diff --git a/appview/oauth/handler/handler.go b/appview/oauth/handler/handler.go
index 62aff886..e24d00a8 100644
--- a/appview/oauth/handler/handler.go
+++ b/appview/oauth/handler/handler.go
@@ -14,6 +14,7 @@ import (
 	"github.com/lestrrat-go/jwx/v2/jwk"
 	"tangled.sh/tangled.sh/core/appview"
 	"tangled.sh/tangled.sh/core/appview/db"
+	"tangled.sh/tangled.sh/core/appview/middleware"
 	"tangled.sh/tangled.sh/core/appview/oauth"
 	"tangled.sh/tangled.sh/core/appview/oauth/client"
 	"tangled.sh/tangled.sh/core/appview/pages"
@@ -38,6 +39,8 @@ func (o *OAuthHandler) Router() http.Handler {
 	r.Get("/login", o.login)
 	r.Post("/login", o.login)
 
+	r.With(middleware.AuthMiddleware(o.OAuth)).Post("/logout", o.logout)
+
 	r.Get("/oauth/client-metadata.json", o.clientMetadata)
 	r.Get("/oauth/jwks.json", o.jwks)
 	r.Get("/oauth/callback", o.callback)
@@ -61,8 +64,6 @@ func (o *OAuthHandler) clientMetadata(w http.ResponseWriter, r *http.Request) {
 		"token_endpoint_auth_signing_alg": "ES256",
 	}
 
-	fmt.Println("clientMetadata", metadata)
-
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
 	json.NewEncoder(w).Encode(metadata)
@@ -246,6 +247,18 @@ func (o *OAuthHandler) callback(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/", http.StatusFound)
 }
 
+func (o *OAuthHandler) logout(w http.ResponseWriter, r *http.Request) {
+	err := o.OAuth.ClearSession(r, w)
+	if err != nil {
+		log.Println("failed to clear session:", err)
+		http.Redirect(w, r, "/", http.StatusFound)
+		return
+	}
+
+	log.Println("session cleared successfully")
+	http.Redirect(w, r, "/", http.StatusFound)
+}
+
 func pubKeyFromJwk(jwks string) (jwk.Key, error) {
 	k, err := helpers.ParseJWKFromBytes([]byte(jwks))
 	if err != nil {
diff --git a/appview/pages/templates/user/login.html b/appview/pages/templates/user/login.html
index b251f433..1c157fc2 100644
--- a/appview/pages/templates/user/login.html
+++ b/appview/pages/templates/user/login.html
@@ -27,9 +27,9 @@
                 </h2>
                 <form
                     class="mt-4 max-w-sm mx-auto"
-                    hx-post="/oauth/login"
+                    hx-post="/login"
                     hx-swap="none"
-                    hx-disabled-elt="this"
+                    hx-disabled-elt="#login-button"
                 >
                     <div class="flex flex-col">
                         <label for="handle">handle</label>
diff --git a/kvothe.dolphin-pentatonic.ts.net.crt b/kvothe.dolphin-pentatonic.ts.net.crt
new file mode 100644
index 00000000..12f64df7
--- /dev/null
+++ b/kvothe.dolphin-pentatonic.ts.net.crt
@@ -0,0 +1,48 @@
+-----BEGIN CERTIFICATE-----
+MIIDrTCCAzOgAwIBAgISBZtKgBCUc/UBeE224CLaBBFJMAoGCCqGSM49BAMDMDIx
+CzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF
+NTAeFw0yNTA1MDkxMjUwMjNaFw0yNTA4MDcxMjUwMjJaMCsxKTAnBgNVBAMTIGt2
+b3RoZS5kb2xwaGluLXBlbnRhdG9uaWMudHMubmV0MFkwEwYHKoZIzj0CAQYIKoZI
+zj0DAQcDQgAEAmfzlJtDI6zQPvUzwM8mxFWAJluFHtyq3KHmKSqfjDdwyX05q4/R
+jhoXWF7x3Vd9S+V8JGIBiMoNgCQ+XpgYXaOCAi4wggIqMA4GA1UdDwEB/wQEAwIH
+gDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAd
+BgNVHQ4EFgQUMcRA7pwt4yXVuUO3pQLTwh4auncwHwYDVR0jBBgwFoAUnytfzzwh
+T50Et+0rLMTGcIvS1w0wMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRw
+Oi8vZTUuaS5sZW5jci5vcmcvMCsGA1UdEQQkMCKCIGt2b3RoZS5kb2xwaGluLXBl
+bnRhdG9uaWMudHMubmV0MBMGA1UdIAQMMAowCAYGZ4EMAQIBMC0GA1UdHwQmMCQw
+IqAgoB6GHGh0dHA6Ly9lNS5jLmxlbmNyLm9yZy83NC5jcmwwggEEBgorBgEEAdZ5
+AgQCBIH1BIHyAPAAdQAN4fIwK9MNwUBiEgnqVS78R3R8sdfpMO8OQh60fk6qNAAA
+AZa1TlxzAAAEAwBGMEQCIEDpoiH+6miZzTk44vJyyfnzrb9/MgZVey/82qKgPcoi
+AiASPKLS20X3nlo10Wmfejac4mMyks9FuR6MJ4mUqeroLQB3AKRCxQZJYGFUjw/U
+6pz7ei0mRU2HqX8v30VZ9idPOoRUAAABlrVOXHUAAAQDAEgwRgIhAK81NbYOshL2
+sas1ARp68siObt6/i44JxWWXgVjG2JETAiEAgjsU14b0+f8iRyFfforu7o3mmJ+J
+05ZDqxZv5SwvI4QwCgYIKoZIzj0EAwMDaAAwZQIxAK8HPrFeNx9fpyZ188QVGNUW
+ulqjYC0DKfU0ehzTOW1QUi//UxH+5C53fasVjRZr3gIwBWcyEeemIOt5Gt1qxkXb
+el3SirHpHiwyY8940+3NBbks2NO2Ty5QsSVKayWOTWQ6
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw
+TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
+cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw
+WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg
+RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK
+a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO
+VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw
+gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD
+ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw
+i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB
+AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g
+BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu
+Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C
+2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+
+bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG
+6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV
+XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO
+koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq
+cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI
+E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e
+K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX
+GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL
+sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd
+VQD9F6Na/+zmXCc=
+-----END CERTIFICATE-----
diff --git a/kvothe.dolphin-pentatonic.ts.net.key b/kvothe.dolphin-pentatonic.ts.net.key
new file mode 100644
index 00000000..954bd0c6
--- /dev/null
+++ b/kvothe.dolphin-pentatonic.ts.net.key
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIMJO0WxtmpDeZ7747hBOX3VCxAjybvqlhRpQhyfmfoiaoAoGCCqGSM49
+AwEHoUQDQgAEAmfzlJtDI6zQPvUzwM8mxFWAJluFHtyq3KHmKSqfjDdwyX05q4/R
+jhoXWF7x3Vd9S+V8JGIBiMoNgCQ+XpgYXQ==
+-----END EC PRIVATE KEY-----