm text-danger" role="alert">{openError}</p>{/if}
+		</section>
 	{/if}
 
 	<footer class="border-t border-line pt-6 text-xs text-muted-2">
diff --git a/apps/homepage/src/routes/docs/+page.server.ts b/apps/homepage/src/routes/docs/+page.server.ts
index 9c6bd49..a253b2e 100644
--- a/apps/homepage/src/routes/docs/+page.server.ts
+++ b/apps/homepage/src/routes/docs/+page.server.ts
@@ -1,4 +1,4 @@
-import { LEXICON_PREFIX, RELAY_DID, RELAY_ORIGIN } from '$lib/config';
+import { LEXICON_PREFIX, RELAY_DID, RELAY_ORIGIN, WEBAPP_URL } from '$lib/config';
 import { highlight, type CodeLang } from '$lib/server/highlight';
 
 import type { PageServerLoad } from './$types';
@@ -49,6 +49,18 @@ const sendCurlExample = `curl -X POST ${RELAY_ORIGIN}/xrpc/${LEXICON_PREFIX}.sen
     "uri": "https://yourapp.example/thread/123"
   }'`;
 
+const appLoginExample = `// 1. Add to your app's OAuth scope:  rpc?lxm=pub.atmo.auth&aud=*
+// 2. Mint a single-use, ~60s identity token on the signed-in user's PDS:
+const { data } = await client.get('com.atproto.server.getServiceAuth', {
+  params: { aud: '${RELAY_DID}', lxm: 'pub.atmo.auth' }
+});
+
+// 3. Open atmo.pub already signed in — deep-link to YOUR app's settings page.
+//    (Open the tab on the click first to keep the user gesture.)
+const url = \`${WEBAPP_URL}/applogin?token=\${encodeURIComponent(data.token)}\`
+  + \`&redirect=\${encodeURIComponent('/apps/did:web:yourapp.example')}\`;
+window.open(url);`;
+
 export interface CodeBlock {
 	lang: CodeLang;
 	raw: string;
@@ -56,7 +68,9 @@ export interface CodeBlock {
 }
 
 // Highlight the (static) examples once per server instance, then reuse.
-let cached: Promise<Record<'request' | 'sendJwt' | 'sendAtcute' | 'sendCurl', CodeBlock>> | undefined;
+let cached:
+	| Promise<Record<'request' | 'sendJwt' | 'sendAtcute' | 'sendCurl' | 'appLogin', CodeBlock>>
+	| undefined;
 function buildBlocks() {
 	cached ??= (async () => {
 		const make = async (raw: string, lang: CodeLang): Promise<CodeBlock> => ({
@@ -68,7 +82,8 @@ function buildBlocks() {
 			request: await make(requestExample, 'bash'),
 			sendJwt: await make(sendJwtExample, 'ts'),
 			sendAtcute: await make(sendAtcuteExample, 'ts'),
-			sendCurl: await make(sendCurlExample, 'bash')
+			sendCurl: await make(sendCurlExample, 'bash'),
+			appLogin: await make(appLoginExample, 'ts')
 		};
 	})();
 	return cached;
diff --git a/apps/homepage/src/routes/docs/+page.svelte b/apps/homepage/src/routes/docs/+page.svelte
index 7d41035..fcbcaa8 100644
--- a/apps/homepage/src/routes/docs/+page.svelte
+++ b/apps/homepage/src/routes/docs/+page.svelte
@@ -138,7 +138,23 @@
 	</section>
 
 	<section class="space-y-3">
-		<h2 class="text-lg font-semibold text-fg">4. Rate limits</h2>
+		<h2 class="text-lg font-semibold text-fg">4. Cross-app login (optional)</h2>
+		<p class="max-w-prose text-sm leading-relaxed text-muted">
+			Let users jump from your app into {PROJECT_NAME} <em>already signed in</em>, with no login form
+			— handy for a “Configure notifications” link that lands on your app's settings page. Your app
+			mints a single-use, short-lived identity token on the user's PDS; {PROJECT_NAME} verifies the
+			signature against their DID and starts a session. It's an identity proof only — it grants no
+			access to the user's data.
+		</p>
+		{@render codeblock(data.code.appLogin)}
+		<p class="max-w-prose text-sm leading-relaxed text-muted">
+			The token is single-use and expires in ~60s; <code class="font-mono text-fg">redirect</code>
+			must be a relative path. It's a bearer link, so don't log it.
+		</p>
+	</section>
+
+	<section class="space-y-3">
+		<h2 class="text-lg font-semibold text-fg">5. Rate limits</h2>
 		<ul class="ml-5 list-disc space-y-1 text-sm text-muted">
 			<li>At most <strong class="text-fg">1 outstanding pending request</strong> per (sender, recipient).</li>
 			<li><code class="font-mono text-fg">requestPermission</code>: <strong class="text-fg">50 / hour</strong> per recipient and <strong class="text-fg">100 / hour</strong> per sender.</li>
@@ -147,7 +163,7 @@
 	</section>
 
 	<section class="space-y-3">
-		<h2 class="text-lg font-semibold text-fg">5. Error handling</h2>
+		<h2 class="text-lg font-semibold text-fg">6. Error handling</h2>
 		<p class="max-w-prose text-sm leading-relaxed text-muted">Common XRPC errors:</p>
 		<ul class="ml-5 list-disc space-y-1 text-sm text-muted">
 			<li><code class="font-mono text-fg">AuthenticationRequired</code> — missing/invalid JWT.</li>
diff --git a/apps/relay/src/auth/appLogin.ts b/apps/relay/src/auth/appLogin.ts
new file mode 100644
index 0000000..9617cd4
--- /dev/null
+++ b/apps/relay/src/auth/appLogin.ts
@@ -0,0 +1,78 @@
+import type { Did, Nsid } from '@atcute/lexicons';
+
+import type { Env } from '../env';
+import { getVerifier } from './verifier';
+
+/**
+ * Cross-app login (`pub.atmo.auth`).
+ *
+ * Another atproto app mints a short-lived service-auth JWT on the *user's* PDS
+ * (`iss` = user, `aud` = this relay's DID, `lxm` = `pub.atmo.auth`) and links the
+ * user to atmo.pub's `/applogin?token=…`. The web app hands the token here over
+ * the private `RelayRpc` binding; we verify it and return the issuer DID, which
+ * the web app turns into a session. This is an *identity* proof only — it grants
+ * no access to the user's PDS. See CROSS-APP-AUTH.md.
+ *
+ * It is a binding method (not public XRPC) because only atmo.pub's server
+ * consumes these tokens; third parties only mint them. The public XRPC surface
+ * stays locked to `requestPermission` + `send`.
+ */
+export const APPLOGIN_LXM = 'pub.atmo.auth' as Nsid;
+
+/**
+ * Single-use replay-guard TTL. Must cover the verifier's `maxAge` (300s) so a
+ * token can never be reused inside its own validity window.
+ */
+const REPLAY_TTL_SECONDS = 300;
+
+/** Thrown for any reason a token is not a usable login proof. */
+export class AppLoginError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'AppLoginError';
+  }
+}
+
+/**
+ * Verify a `pub.atmo.auth` service-auth token and return the issuer DID. Single
+ * use: a token is rejected if it has already been consumed (keyed on a hash of
+ * the whole token rather than `jti`, so it works whether or not the PDS emits a
+ * unique nonce — the shared verifier has no `replayStore`, which keeps
+ * non-`jti` `requestPermission` tokens working).
+ */
+export async function verifyAppLoginToken(env: Env, token: string): Promise<{ did: Did }> {
+  if (typeof token !== 'string' || token.length === 0) {
+    throw new AppLoginError('Missing token');
+  }
+
+  const replayKey = `applogin:${await sha256Base64Url(token)}`;
+  if ((await env.CACHE.get(replayKey)) !== null) {
+    throw new AppLoginError('Token already used');
+  }
+
+  // The verifier reads the bearer token from an Authorization header, so wrap it
+  // in a synthetic Request. `lxm` + the relay-DID audiences are checked here.
+  const req = new Request('https://relay.atmo.pub/applogin', {
+    headers: { authorization: `Bearer ${token}` },
+  });
+  let issuer: Did;
+  try {
+    ({ issuer } = await getVerifier(env).verifyRequest(req, { lxm: APPLOGIN_LXM }));
+  } catch (err) {
+    throw new AppLoginError(err instanceof Error ? err.message : 'Invalid token');
+  }
+
+  // Burn it so it can't be replayed within its validity window.
+  await env.CACHE.put(replayKey, '1', { expirationTtl: REPLAY_TTL_SECONDS });
+
+  return { did: issuer };
+}
+
+async function sha256Base64Url(input: string): Promise<string> {
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(input));
+  let binary = '';
+  for (const byte of new Uint8Array(digest)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
diff --git a/apps/relay/src/auth/sender.ts b/apps/relay/src/auth/sender.ts
index 913e66d..4fd47e5 100644
--- a/apps/relay/src/auth/sender.ts
+++ b/apps/relay/src/auth/sender.ts
@@ -16,3 +16,22 @@ export async function verifySenderRequest(
   const { issuer } = await verifier.verifyRequest(request, { lxm });
   return { senderDid: issuer };
 }
+
+/**
+ * Verify a *second*, body-carried service-auth JWT — used by the dual-auth
+ * routing methods to prove the user's consent alongside the app's own bearer
+ * token. The verifier only inspects the `Authorization` header, so we wrap the
+ * raw token in a synthetic request; the URL/method are irrelevant to JWT
+ * verification while the same audience/lxm/expiry checks still apply.
+ */
+export async function verifyServiceToken(
+  verifier: ServiceJwtVerifier,
+  token: string,
+  lxm: Nsid,
+): Promise<{ did: Did }> {
+  const synthetic = new Request('https://relay.invalid/', {
+    headers: { authorization: `Bearer ${token}` },
+  });
+  const { issuer } = await verifier.verifyRequest(synthetic, { lxm });
+  return { did: issuer };
+}
diff --git a/apps/relay/src/db/queries.ts b/apps/relay/src/db/queries.ts
index bf71a56..0bdbfd5 100644
--- a/apps/relay/src/db/queries.ts
+++ b/apps/relay/src/db/queries.ts
@@ -643,6 +643,71 @@ export async function markAllNotificationsRead(
   return result.meta.changes ?? 0;
 }
 
+// --- App-scoped inbox access (one sender's notifications for one recipient) ---
+// Used by the federated, dual-authed `listNotifications`/`markRead` so an app
+// can see and acknowledge only the notifications *it* sent.
+
+export interface NotificationWithDeliveryRow extends NotificationRow {
+  /** Channels this notification fanned out to (from delivery_log); null if unlogged. */
+  delivered_count: number | null;
+}
+
+/** Page one sender's notifications to one recipient, newest-first, with delivery counts. */
+export async function listNotificationsFromSender(
+  db: D1Database,
+  recipientDid: Did,
+  senderDid: Did,
+  limit: number,
+  before?: number,
+): Promise<NotificationWithDeliveryRow[]> {
+  const where =
+    before !== undefined
+      ? 'n.recipient_did = ? AND n.sender_did = ? AND n.created_at < ?'
+      : 'n.recipient_did = ? AND n.sender_did = ?';
+  const sql = `SELECT n.*, d.delivered_count FROM notifications n
+       LEFT JOIN delivery_log d ON d.id = n.id
+       WHERE ${where} ORDER BY n.created_at DESC LIMIT ?`;
+  const stmt =
+    before !== undefined
+      ? db.prepare(sql).bind(recipientDid, senderDid, before, limit)
+      : db.prepare(sql).bind(recipientDid, senderDid, limit);
+  const { results } = await stmt.all<NotificationWithDeliveryRow>();
+  return results;
+}
+
+/**
+ * Mark a sender's notifications to a recipient as read. With `ids`, only those
+ * (still scoped to this sender); without, all of this sender's unread ones.
+ * Returns the number of rows changed.
+ */
+export async function markNotificationsReadFromSender(
+  db: D1Database,
+  recipientDid: Did,
+  senderDid: Did,
+  readAt: number,
+  ids?: string[],
+): Promise<number> {
+  if (ids !== undefined) {
+    if (ids.length === 0) return 0;
+    const placeholders = ids.map(() => '?').join(',');
+    const result = await db
+      .prepare(
+        `UPDATE notifications SET read_at = ?
+         WHERE recipient_did = ? AND sender_did = ? AND read_at IS NULL AND id IN (${placeholders})`,
+      )
+      .bind(readAt, recipientDid, senderDid, ...ids)
+      .run();
+    return result.meta.changes ?? 0;
+  }
+  const result = await db
+    .prepare(
+      'UPDATE notifications SET read_at = ? WHERE recipient_did = ? AND sender_did = ? AND read_at IS NULL',
+    )
+    .bind(readAt, recipientDid, senderDid)
+    .run();
+  return result.meta.changes ?? 0;
+}
+
 // ---------------------------------------------------------------------------
 // app_categories + routing (per-category routing)
 // ---------------------------------------------------------------------------
@@ -688,6 +753,21 @@ export async function listAppCategoriesForRecipient(
   return results;
 }
 
+/** Categories seen from one sender for one recipient (for an app's own routing UI). */
+export async function listAppCategoriesForSender(
+  db: D1Database,
+  recipientDid: Did,
+  senderDid: Did,
+): Promise<AppCategoryRow[]> {
+  const { results } = await db
+    .prepare(
+      'SELECT * FROM app_categories WHERE recipient_did = ? AND sender_did = ? ORDER BY category ASC',
+    )
+    .bind(recipientDid, senderDid)
+    .all<AppCategoryRow>();
+  return results;
+}
+
 export interface RoutingRow {
   recipient_did: Did;
   sender_did: Did;
@@ -718,6 +798,19 @@ export async function listRoutingForRecipient(
   return results;
 }
 
+/** Per-category routing overrides from one sender for one recipient. */
+export async function listRoutingForSender(
+  db: D1Database,
+  recipientDid: Did,
+  senderDid: Did,
+): Promise<RoutingRow[]> {
+  const { results } = await db
+    .prepare('SELECT * FROM routing WHERE recipient_did = ? AND sender_did = ?')
+    .bind(recipientDid, senderDid)
+    .all<RoutingRow>();
+  return results;
+}
+
 export async function upsertRouting(
   db: D1Database,
   recipientDid: Did,
diff --git a/apps/relay/src/router.ts b/apps/relay/src/router.ts
index b19da85..05604ad 100644
--- a/apps/relay/src/router.ts
+++ b/apps/relay/src/router.ts
@@ -1,16 +1,31 @@
-import { PubAtmoNotifyRequestPermission, PubAtmoNotifySend } from '@atmo/notifs-lexicons';
+import {
+  PubAtmoNotifyGetRouting,
+  PubAtmoNotifyListNotifications,
+  PubAtmoNotifyMarkRead,
+  PubAtmoNotifyRequestPermission,
+  PubAtmoNotifySend,
+  PubAtmoNotifySetRouting,
+} from '@atmo/notifs-lexicons';
 import { XRPCRouter } from '@atcute/xrpc-server';
 
 import { getVerifier } from './auth/verifier';
 import type { AppContext, Env } from './env';
+import { makeGetRouting } from './xrpc/getRouting';
+import { makeListNotifications } from './xrpc/listNotifications';
+import { makeMarkRead } from './xrpc/markRead';
 import { makeRequestPermission } from './xrpc/requestPermission';
 import { makeSend } from './xrpc/send';
+import { makeSetRouting } from './xrpc/setRouting';
 
 /**
  * Build the XRPC router for a single request. This is the relay's *federated*
  * surface — the only methods third-party atproto apps interact with:
  *   - `requestPermission` (user-OAuth): an app asks a user for notify permission.
  *   - `send` (sender-DID): an approved sender delivers a notification.
+ *   - `setRouting` / `getRouting` (dual-auth: app JWT + user consent JWT): an
+ *     app reads/writes how *its own* notifications are routed for a user.
+ *   - `listNotifications` / `markRead` (same dual-auth): an app reads/acks the
+ *     notifications *it* sent to a user (with read state + delivery counts).
  *
  * Every first-party user-management method (grant, revoke, the list/get
  * queries, settings, and so on) lives behind the `RelayRpc` service-binding
@@ -32,6 +47,10 @@ export function buildRouter(env: Env, ctx: ExecutionContext): XRPCRouter {
 
   router.addProcedure(PubAtmoNotifyRequestPermission.mainSchema, makeRequestPermission(app));
   router.addProcedure(PubAtmoNotifySend.mainSchema, makeSend(app));
+  router.addProcedure(PubAtmoNotifySetRouting.mainSchema, makeSetRouting(app));
+  router.addProcedure(PubAtmoNotifyGetRouting.mainSchema, makeGetRouting(app));
+  router.addProcedure(PubAtmoNotifyListNotifications.mainSchema, makeListNotifications(app));
+  router.addProcedure(PubAtmoNotifyMarkRead.mainSchema, makeMarkRead(app));
 
   return router;
 }
diff --git a/apps/relay/src/rpc/entrypoint.ts b/apps/relay/src/rpc/entrypoint.ts
index 697b95e..93163fd 100644
--- a/apps/relay/src/rpc/entrypoint.ts
+++ b/apps/relay/src/rpc/entrypoint.ts
@@ -101,4 +101,7 @@ export class RelayRpc extends WorkerEntrypoint<Env> implements NotifsRpc {
   setDefaultRoute(did: Did, route: AlertRoute) {
     return ops.setDefaultRoute(this.env, did, route);
   }
+  verifyAppLogin(token: string): Promise<{ did: Did }> {
+    return ops.verifyAppLogin(this.env, token);
+  }
 }
diff --git a/apps/relay/src/rpc/ops.ts b/apps/relay/src/rpc/ops.ts
index 6c697bf..36a0945 100644
--- a/apps/relay/src/rpc/ops.ts
+++ b/apps/relay/src/rpc/ops.ts
@@ -29,6 +29,7 @@ import type {
   PubAtmoNotifyUpdateSettings,
 } from '@atmo/notifs-lexicons';
 
+import { verifyAppLoginToken } from '../auth/appLogin';
 import * as q from '../db/queries';
 import type { Env } from '../env';
 import { newLinkToken } from '../lib/ids';
@@ -390,3 +391,14 @@ export async function setDefaultRoute(
   await q.setDefaultRoute(env.DB, did, route);
   return { ok: true };
 }
+
+/**
+ * Cross-app login: verify a `pub.atmo.auth` service-auth token and return the
+ * issuer DID, ensuring the user row exists. Pre-auth — no leading `did`, the DID
+ * is the result. The web app's /applogin route consumes it to mint a session.
+ */
+export async function verifyAppLogin(env: Env, token: string): Promise<{ did: Did }> {
+  const { did } = await verifyAppLoginToken(env, token);
+  await q.ensureUser(env.DB, did, now());
+  return { did };
+}
diff --git a/apps/relay/src/well-known.ts b/apps/relay/src/well-known.ts
index de29c4f..74abaf1 100644
--- a/apps/relay/src/well-known.ts
+++ b/apps/relay/src/well-known.ts
@@ -1,15 +1,24 @@
+import getRouting from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/getRouting.json';
+import listNotifications from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/listNotifications.json';
+import markRead from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/markRead.json';
 import requestPermission from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/requestPermission.json';
 import send from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/send.json';
+import setRouting from '@atmo/notifs-lexicons/lexicons/pub/atmo/notify/setRouting.json';
 
 import type { Env } from './env';
 
-// Only the *federated* lexicons are published here. The user-management methods
-// are no longer public XRPC — they live behind the `RelayRpc` service binding —
-// so their lexicon JSON is intentionally NOT served (the files remain in the
-// package purely as type-generation input). See src/rpc/entrypoint.ts.
+// Only the *federated* lexicons are published here. The first-party
+// user-management methods are not public XRPC — they live behind the `RelayRpc`
+// service binding — so their lexicon JSON is intentionally NOT served (those
+// files remain in the package purely as type-generation input). See
+// src/rpc/entrypoint.ts.
 const LEXICONS: Record<string, unknown> = {
   'pub.atmo.notify.requestPermission': requestPermission,
   'pub.atmo.notify.send': send,
+  'pub.atmo.notify.setRouting': setRouting,
+  'pub.atmo.notify.getRouting': getRouting,
+  'pub.atmo.notify.listNotifications': listNotifications,
+  'pub.atmo.notify.markRead': markRead,
 };
 
 /**
diff --git a/apps/relay/src/xrpc/getRouting.ts b/apps/relay/src/xrpc/getRouting.ts
new file mode 100644
index 0000000..1b2a8a9
--- /dev/null
+++ b/apps/relay/src/xrpc/getRouting.ts
@@ -0,0 +1,53 @@
+import { PubAtmoNotifyGetRouting } from '@atmo/notifs-lexicons';
+import { json, type ProcedureConfig } from '@atcute/xrpc-server';
+
+import { verifySenderRequest, verifyServiceToken } from '../auth/sender';
+import * as q from '../db/queries';
+import type { AppContext } from '../env';
+import { notAuthorized } from '../lib/errors';
+
+const LXM = 'pub.atmo.notify.getRouting';
+
+/**
+ * Read how the calling app's own notifications are currently routed for a user,
+ * so the app can render an accurate in-app settings UI. Dual-authenticated and
+ * grant-gated exactly like setRouting; returns only this app's slice plus the
+ * account-default value (so 'default'/'app' can be labelled by the caller).
+ */
+export function makeGetRouting(
+  app: AppContext,
+): ProcedureConfig<PubAtmoNotifyGetRouting.mainSchema> {
+  return {
+    handler: async ({ request, input }) => {
+      const { senderDid } = await verifySenderRequest(app.verifier, request, LXM);
+      const { did: userDid } = await verifyServiceToken(app.verifier, input.userToken, LXM);
+
+      if (userDid === senderDid) throw notAuthorized();
+      if ((await q.getGrant(app.env.DB, userDid, senderDid)) === null) throw notAuthorized();
+
+      const [user, appRoute, cats, routes] = await Promise.all([
+        q.getUser(app.env.DB, userDid),
+        q.getAppRoute(app.env.DB, userDid, senderDid),
+        q.listAppCategoriesForSender(app.env.DB, userDid, senderDid),
+        q.listRoutingForSender(app.env.DB, userDid, senderDid),
+      ]);
+
+      const routeByCategory = new Map(routes.map((r) => [r.category, r.route]));
+
+      // DB columns are plain strings; cast to the lexicon's route unions at the
+      // boundary (values were validated when written).
+      type Out = PubAtmoNotifyGetRouting.$output;
+      return json({
+        route: (appRoute?.route ?? 'default') as Out['route'],
+        defaultRoute: (user?.default_route ?? 'push') as Out['defaultRoute'],
+        categories: cats.map(
+          (c): PubAtmoNotifyGetRouting.Category => ({
+            id: c.category,
+            description: c.description ?? undefined,
+            route: (routeByCategory.get(c.category) ?? 'app') as PubAtmoNotifyGetRouting.Category['route'],
+          }),
+        ),
+      });
+    },
+  };
+}
diff --git a/apps/relay/src/xrpc/listNotifications.ts b/apps/relay/src/xrpc/listNotifications.ts
new file mode 100644
index 0000000..1c26db5
--- /dev/null
+++ b/apps/relay/src/xrpc/listNotifications.ts
@@ -0,0 +1,55 @@
+import { PubAtmoNotifyListNotifications } from '@atmo/notifs-lexicons';
+import { json, type ProcedureConfig } from '@atcute/xrpc-server';
+
+import { verifySenderRequest, verifyServiceToken } from '../auth/sender';
+import * as q from '../db/queries';
+import type { AppContext } from '../env';
+import { notAuthorized } from '../lib/errors';
+
+const LXM = 'pub.atmo.notify.listNotifications';
+const DEFAULT_LIMIT = 50;
+
+/**
+ * Let an app page the notifications *it* sent to a user, with read state and
+ * the per-notification delivery count. Dual-authenticated and grant-gated like
+ * setRouting; results are scoped to (userDid, senderDid) so an app only ever
+ * sees its own notifications. Cursor is the `created_at` of the last row.
+ */
+export function makeListNotifications(
+  app: AppContext,
+): ProcedureConfig<PubAtmoNotifyListNotifications.mainSchema> {
+  return {
+    handler: async ({ request, input }) => {
+      const { senderDid } = await verifySenderRequest(app.verifier, request, LXM);
+      const { did: userDid } = await verifyServiceToken(app.verifier, input.userToken, LXM);
+
+      if (userDid === senderDid) throw notAuthorized();
+      if ((await q.getGrant(app.env.DB, userDid, senderDid)) === null) throw notAuthorized();
+
+      const limit = input.limit ?? DEFAULT_LIMIT;
+      let before: number | undefined;
+      if (input.cursor !== undefined) {
+        const n = Number(input.cursor);
+        if (Number.isFinite(n)) before = n;
+      }
+
+      const rows = await q.listNotificationsFromSender(app.env.DB, userDid, senderDid, limit, before);
+      const last = rows.at(-1);
+
+      return json({
+        notifications: rows.map((r) => ({
+          id: r.id,
+          title: r.title,
+          body: r.body,
+          uri: r.uri ?? undefined,
+          category: r.category ?? undefined,
+          createdAt: new Date(r.created_at).toISOString(),
+          read: r.read_at !== null,
+          delivered: r.delivered_count ?? undefined,
+        })),
+        // Only emit a cursor when the page was full (more rows may remain).
+        cursor: last !== undefined && rows.length === limit ? String(last.created_at) : undefined,
+      });
+    },
+  };
+}
diff --git a/apps/relay/src/xrpc/markRead.ts b/apps/relay/src/xrpc/markRead.ts
new file mode 100644
index 0000000..5fdd576
--- /dev/null
+++ b/apps/relay/src/xrpc/markRead.ts
@@ -0,0 +1,38 @@
+import { PubAtmoNotifyMarkRead } from '@atmo/notifs-lexicons';
+import { json, type ProcedureConfig } from '@atcute/xrpc-server';
+
+import { verifySenderRequest, verifyServiceToken } from '../auth/sender';
+import * as q from '../db/queries';
+import type { AppContext } from '../env';
+import { notAuthorized } from '../lib/errors';
+import { now } from '../lib/time';
+
+const LXM = 'pub.atmo.notify.markRead';
+
+/**
+ * Let an app mark the notifications *it* sent to a user as read — all of them,
+ * or a specific `ids` set. Dual-authenticated and grant-gated like setRouting;
+ * the update is scoped to (userDid, senderDid), so ids belonging to other apps
+ * are silently ignored.
+ */
+export function makeMarkRead(app: AppContext): ProcedureConfig<PubAtmoNotifyMarkRead.mainSchema> {
+  return {
+    handler: async ({ request, input }) => {
+      const { senderDid } = await verifySenderRequest(app.verifier, request, LXM);
+      const { did: userDid } = await verifyServiceToken(app.verifier, input.userToken, LXM);
+
+      if (userDid === senderDid) throw notAuthorized();
+      if ((await q.getGrant(app.env.DB, userDid, senderDid)) === null) throw notAuthorized();
+
+      const marked = await q.markNotificationsReadFromSender(
+        app.env.DB,
+        userDid,
+        senderDid,
+        now(),
+        input.ids,
+      );
+
+      return json({ marked });
+    },
+  };
+}
diff --git a/apps/relay/src/xrpc/setRouting.ts b/apps/relay/src/xrpc/setRouting.ts
new file mode 100644
index 0000000..2fb8585
--- /dev/null
+++ b/apps/relay/src/xrpc/setRouting.ts
@@ -0,0 +1,53 @@
+import { PubAtmoNotifySetRouting } from '@atmo/notifs-lexicons';
+import { json, type ProcedureConfig } from '@atcute/xrpc-server';
+
+import { verifySenderRequest, verifyServiceToken } from '../auth/sender';
+import * as q from '../db/queries';
+import type { AppContext } from '../env';
+import { notAuthorized } from '../lib/errors';
+
+const LXM = 'pub.atmo.notify.setRouting';
+
+/**
+ * Let an app change how *its own* notifications are routed for a user.
+ *
+ * Dual-authenticated: the app proves its identity with its service-auth JWT in
+ * the Authorization header (→ `senderDid`), and the user proves consent with a
+ * fresh user-issued service-auth JWT in `userToken` (→ `userDid`). Both are
+ * scoped to this method. We then require an active grant from the user to the
+ * app, and only ever touch routing rows keyed by (userDid, senderDid) — so an
+ * app can never reach the account default, other apps, or channels.
+ */
+export function makeSetRouting(
+  app: AppContext,
+): ProcedureConfig<PubAtmoNotifySetRouting.mainSchema> {
+  return {
+    handler: async ({ request, input }) => {
+      const { senderDid } = await verifySenderRequest(app.verifier, request, LXM);
+      const { did: userDid } = await verifyServiceToken(app.verifier, input.userToken, LXM);
+
+      // The two tokens must be distinct identities, and the user must have an
+      // active grant for this app (i.e. the app is approved to notify them).
+      if (userDid === senderDid) throw notAuthorized();
+      if ((await q.getGrant(app.env.DB, userDid, senderDid)) === null) throw notAuthorized();
+
+      if (input.route !== undefined) {
+        if (input.route === 'default') {
+          await q.deleteAppRoute(app.env.DB, userDid, senderDid);
+        } else {
+          await q.upsertAppRoute(app.env.DB, userDid, senderDid, input.route);
+        }
+      }
+
+      for (const c of input.categories ?? []) {
+        if (c.route === 'app') {
+          await q.deleteRouting(app.env.DB, userDid, senderDid, c.id);
+        } else {
+          await q.upsertRouting(app.env.DB, userDid, senderDid, c.id, c.route);
+        }
+      }
+
+      return json({ ok: true });
+    },
+  };
+}
diff --git a/apps/relay/test/app-routing-inbox.test.ts b/apps/relay/test/app-routing-inbox.test.ts
new file mode 100644
index 0000000..361c25a
--- /dev/null
+++ b/apps/relay/test/app-routing-inbox.test.ts
@@ -0,0 +1,312 @@
+import type { Did } from '@atcute/lexicons';
+import { createExecutionContext, env, waitOnExecutionContext } from 'cloudflare:test';
+import { beforeAll, expect, it } from 'vitest';
+
+import * as q from '../src/db/queries';
+import worker from '../src/index';
+
+import { installFetchMock, makeIdentity, makeJwt, mockPlc, xrpcPost, type TestIdentity } from './helpers';
+
+beforeAll(() => {
+  installFetchMock();
+});
+
+const SETR = 'pub.atmo.notify.setRouting';
+const GETR = 'pub.atmo.notify.getRouting';
+const LIST = 'pub.atmo.notify.listNotifications';
+const MARK = 'pub.atmo.notify.markRead';
+
+async function call(req: Request): Promise<Response> {
+  const ctx = createExecutionContext();
+  const res = await worker.fetch(req, env, ctx);
+  await waitOnExecutionContext(ctx);
+  return res;
+}
+
+/** Mint the app bearer (header) + the user consent token (body), both scoped to `lxm`. */
+async function dualCall(
+  lxm: string,
+  appId: TestIdentity,
+  userId: TestIdentity,
+  body: Record<string, unknown> = {},
+): Promise<Response> {
+  const appJwt = await makeJwt(appId, { lxm });
+  const userToken = await makeJwt(userId, { lxm });
+  return call(xrpcPost(lxm, appJwt, { userToken, ...body }));
+}
+
+function grant(recipient: Did, sender: Did): Promise<void> {
+  return q.upsertGrant(env.DB, {
+    recipientDid: recipient,
+    senderDid: sender,
+    grantedAt: Date.now(),
+    title: null,
+    description: null,
+    iconUrl: null,
+  });
+}
+
+/** A mock app + user identity pair (both DID docs resolvable), with the app granted. */
+async function granted(tag: string): Promise<{ app: TestIdentity; user: TestIdentity }> {
+  const app = await makeIdentity(`did:plc:${tag}-app`);
+  const user = await makeIdentity(`did:plc:${tag}-user`);
+  mockPlc(app);
+  mockPlc(user);
+  await grant(user.did, app.did);
+  return { app, user };
+}
+
+// --- setRouting ------------------------------------------------------------
+
+it('setRouting: 403 without a grant', async () => {
+  const app = await makeIdentity('did:plc:srt-ng-app');
+  const user = await makeIdentity('did:plc:srt-ng-user');
+  mockPlc(app);
+  mockPlc(user);
+
+  const res = await dualCall(SETR, app, user, { route: 'telegram' });
+
+  expect(res.status).toBe(403);
+});
+
+it('setRouting: 403 when the user token is the app itself', async () => {
+  const app = await makeIdentity('did:plc:srt-self-app');
+  mockPlc(app);
+  // Forge the consent token from the app's own key → userDid === senderDid.
+  const appJwt = await makeJwt(app, { lxm: SETR });
+  const userToken = await makeJwt(app, { lxm: SETR });
+
+  const res = await call(xrpcPost(SETR, appJwt, { userToken, route: 'off' }));
+
+  expect(res.status).toBe(403);
+});
+
+it('setRouting: 400 when userToken is missing', async () => {
+  const app = await makeIdentity('did:plc:srt-nouser-app');
+  mockPlc(app);
+  const appJwt = await makeJwt(app, { lxm: SETR });
+
+  const res = await call(xrpcPost(SETR, appJwt, { route: 'off' }));
+
+  expect(res.status).toBe(400);
+});
+
+it('setRouting: 401 when the user token is scoped to another method', async () => {
+  const { app, user } = await granted('srt-lxm');
+  const appJwt = await makeJwt(app, { lxm: SETR });
+  const userToken = await makeJwt(user, { lxm: 'pub.atmo.notify.send' });
+
+  const res = await call(xrpcPost(SETR, appJwt, { userToken, route: 'off' }));
+
+  expect(res.status).toBe(401);
+});
+
+it('setRouting: writes app-wide + per-category routes scoped to the app', async () => {
+  const { app, user } = await granted('srt-write');
+
+  const res = await dualCall(SETR, app, user, {
+    route: 'telegram',
+    categories: [{ id: 'mention', route: 'off' }],
+  });
+
+  expect(res.status).toBe(200);
+  expect(await res.json()).toMatchObject({ ok: true });
+  expect((await q.getAppRoute(env.DB, user.did, app.did))?.route).toBe('telegram');
+  expect((await q.getRoutingRoute(env.DB, user.did, app.did, 'mention'))?.route).toBe('off');
+});
+
+it("setRouting: 'default'/'app' clear existing overrides", async () => {
+  const { app, user } = await granted('srt-clear');
+  await q.upsertAppRoute(env.DB, user.did, app.did, 'telegram');
+  await q.upsertRouting(env.DB, user.did, app.did, 'mention', 'off');
+
+  const res = await dualCall(SETR, app, user, {
+    route: 'default',
+    categories: [{ id: 'mention', route: 'app' }],
+  });
+
+  expect(res.status).toBe(200);
+  expect(await q.getAppRoute(env.DB, user.did, app.did)).toBeNull();
+  expect(await q.getRoutingRoute(env.DB, user.did, app.did, 'mention')).toBeNull();
+});
+
+it('setRouting: 400 on an invalid route value', async () => {
+  const { app, user } = await granted('srt-bad');
+  const appJwt = await makeJwt(app, { lxm: SETR });
+  const userToken = await makeJwt(user, { lxm: SETR });
+
+  const res = await call(xrpcPost(SETR, appJwt, { userToken, route: 'carrier-pigeon' }));
+
+  expect(res.status).toBe(400);
+});
+
+// --- getRouting ------------------------------------------------------------
+
+it('getRouting: returns the app slice + account default', async () => {
+  const { app, user } = await granted('getr');
+  await q.ensureUser(env.DB, user.did, Date.now());
+  await q.setDefaultRoute(env.DB, user.did, 'push+telegram');
+  await q.upsertAppRoute(env.DB, user.did, app.did, 'telegram');
+  await q.upsertAppCategory(env.DB, {
+    recipientDid: user.did,
+    senderDid: app.did,
+    category: 'mention',
+    description: 'Mentions',
+    lastSeen: Date.now(),
+  });
+  await q.upsertRouting(env.DB, user.did, app.did, 'mention', 'off');
+
+  const res = await dualCall(GETR, app, user);
+
+  expect(res.status).toBe(200);
+  const data = (await res.json()) as {
+    route: string;
+    defaultRoute: string;
+    categories: { id: string; description?: string; route: string }[];
+  };
+  expect(data.route).toBe('telegram');
+  expect(data.defaultRoute).toBe('push+telegram');
+  expect(data.categories).toEqual([{ id: 'mention', description: 'Mentions', route: 'off' }]);
+});
+
+it('getRouting: defaults when nothing is configured', async () => {
+  const { app, user } = await granted('getr-default');
+
+  const res = await dualCall(GETR, app, user);
+
+  expect(res.status).toBe(200);
+  const data = (await res.json()) as { route: string; defaultRoute: string; categories: unknown[] };
+  expect(data.route).toBe('default');
+  expect(data.defaultRoute).toBe('push');
+  expect(data.categories).toEqual([]);
+});
+
+// --- listNotifications -----------------------------------------------------
+
+it('listNotifications: returns only the app’s own notifications, newest-first, with delivery', async () => {
+  const { app, user } = await granted('list');
+  const other: Did = 'did:plc:list-other';
+  const t0 = Date.now();
+  await q.insertNotification(env.DB, {
+    id: 'list-n1',
+    recipientDid: user.did,
+    senderDid: app.did,
+    category: 'mention',
+    title: 'First',
+    body: 'a',
+    uri: null,
+    actors: null,
+    createdAt: t0 - 1000,
+  });
+  await q.insertNotification(env.DB, {
+    id: 'list-n2',
+    recipientDid: user.did,
+    senderDid: app.did,
+    category: null,
+    title: 'Second',
+    body: 'b',
+    uri: 'https://example.com/x',
+    actors: null,
+    createdAt: t0,
+  });
+  await q.insertDeliveryLog(env.DB, {
+    id: 'list-n2',
+    recipientDid: user.did,
+    senderDid: app.did,
+    title: 'Second',
+    deliveredCount: 2,
+    createdAt: t0,
+  });
+  // A different app's notification to the same user must not leak.
+  await q.insertNotification(env.DB, {
+    id: 'list-n3',
+    recipientDid: user.did,
+    senderDid: other,
+    category: null,
+    title: 'Other',
+    body: 'c',
+    uri: null,
+    actors: null,
+    createdAt: t0,
+  });
+
+  const res = await dualCall(LIST, app, user, { limit: 50 });
+
+  expect(res.status).toBe(200);
+  const data = (await res.json()) as {
+    notifications: { id: string; read: boolean; delivered?: number; uri?: string }[];
+  };
+  const ids = data.notifications.map((n) => n.id);
+  expect(ids).toContain('list-n1');
+  expect(ids).toContain('list-n2');
+  expect(ids).not.toContain('list-n3');
+  // Newest first.
+  expect(ids.indexOf('list-n2')).toBeLessThan(ids.indexOf('list-n1'));
+  const n2 = data.notifications.find((n) => n.id === 'list-n2');
+  expect(n2?.read).toBe(false);
+  expect(n2?.delivered).toBe(2);
+  expect(n2?.uri).toBe('https://example.com/x');
+});
+
+// --- markRead --------------------------------------------------------------
+
+it('markRead: marks all of the app’s notifications, leaving other apps untouched', async () => {
+  const { app, user } = await granted('mark-all');
+  const other: Did = 'did:plc:mark-other';
+  for (const [id, sender] of [
+    ['mark-n1', app.did],
+    ['mark-n2', app.did],
+    ['mark-n3', other],
+  ] as const) {
+    await q.insertNotification(env.DB, {
+      id,
+      recipientDid: user.did,
+      senderDid: sender,
+      category: null,
+      title: id,
+      body: 'x',
+      uri: null,
+      actors: null,
+      createdAt: Date.now(),
+    });
+  }
+
+  const res = await dualCall(MARK, app, user);
+
+  expect(res.status).toBe(200);
+  expect(await res.json()).toMatchObject({ marked: 2 });
+  const n1 = await env.DB.prepare('SELECT read_at FROM notifications WHERE id = ?')
+    .bind('mark-n1')
+    .first<{ read_at: number | null }>();
+  const n3 = await env.DB.prepare('SELECT read_at FROM notifications WHERE id = ?')
+    .bind('mark-n3')
+    .first<{ read_at: number | null }>();
+  expect(n1?.read_at).not.toBeNull();
+  expect(n3?.read_at).toBeNull(); // other app's notification stays unread
+});
+
+it('markRead: marks only the given ids when provided', async () => {
+  const { app, user } = await granted('mark-ids');
+  for (const id of ['mark-i4', 'mark-i5']) {
+    await q.insertNotification(env.DB, {
+      id,
+      recipientDid: user.did,
+      senderDid: app.did,
+      category: null,
+      title: id,
+      body: 'x',
+      uri: null,
+      actors: null,
+      createdAt: Date.now(),
+    });
+  }
+
+  const res = await dualCall(MARK, app, user, { ids: ['mark-i4'] });
+
+  expect(res.status).toBe(200);
+  expect(await res.json()).toMatchObject({ marked: 1 });
+  const i5 = await env.DB.prepare('SELECT read_at FROM notifications WHERE id = ?')
+    .bind('mark-i5')
+    .first<{ read_at: number | null }>();
+  expect(i5?.read_at).toBeNull();
+});
diff --git a/apps/relay/test/appLogin.test.ts b/apps/relay/test/appLogin.test.ts
new file mode 100644
index 0000000..6b45d0b
--- /dev/null
+++ b/apps/relay/test/appLogin.test.ts
@@ -0,0 +1,60 @@
+import { env } from 'cloudflare:test';
+import { beforeAll, expect, it } from 'vitest';
+
+import { verifyAppLogin } from '../src/rpc/ops';
+
+import { installFetchMock, makeIdentity, makeJwt, mockPlc, RELAY_DID } from './helpers';
+
+beforeAll(() => {
+  installFetchMock();
+});
+
+const LXM = 'pub.atmo.auth';
+
+it('verifies a valid token and returns the issuer DID', async () => {
+  const user = await makeIdentity('did:plc:applogin1');
+  mockPlc(user);
+  const token = await makeJwt(user, { lxm: LXM });
+
+  const { did } = await verifyAppLogin(env, token);
+
+  expect(did).toBe(user.did);
+});
+
+it('rejects a token bound to a different lxm', async () => {
+  const user = await makeIdentity('did:plc:applogin2');
+  mockPlc(user);
+  const token = await makeJwt(user, { lxm: 'pub.atmo.notify.send' });
+
+  await expect(verifyAppLogin(env, token)).rejects.toThrow();
+});
+
+it('rejects a token addressed to a different audience', async () => {
+  const user = await makeIdentity('did:plc:applogin3');
+  mockPlc(user);
+  const token = await makeJwt(user, { lxm: LXM, audience: 'did:web:someone.else' });
+
+  await expect(verifyAppLogin(env, token)).rejects.toThrow();
+});
+
+it('rejects an expired token', async () => {
+  const user = await makeIdentity('did:plc:applogin4');
+  mockPlc(user);
+  const token = await makeJwt(user, { lxm: LXM, expiresIn: -60 });
+
+  await expect(verifyAppLogin(env, token)).rejects.toThrow();
+});
+
+it('rejects a token that has already been used (single-use)', async () => {
+  const user = await makeIdentity('did:plc:applogin5');
+  mockPlc(user);
+  const token = await makeJwt(user, { lxm: LXM });
+
+  await expect(verifyAppLogin(env, token)).resolves.toEqual({ did: user.did });
+  await expect(verifyAppLogin(env, token)).rejects.toThrow();
+});
+
+it('ensures the relay DID is the accepted audience', () => {
+  // Guards against an accidental rename of the test/helper relay DID.
+  expect(RELAY_DID).toBe('did:web:relay.atmo.pub');
+});
diff --git a/apps/web/src/app.d.ts b/apps/web/src/app.d.ts
index 20e079e..95c41f2 100644
--- a/apps/web/src/app.d.ts
+++ b/apps/web/src/app.d.ts
@@ -11,6 +11,9 @@ declare global {
 			session: OAuthSession | null;
 			client: Client | null;
 			did: Did | null;
+			// How the current session was established: a full OAuth login, a
+			// cross-app login link (lite session, see CROSS-APP-AUTH.md), or neither.
+			authVia: 'oauth' | 'link' | null;
 		}
 		// interface PageData {}
 		// interface PageState {}
diff --git a/apps/web/src/hooks.server.ts b/apps/web/src/hooks.server.ts
index e9dba0a..5ab53b5 100644
--- a/apps/web/src/hooks.server.ts
+++ b/apps/web/src/hooks.server.ts
@@ -1,3 +1,24 @@
+import type { Handle } from '@sveltejs/kit';
+
 import { atproto } from '$lib/atproto';
+import { LITE_SESSION_COOKIE, verifyLiteSession } from '$lib/server/liteSession';
 
-export const handle = atproto.handle;
+// Run the OAuth lib's handle (it populates locals.did/session/client from the
+// OAuth session and intercepts /oauth/* routes). For normal requests it didn't
+// intercept, fall back to the cross-app "lite session" cookie if there's no
+// OAuth session, so a link-authenticated user is signed in too. The app only
+// ever needs locals.did, so the two paths are equivalent (see CROSS-APP-AUTH.md).
+export const handle: Handle = ({ event, resolve }) =>
+	atproto.handle({
+		event,
+		resolve: async (ev) => {
+			if (ev.locals.did) {
+				ev.locals.authVia = 'oauth';
+			} else {
+				const did = await verifyLiteSession(ev.cookies.get(LITE_SESSION_COOKIE));
+				ev.locals.did = did;
+				ev.locals.authVia = did ? 'link' : null;
+			}
+			return resolve(ev);
+		}
+	});
diff --git a/apps/web/src/lib/atproto/oauth.remote.ts b/apps/web/src/lib/atproto/oauth.remote.ts
index 999318c..22785a1 100644
--- a/apps/web/src/lib/atproto/oauth.remote.ts
+++ b/apps/web/src/lib/atproto/oauth.remote.ts
@@ -1,6 +1,7 @@
-import { command } from '$app/server';
+import { command, getRequestEvent } from '$app/server';
 import * as v from 'valibot';
 import { atproto } from '$lib/atproto';
+import { LITE_SESSION_COOKIE, liteCookieOptions } from '$lib/server/liteSession';
 
 export const oauthLogin = command(
 	v.object({
@@ -19,4 +20,9 @@ export const oauthLogin = command(
 	}
 );
 
-export const oauthLogout = command(() => atproto.api.logout());
+export const oauthLogout = command(async () => {
+	// Clear the cross-app lite session too, so logout works regardless of how the
+	// user signed in (see CROSS-APP-AUTH.md).
+	getRequestEvent().cookies.delete(LITE_SESSION_COOKIE, { path: liteCookieOptions.path });
+	return atproto.api.logout();
+});
diff --git a/apps/web/src/lib/server/liteSession.ts b/apps/web/src/lib/server/liteSession.ts
new file mode 100644
index 0000000..31bfb3e
--- /dev/null
+++ b/apps/web/src/lib/server/liteSession.ts
@@ -0,0 +1,104 @@
+// "Lite session" — a signed cookie carrying just the user's DID, minted when a
+// user arrives via a cross-app login link (`/applogin`, see CROSS-APP-AUTH.md)
+// rather than the full OAuth flow. The whole app only ever needs `locals.did`
+// (every action goes through the trusted RELAY binding), so a lite session is
+// functionally identical to an OAuth one — it just can't talk to the user's PDS
+// directly, which atmo.pub never does.
+//
+// HMAC-SHA256 signed with COOKIE_SECRET (the same secret the OAuth lib uses, but
+// an independent cookie + scheme). Payload is `{ did, exp }`; `exp` is re-checked
+// server-side so a stolen value can't outlive its window even if the browser
+// ignores Max-Age. Capped at 30 days (vs. the OAuth cookie's 180) to shrink the
+// blast radius of a leaked link.
+import { dev } from '$app/environment';
+import { env } from '$env/dynamic/private';
+import type { Did } from '@atcute/lexicons';
+
+export const LITE_SESSION_COOKIE = 'atmo_session';
+export const LITE_SESSION_MAX_AGE = 60 * 60 * 24 * 30; // 30 days, seconds
+
+/** Cookie attributes shared by set + delete. SameSite=Lax so the cookie is sent
+ *  on the top-level navigation that lands the user here from another app. */
+export const liteCookieOptions = {
+	httpOnly: true,
+	secure: !dev,
+	sameSite: 'lax',
+	path: '/',
+	maxAge: LITE_SESSION_MAX_AGE
+} as const;
+
+interface LitePayload {
+	did: Did;
+	/** Unix seconds. */
+	exp: number;
+}
+
+function secret(): string {
+	const s = env.COOKIE_SECRET;
+	if (s) return s;
+	// Mirror the OAuth lib's dev behaviour: a fixed insecure fallback so local
+	// dev works without configuring the secret. Never reached in production
+	// (COOKIE_SECRET is required there).
+	if (dev) return 'dev-insecure-cookie-secret';
+	throw new Error('COOKIE_SECRET is not set');
+}
+
+let keyPromise: Promise<CryptoKey> | null = null;
+function hmacKey(): Promise<CryptoKey> {
+	keyPromise ??= crypto.subtle.importKey(
+		'raw',
+		new TextEncoder().encode(secret()),
+		{ name: 'HMAC', hash: 'SHA-256' },
+		false,
+		['sign', 'verify']
+	);
+	return keyPromise;
+}
+
+function b64urlEncode(bytes: Uint8Array): string {
+	let binary = '';
+	for (const byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+}
+
+function b64urlDecode(str: string): Uint8Array<ArrayBuffer> {
+	const padded = str.replaceAll('-', '+').replaceAll('_', '/');
+	const binary = atob(padded);
+	const bytes = new Uint8Array(binary.length);
+	for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+	return bytes;
+}
+
+/** Produce a signed cookie value for the given DID. */
+export async function signLiteSession(did: Did): Promise<string> {
+	const payload: LitePayload = { did, exp: Math.floor(Date.now() / 1000) + LITE_SESSION_MAX_AGE };
+	const data = new TextEncoder().encode(JSON.stringify(payload));
+	const mac = new Uint8Array(await crypto.subtle.sign('HMAC', await hmacKey(), data));
+	return `${b64urlEncode(data)}.${b64urlEncode(mac)}`;
+}
+
+/** Verify a cookie value and return the DID, or null if invalid/expired. */
+export async function verifyLiteSession(value: string | undefined): Promise<Did | null> {
+	if (!value) return null;
+	const dot = value.indexOf('.');
+	if (dot <= 0) return null;
+	let data: Uint8Array<ArrayBuffer>;
+	let mac: Uint8Array<ArrayBuffer>;
+	try {
+		data = b64urlDecode(value.slice(0, dot));
+		mac = b64urlDecode(value.slice(dot + 1));
+	} catch {
+		return null;
+	}
+	if (!(await crypto.subtle.verify('HMAC', await hmacKey(), mac, data))) return null;
+
+	let payload: LitePayload;
+	try {
+		payload = JSON.parse(new TextDecoder().decode(data));
+	} catch {
+		return null;
+	}
+	if (typeof payload.exp !== 'number' || payload.exp * 1000 <= Date.now()) return null;
+	if (typeof payload.did !== 'string' || !payload.did.startsWith('did:')) return null;
+	return payload.did as Did;
+}
diff --git a/apps/web/src/routes/+page.svelte b/apps/web/src/routes/+page.svelte
index 80d86b0..106d96f 100644
--- a/apps/web/src/routes/+page.svelte
+++ b/apps/web/src/routes/+page.svelte
@@ -1,4 +1,5 @@
 <script lang="ts">
+	import { page } from '$app/state';
 	import { oauthLogin } from '$lib/atproto/oauth.remote';
 	import Icon from '$lib/components/Icon.svelte';
 	import Logomark from '$lib/components/Logomark.svelte';
@@ -8,6 +9,9 @@
 	let busy = $state(false);
 	let errorMsg = $state('');
 
+	// Set by /applogin when a cross-app login link was invalid or expired.
+	const linkExpired = $derived(page.url.searchParams.get('login') === 'expired');
+
 	async function signIn(event: SubmitEvent) {
 		event.preventDefault();
 		const value = handle.trim();
@@ -47,6 +51,15 @@
 			</p>
 		</div>
 
+		{#if linkExpired}
+			<p
+				class="mb-4 rounded-card border border-line bg-surface px-4 py-3 text-sm text-muted"
+				role="status"
+			>
+				That sign-in link expired or was already used. Sign in below to continue.
+			</p>
+		{/if}
+
 		<form onsubmit={signIn} class="rounded-card border border-line bg-surface p-6">
 			<label
 				for="handle"
diff --git a/apps/web/src/routes/applogin/+server.ts b/apps/web/src/routes/applogin/+server.ts
new file mode 100644
index 0000000..db434e0
--- /dev/null
+++ b/apps/web/src/routes/applogin/+server.ts
@@ -0,0 +1,44 @@
+// Cross-app login landing. Another atproto app links the user here with a
+// single-use `pub.atmo.auth` service-auth token minted by their PDS; we verify
+// it through the RELAY binding, mint a lite session, and redirect — stripping the
+// token from the URL. See CROSS-APP-AUTH.md.
+import { redirect } from '@sveltejs/kit';
+
+import { LITE_SESSION_COOKIE, liteCookieOptions, signLiteSession } from '$lib/server/liteSession';
+
+import type { RequestHandler } from './$types';
+
+/** Only allow same-app relative redirects (no open redirects). */
+function safeRedirect(target: string | null): string {
+	if (!target || !target.startsWith('/') || target.startsWith('//')) return '/apps';
+	return target;
+}
+
+export const GET: RequestHandler = async ({ url, platform, cookies, setHeaders }) => {
+	// Defence-in-depth: keep the token out of any Referer to a third party. The
+	// token is also single-use, so it is inert after this request regardless.
+	setHeaders({ 'referrer-policy': 'no-referrer' });
+
+	const token = url.searchParams.get('token');
+	const target = safeRedirect(url.searchParams.get('redirect'));
+	const relay = platform?.env.RELAY;
+
+	if (!token || !relay) {
+		redirect(303, '/?login=expired');
+	}
+
+	// A service-binding RPC call returns an awaitable thenable, but not a full
+	// Promise — `.catch()` isn't available on it — so guard with try/catch.
+	let result: Awaited<ReturnType<typeof relay.verifyAppLogin>> | null = null;
+	try {
+		result = await relay.verifyAppLogin(token);
+	} catch {
+		result = null;
+	}
+	if (!result) {
+		redirect(303, '/?login=expired');
+	}
+
+	cookies.set(LITE_SESSION_COOKIE, await signLiteSession(result.did), liteCookieOptions);
+	redirect(303, target);
+};
diff --git a/packages/lexicons/lexicons/pub/atmo/notify/getRouting.json b/packages/lexicons/lexicons/pub/atmo/notify/getRouting.json
new file mode 100644
index 0000000..42fcda3
--- /dev/null
+++ b/packages/lexicons/lexicons/pub/atmo/notify/getRouting.json
@@ -0,0 +1,64 @@
+{
+  "lexicon": 1,
+  "id": "pub.atmo.notify.getRouting",
+  "defs": {
+    "main": {
+      "type": "procedure",
+      "description": "Read how the calling app's own notifications are currently routed for a user, so the app can render its in-app settings UI. Dual-authenticated exactly like setRouting (app JWT in the Authorization header + a user-issued `userToken`). It is a procedure, not a query, so the user token travels in the request body rather than the URL. Requires an active grant from the user to the app.",
+      "input": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["userToken"],
+          "properties": {
+            "userToken": {
+              "type": "string",
+              "description": "A user-issued atproto service-auth JWT (com.atproto.server.getServiceAuth) with aud = the relay's DID and lxm = pub.atmo.notify.getRouting."
+            }
+          }
+        }
+      },
+      "output": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["route", "defaultRoute", "categories"],
+          "properties": {
+            "route": {
+              "type": "string",
+              "enum": ["push", "telegram", "push+telegram", "off", "default"],
+              "description": "The app-wide route. 'default' means it inherits the account default."
+            },
+            "defaultRoute": {
+              "type": "string",
+              "enum": ["push", "telegram", "push+telegram", "off"],
+              "description": "The user's account-default route, so the app can label what 'default'/'app' resolves to."
+            },
+            "categories": {
+              "type": "array",
+              "description": "Categories this app has used for the user, with their current routing.",
+              "items": { "type": "ref", "ref": "#category" }
+            }
+          }
+        }
+      },
+      "errors": [{ "name": "NotAuthorized" }]
+    },
+    "category": {
+      "type": "object",
+      "required": ["id", "route"],
+      "properties": {
+        "id": { "type": "string", "description": "The category key." },
+        "description": {
+          "type": "string",
+          "description": "Human description last seen for this category, if any."
+        },
+        "route": {
+          "type": "string",
+          "enum": ["push", "telegram", "push+telegram", "off", "app"],
+          "description": "Route for this category. 'app' means it inherits the app-wide route."
+        }
+      }
+    }
+  }
+}
diff --git a/packages/lexicons/lexicons/pub/atmo/notify/listNotifications.json b/packages/lexicons/lexicons/pub/atmo/notify/listNotifications.json
new file mode 100644
index 0000000..c86a4e5
--- /dev/null
+++ b/packages/lexicons/lexicons/pub/atmo/notify/listNotifications.json
@@ -0,0 +1,72 @@
+{
+  "lexicon": 1,
+  "id": "pub.atmo.notify.listNotifications",
+  "defs": {
+    "main": {
+      "type": "procedure",
+      "description": "List the notifications the calling app has sent to a user, newest-first, including read state and how many channels each was delivered to. Dual-authenticated like setRouting (app JWT in the Authorization header + a user-issued `userToken`); it is a procedure, not a query, so the user token travels in the body. Returns only the calling app's own notifications. Requires an active grant from the user to the app.",
+      "input": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["userToken"],
+          "properties": {
+            "userToken": {
+              "type": "string",
+              "description": "A user-issued atproto service-auth JWT (com.atproto.server.getServiceAuth) with aud = the relay's DID and lxm = pub.atmo.notify.listNotifications."
+            },
+            "limit": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 50,
+              "description": "Max notifications to return."
+            },
+            "cursor": {
+              "type": "string",
+              "description": "Pagination cursor from a previous response."
+            }
+          }
+        }
+      },
+      "output": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["notifications"],
+          "properties": {
+            "notifications": {
+              "type": "array",
+              "items": { "type": "ref", "ref": "#notification" }
+            },
+            "cursor": {
+              "type": "string",
+              "description": "Present when more notifications may be available."
+            }
+          }
+        }
+      },
+      "errors": [{ "name": "NotAuthorized" }]
+    },
+    "notification": {
+      "type": "object",
+      "required": ["id", "title", "body", "createdAt", "read"],
+      "properties": {
+        "id": { "type": "string" },
+        "title": { "type": "string" },
+        "body": { "type": "string" },
+        "uri": { "type": "string" },
+        "category": { "type": "string" },
+        "createdAt": { "type": "string", "format": "datetime" },
+        "read": {
+          "type": "boolean",
+          "description": "Whether the user has marked this notification read (in any client)."
+        },
+        "delivered": {
+          "type": "integer",
+          "description": "Number of channels (push/Telegram targets) this notification fanned out to. 0 means it was recorded to the inbox but no alert channel fired (e.g. muted, routed off, or no channels)."
+        }
+      }
+    }
+  }
+}
diff --git a/packages/lexicons/lexicons/pub/atmo/notify/markRead.json b/packages/lexicons/lexicons/pub/atmo/notify/markRead.json
new file mode 100644
index 0000000..34e2083
--- /dev/null
+++ b/packages/lexicons/lexicons/pub/atmo/notify/markRead.json
@@ -0,0 +1,43 @@
+{
+  "lexicon": 1,
+  "id": "pub.atmo.notify.markRead",
+  "defs": {
+    "main": {
+      "type": "procedure",
+      "description": "Mark the calling app's notifications to a user as read — by default all of them, or a specific set via `ids`. Useful when the user has seen them inside the app, so they don't also show unread in atmo.pub. Dual-authenticated like setRouting (app JWT in the Authorization header + a user-issued `userToken`). Only ever affects the calling app's own notifications. Requires an active grant from the user to the app.",
+      "input": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["userToken"],
+          "properties": {
+            "userToken": {
+              "type": "string",
+              "description": "A user-issued atproto service-auth JWT (com.atproto.server.getServiceAuth) with aud = the relay's DID and lxm = pub.atmo.notify.markRead."
+            },
+            "ids": {
+              "type": "array",
+              "maxLength": 1000,
+              "items": { "type": "string" },
+              "description": "Specific notification ids to mark read (still scoped to this app). Omit to mark all of this app's notifications read."
+            }
+          }
+        }
+      },
+      "output": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["marked"],
+          "properties": {
+            "marked": {
+              "type": "integer",
+              "description": "Number of notifications newly marked read."
+            }
+          }
+        }
+      },
+      "errors": [{ "name": "NotAuthorized" }]
+    }
+  }
+}
diff --git a/packages/lexicons/lexicons/pub/atmo/notify/setRouting.json b/packages/lexicons/lexicons/pub/atmo/notify/setRouting.json
new file mode 100644
index 0000000..c104ce4
--- /dev/null
+++ b/packages/lexicons/lexicons/pub/atmo/notify/setRouting.json
@@ -0,0 +1,59 @@
+{
+  "lexicon": 1,
+  "id": "pub.atmo.notify.setRouting",
+  "defs": {
+    "main": {
+      "type": "procedure",
+      "description": "Update how the calling app's own notifications are routed for a user. Dual-authenticated: the app authenticates with its service-auth JWT in the Authorization header (like send), and the user's consent is proven by a fresh user-issued service-auth JWT in `userToken`. Both tokens must be audienced to the relay and scoped to this method (lxm). Only the calling app's routing is affected — never the account default, other apps, or channels. Requires an active grant from the user to the app.",
+      "input": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["userToken"],
+          "properties": {
+            "userToken": {
+              "type": "string",
+              "description": "A user-issued atproto service-auth JWT (com.atproto.server.getServiceAuth) with aud = the relay's DID and lxm = pub.atmo.notify.setRouting. Identifies the user and proves they authorized this change."
+            },
+            "route": {
+              "type": "string",
+              "enum": ["push", "telegram", "push+telegram", "off", "default"],
+              "description": "App-wide route for all of this app's notifications. 'default' clears the override so it inherits the account default. Omit to leave the app-wide route unchanged."
+            },
+            "categories": {
+              "type": "array",
+              "maxLength": 200,
+              "description": "Per-category routing overrides for this app. Omit to leave categories unchanged.",
+              "items": { "type": "ref", "ref": "#categoryRoute" }
+            }
+          }
+        }
+      },
+      "output": {
+        "encoding": "application/json",
+        "schema": {
+          "type": "object",
+          "required": ["ok"],
+          "properties": { "ok": { "type": "boolean" } }
+        }
+      },
+      "errors": [{ "name": "NotAuthorized" }]
+    },
+    "categoryRoute": {
+      "type": "object",
+      "required": ["id", "route"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "maxLength": 64,
+          "description": "The category key, matching the `category` used in send."
+        },
+        "route": {
+          "type": "string",
+          "enum": ["push", "telegram", "push+telegram", "off", "app"],
+          "description": "Route for this category. 'app' clears the override so it inherits the app-wide route."
+        }
+      }
+    }
+  }
+}
diff --git a/packages/lexicons/src/rpc.ts b/packages/lexicons/src/rpc.ts
index 347a25b..b81a588 100644
--- a/packages/lexicons/src/rpc.ts
+++ b/packages/lexicons/src/rpc.ts
@@ -140,4 +140,14 @@ export interface NotifsRpc {
   ): Promise<{ ok: boolean }>;
   setAppRouting(did: Did, sender: Did, route: AppRoute): Promise<{ ok: boolean }>;
   setDefaultRoute(did: Did, route: AlertRoute): Promise<{ ok: boolean }>;
+
+  /**
+   * Cross-app login: verify a `pub.atmo.auth` service-auth JWT (issued by the
+   * user's PDS, addressed to the relay DID, single-use) and return the issuer
+   * DID. The ONLY method with no leading `did` — it is pre-auth; the DID is the
+   * *result*, which the web app's /applogin route turns into a session. An
+   * identity proof only: it grants no access to the user's PDS. See
+   * CROSS-APP-AUTH.md.
+   */
+  verifyAppLogin(token: string): Promise<{ did: Did }>;
 }