diff --git a/docs/design/PRODUCTION-READINESS.md b/docs/design/PRODUCTION-READINESS.md
index ba655dcc63..75fdd70116 100644
--- a/docs/design/PRODUCTION-READINESS.md
+++ b/docs/design/PRODUCTION-READINESS.md
@@ -46,7 +46,7 @@ record; current behaviour is in the linked [architecture](../architecture.md) do
 | mecak8s (storage-free k8s-native agent) | ✅ shipped (MVP) · ✅ OPT-IN `/metrics` loopback scrape + OTLP push (ADR 0098) · ✅ verified external Redis TLS/ACL with transactional projected-file reload + last-valid generations (ADR 0240) · ✅ Helm 0.3.0 secure real-provider in-pod TLS+OIDC or edge-terminated TLS+OIDC (ClusterIP h2c), nullable spend ceilings, and pod scheduling controls · ⛔ CRD/Operator · ⛔ HPA (custom-metrics on active-runs) · ⛔ managed Redis provisioning (ElastiCache/MemoryStore — endpoint only) · ⛔ fix `mecated`'s unbounded `GracefulStop` (pre-existing, follow-up) | [mecak8s.md](../adr/0048-mecak8s.md) · [0098](../adr/0098-headless-telemetry.md) · [0240](../adr/0240-mecak8s-credential-reload-and-chart-security.md) · [0278](../adr/0278-mecak8s-edge-terminated-tls.md) · [MECAK8S-PLAN.md](./MECAK8S-PLAN.md) | [overview](../architecture.md) |
 | ACP adapter (editor stdio surface) | ✅ Phase 1+2 + bounded Phase 3 + multimodal shipped · ⛔ Phase 3 long-tail (rule persistence, grep-over-buffers, fs/* on resume) | [0001-acp-adapter.md](../adr/0001-acp-adapter.md) | [api surface](../architecture/api-surface.md) |
 | Conversation fork (peer session from a history snapshot) | ✅ shipped · ✅ effort override (mid-conversation effort switch, keeps the transcript — [0068](../adr/0068-effort-change-via-fork.md)) · ⛔ cross-provider/model fork (v2: replay-blob stripping) · ⛔ workspace-branching fork · ⛔ fork-from-event-log-at-arbitrary-point · ⛔ fork lineage (`forked_from` label) | [0065-conversation-fork.md](../adr/0065-conversation-fork.md) | [overview](../architecture.md) |
-| Studio (web client) | 🚧 landing as a stacked PR series: ✅ module foundation (vendored Atrium UI kit, toolchain, CI gates) · ✅ server tier (trusted proxy + managed-mode controller core, hermetic suite) · ✅ protocol seam + harness transport · ✅ workspace shell + runtime status · ✅ Chats core + hermetic browser e2e (fixture daemon) · ✅ Scheduled (authoring, carried-spec edit, fire log + per-fire transcripts) · ✅ Skills (browse/create/upload/enable-disable, controller-mediated; learned-skills panel) · ✅ Memory (read-only table + detail + consolidate, honest disabled/empty states) · ✅ Settings core (Personalize, agent identity, learning review) · ✅ provider management + model router + MCP gateway (controller-mediated; server-side auth.yaml ownership, no key material on the wire) · ⛔ external-mode OIDC sign-in · ⛔ advanced chat tiers (attachments, steer/queue, threads, re-attach, modes, mobile) | [0288](../adr/0288-studio-atrium-module.md) · [0289](../adr/0289-studio-server-backed-chats.md) | [overview](../architecture.md) |
+| Studio (web client) | 🚧 landing as a stacked PR series: ✅ module foundation (vendored Atrium UI kit, toolchain, CI gates) · ✅ server tier (trusted proxy + managed-mode controller core, hermetic suite) · ✅ protocol seam + harness transport · ✅ workspace shell + runtime status · ✅ Chats core + hermetic browser e2e (fixture daemon) · ✅ Scheduled (authoring, carried-spec edit, fire log + per-fire transcripts) · ✅ Skills (browse/create/upload/enable-disable, controller-mediated; learned-skills panel) · ✅ Memory (read-only table + detail + consolidate, honest disabled/empty states) · ✅ Settings core (Personalize, agent identity, learning review) · ✅ provider management + model router + MCP gateway (controller-mediated; server-side auth.yaml ownership, no key material on the wire) · ✅ external-mode OIDC sign-in (PKCE, server-held tokens) · ⛔ advanced chat tiers (attachments, tool drill-down, steer/queue, threads, re-attach, modes, mobile) · ⛔ advanced chat tiers (attachments, steer/queue, threads, re-attach, modes, mobile) | [0288](../adr/0288-studio-atrium-module.md) · [0289](../adr/0289-studio-server-backed-chats.md) | [overview](../architecture.md) |
 | _Historical / retired_ | — | [ARCHITECTURE.md](../adr/0004-v1-architecture.md) · [STEP-CHAIN.md](../adr/0006-v1-step-chain.md) · [TWELVE-PATTERNS-AUDIT.md](../adr/0007-twelve-patterns-audit.md) · [REPOMAP-TREE-SITTER.md](../adr/0029-repomap-tree-sitter.md) | — |
 
 ## Security
diff --git a/studio/.env.example b/studio/.env.example
index c403659c3d..cf5c5cfec3 100644
--- a/studio/.env.example
+++ b/studio/.env.example
@@ -44,6 +44,16 @@
 # required).
 # MECATL_ALLOW_INSECURE_LOOPBACK_MCP=
 
+# ── External-mode OIDC sign-in (optional) ────────────────────────────────────
+# When the external daemon sits behind an OIDC-aware gateway, Studio's server
+# tier can run the sign-in itself (PKCE; tokens held in server process memory
+# only). Unset = the static MECATL_AUTH_TOKEN path above.
+# MECATL_OIDC_ISSUER=
+# MECATL_OIDC_CLIENT_ID=
+# MECATL_OIDC_REDIRECT_URI=
+# MECATL_OIDC_SCOPE=
+# MECATL_OIDC_AUDIENCE=
+
 # ── Branding (optional) ──────────────────────────────────────────────────────
 # Display name used as the logo's alt text.
 # BRAND_NAME=
diff --git a/studio/src/app/api/auth/oidc/[action]/route.ts b/studio/src/app/api/auth/oidc/[action]/route.ts
new file mode 100644
index 0000000000..55fe5c8905
--- /dev/null
+++ b/studio/src/app/api/auth/oidc/[action]/route.ts
@@ -0,0 +1,102 @@
+/**
+ * Remote OIDC login routes (requirement H3) — the server-tier half of
+ * Authorization Code + PKCE against an OIDC-protected external mecated.
+ * Tokens live in `src/lib/oidc-session.ts` (process memory) and never reach
+ * the browser (rule 3). Same origin-trust table as the proxy routes (rule 4's
+ * browser-facing half).
+ *
+ *   GET  /api/auth/oidc/status   → sign-in state for the settings card
+ *   GET  /api/auth/oidc/start    → 302 to the issuer's authorize URL
+ *                                  (opened by the card's Sign in button —
+ *                                  never without that user action, H3.3)
+ *   GET  /api/auth/oidc/callback → the registered redirect URI; verifies
+ *                                  state + PKCE server-side, exchanges the
+ *                                  code, renders a close-this-tab page
+ *   POST /api/auth/oidc/logout   → local sign-out + best-effort revocation
+ */
+import {
+  beginOidcLogin,
+  type CallbackOutcome,
+  completeOidcCallback,
+  oidcLoginStatus,
+  oidcSignOut,
+} from "@/lib/oidc-session";
+import { requestIsTrusted } from "@/lib/request-trust";
+
+type Context = { params: Promise<{ action: string }> };
+
+const noStore = { "cache-control": "no-store" };
+
+const forbidden = () =>
+  Response.json({ error: "request origin is not allowed" }, { status: 403 });
+
+const unknownAction = () =>
+  Response.json({ error: "unknown auth action" }, { status: 404 });
+
+export async function GET(request: Request, context: Context) {
+  if (!requestIsTrusted(request)) return forbidden();
+  const { action } = await context.params;
+  if (action === "status") {
+    return Response.json(oidcLoginStatus(), { headers: noStore });
+  }
+  if (action === "start") {
+    try {
+      const { authorizationUrl } = await beginOidcLogin();
+      return new Response(null, {
+        status: 302,
+        headers: { ...noStore, location: authorizationUrl },
+      });
+    } catch (error) {
+      const message =
+        error instanceof Error && error.message
+          ? error.message
+          : "Could not start OIDC sign-in.";
+      return Response.json(
+        { error: message },
+        { status: 400, headers: noStore },
+      );
+    }
+  }
+  if (action === "callback") {
+    const outcome = await completeOidcCallback(
+      new URL(request.url).searchParams,
+    );
+    return callbackPage(outcome);
+  }
+  return unknownAction();
+}
+
+export async function POST(request: Request, context: Context) {
+  if (!requestIsTrusted(request)) return forbidden();
+  const { action } = await context.params;
+  if (action === "logout") {
+    return Response.json(await oidcSignOut(), { headers: noStore });
+  }
+  return unknownAction();
+}
+
+/** Mirrors the controller's gateway-OAuth callback page: a tiny same-origin
+ * HTML page that notifies the opener (the settings card listens for the
+ * `mecatl-oidc` message) and asks to be closed. The failure message is
+ * harness-authored or provider-bounded upstream, and escaped here anyway. */
+function callbackPage(outcome: CallbackOutcome): Response {
+  const headers = {
+    "content-type": "text/html; charset=utf-8",
+    // The authorization code rides this page's URL; keep it out of referrers.
+    "referrer-policy": "no-referrer",
+    ...noStore,
+  };
+  const notify = (ok: boolean) =>
+    `<script>window.opener?.postMessage({type:"mecatl-oidc",ok:${ok ? "true" : "false"}},window.location.origin);setTimeout(()=>window.close(),700)</script>`;
+  if (outcome.ok) {
+    return new Response(
+      `<!doctype html><title>Signed in to Mecatl</title><style>body{font:16px system-ui;padding:40px;color:#25231f}</style><h1>Signed in</h1><p>You can close this tab and return to Mecatl Studio.</p>${notify(true)}`,
+      { headers },
+    );
+  }
+  const message = outcome.error.replace(/[<>&"']/g, "");
+  return new Response(
+    `<!doctype html><title>Mecatl sign-in failed</title><style>body{font:16px system-ui;padding:40px;color:#25231f}</style><h1>Could not sign in</h1><p>${message}</p>${notify(false)}`,
+    { status: 400, headers },
+  );
+}
diff --git a/studio/src/app/workspace/settings/_components/oidc-login-card.tsx b/studio/src/app/workspace/settings/_components/oidc-login-card.tsx
new file mode 100644
index 0000000000..b9530e1578
--- /dev/null
+++ b/studio/src/app/workspace/settings/_components/oidc-login-card.tsx
@@ -0,0 +1,150 @@
+"use client";
+
+/**
+ * Remote sign-in card for OIDC-protected external deployments (requirement
+ * H3). Self-contained and NOT yet mounted anywhere — the natural home is the
+ * Settings runtime/connection section (beside the connection status), mounted
+ * only when the deployment mode is external; the orchestrator wires it in
+ * during integration.
+ *
+ * Talks only to the server-tier auth routes (`/api/auth/oidc/*`); no token
+ * ever reaches this component (rule 3). Sign in opens the authorize redirect
+ * in a popup — the explicit user action H3.3 requires — and the card refreshes
+ * on the callback page's `mecatl-oidc` message and on window focus.
+ */
+import { useCallback, useEffect, useState } from "react";
+import { Button } from "@/components/ui/button";
+import { Note, SettingsCard, SettingsRow } from "./settings-card";
+
+type OidcStatus = {
+  configured: boolean;
+  state: "not-configured" | "signed-out" | "signed-in" | "expired";
+  problem?: string;
+  issuer?: string;
+  subject?: string;
+  email?: string;
+  expiresAt?: string;
+};
+
+export function OidcLoginCard() {
+  const [status, setStatus] = useState<OidcStatus | null>(null);
+  const [failed, setFailed] = useState(false);
+  const [busy, setBusy] = useState(false);
+
+  const refresh = useCallback(async () => {
+    try {
+      const response = await fetch("/api/auth/oidc/status", {
+        cache: "no-store",
+      });
+      if (!response.ok) throw new Error();
+      setStatus((await response.json()) as OidcStatus);
+      setFailed(false);
+    } catch {
+      setStatus(null);
+      setFailed(true);
+    }
+  }, []);
+
+  useEffect(() => {
+    void refresh();
+    const onMessage = (event: MessageEvent) => {
+      const data = event.data as { type?: unknown } | null;
+      if (
+        event.origin === window.location.origin &&
+        data?.type === "mecatl-oidc"
+      ) {
+        void refresh();
+      }
+    };
+    const onFocus = () => void refresh();
+    window.addEventListener("message", onMessage);
+    window.addEventListener("focus", onFocus);
+    return () => {
+      window.removeEventListener("message", onMessage);
+      window.removeEventListener("focus", onFocus);
+    };
+  }, [refresh]);
+
+  const signIn = () => {
+    // The route 302s straight to the issuer's authorize URL; the callback
+    // page notifies this card and closes itself.
+    window.open(
+      "/api/auth/oidc/start",
+      "mecatl-oidc-login",
+      "width=520,height=680",
+    );
+  };
+
+  const signOut = async () => {
+    setBusy(true);
+    try {
+      await fetch("/api/auth/oidc/logout", { method: "POST" });
+    } catch {
+      // Local sign-out state is authoritative server-side; refresh shows it.
+    } finally {
+      setBusy(false);
+      void refresh();
+    }
+  };
+
+  return (
+    <SettingsCard
+      title="Remote sign-in"
+      description="OIDC login to the external mecated deployment. Tokens stay in the Studio server and never reach this browser."
+    >
+      {failed ? (
+        <Note>The sign-in status could not be read right now.</Note>
+      ) : !status ? (
+        <Note>Checking sign-in status…</Note>
+      ) : status.state === "not-configured" ? (
+        <Note>
+          {status.problem ||
+            "Not configured. Set MECATL_OIDC_ISSUER and MECATL_OIDC_CLIENT_ID (and optionally MECATL_OIDC_AUDIENCE) in Studio's environment to sign in to an OIDC-protected deployment."}
+        </Note>
+      ) : (
+        <div className="divide-y divide-border/60">
+          {status.state === "signed-in" ? (
+            <SettingsRow
+              label="Signed in"
+              description={
+                status.email ||
+                status.subject ||
+                "Authenticated to the deployment."
+              }
+            >
+              <Button
+                type="button"
+                variant="outline"
+                className="rounded-full"
+                disabled={busy}
+                onClick={() => void signOut()}
+              >
+                {busy ? "Signing out…" : "Sign out"}
+              </Button>
+            </SettingsRow>
+          ) : (
+            <SettingsRow
+              label={
+                status.state === "expired" ? "Session expired" : "Not signed in"
+              }
+              description={
+                status.state === "expired"
+                  ? "The identity provider ended this session — sign in again."
+                  : status.issuer
+              }
+            >
+              <Button
+                type="button"
+                variant="action"
+                className="rounded-full"
+                onClick={signIn}
+              >
+                {status.state === "expired" ? "Sign in again" : "Sign in"}
+              </Button>
+            </SettingsRow>
+          )}
+        </div>
+      )}
+    </SettingsCard>
+  );
+}
diff --git a/studio/src/app/workspace/settings/provider/page.tsx b/studio/src/app/workspace/settings/provider/page.tsx
index f4a875627d..2f86e474ee 100644
--- a/studio/src/app/workspace/settings/provider/page.tsx
+++ b/studio/src/app/workspace/settings/provider/page.tsx
@@ -3,6 +3,7 @@
 import { useHarnessRuntime } from "@/features/agent/hooks/use-harness-runtime";
 import { useProviderManagement } from "@/features/agent/hooks/use-provider-management";
 import { AboutDaemonCard } from "../_components/about-daemon-card";
+import { OidcLoginCard } from "../_components/oidc-login-card";
 import { ProviderSection } from "../_components/provider-section";
 import { RuntimeStatusLine } from "../_components/runtime-status-line";
 
@@ -18,6 +19,7 @@ export default function ProviderSettingsPage() {
       />
       {/* Remote-daemon login (H3): only external mode authenticates upstream,
           and the card itself explains a half-configured issuer. */}
+      {runtime.mode === "external" && <OidcLoginCard />}
     </>
   );
 }
diff --git a/studio/src/lib/oidc-session.ts b/studio/src/lib/oidc-session.ts
new file mode 100644
index 0000000000..970e493ae9
--- /dev/null
+++ b/studio/src/lib/oidc-session.ts
@@ -0,0 +1,452 @@
+import "server-only";
+
+/**
+ * Remote OIDC login for external mode (requirement H3, #847; the client-side
+ * pattern is mecatui's ADR 0277): Authorization Code + PKCE runs ENTIRELY in
+ * the Next server tier — this module owns issuer discovery, the pending login
+ * attempts, the in-memory token store, refresh, and revocation. Tokens never
+ * reach the browser (rule 3) and are never written to disk: a Next server
+ * restart requires one fresh sign-in (v1 deliberately defers durable storage;
+ * ADR 0277's keyring-wrapped store is the eventual model).
+ *
+ * Env contract (all three unset → the static MECATL_AUTH_TOKEN path,
+ * byte-identical to pre-H3 behavior):
+ *
+ * - MECATL_OIDC_ISSUER     — HTTPS issuer URL (required to enable)
+ * - MECATL_OIDC_CLIENT_ID  — public client id (required to enable)
+ * - MECATL_OIDC_AUDIENCE   — optional; forwarded as the `audience`
+ *                            authorization parameter for providers that mint
+ *                            audience-bound access tokens
+ * - MECATL_OIDC_SCOPE      — optional; default
+ *                            "openid profile email offline_access"
+ * - MECATL_OIDC_REDIRECT_URI — optional; default = the first
+ *                            MECATL_STUDIO_PUBLIC_ORIGIN +
+ *                            "/api/auth/oidc/callback" (must be registered
+ *                            with the provider)
+ */
+import {
+  boundProviderError,
+  buildAuthorizationUrl,
+  evaluateCallback,
+  pkceChallengeS256,
+  randomUrlSafe,
+  readCallbackParams,
+} from "@/lib/oidc/pkce";
+import {
+  type ProxyAuthDecision,
+  resolveProxyAuthorization,
+} from "@/lib/oidc/resolve-authorization";
+import {
+  claimsFromIdToken,
+  isInvalidGrantResponse,
+  OidcTokenStore,
+  type RefreshResult,
+  type StoredTokens,
+  tokenExpiryMs,
+  tokensFromRefreshResponse,
+} from "@/lib/oidc/token-store";
+import { studioAllowedOrigins } from "@/lib/request-trust";
+
+type OidcEnvConfig = {
+  issuer: string;
+  clientId: string;
+  audience: string;
+  scope: string;
+  redirectUri: string;
+};
+
+function defaultRedirectUri(): string {
+  const first = [...studioAllowedOrigins()][0] || "http://localhost:3000";
+  return `${first}/api/auth/oidc/callback`;
+}
+
+function oidcConfig(): OidcEnvConfig | null {
+  const issuer = process.env.MECATL_OIDC_ISSUER?.trim().replace(/\/+$/, "");
+  const clientId = process.env.MECATL_OIDC_CLIENT_ID?.trim();
+  if (!issuer || !clientId) return null;
+  return {
+    issuer,
+    clientId,
+    audience: process.env.MECATL_OIDC_AUDIENCE?.trim() || "",
+    scope:
+      process.env.MECATL_OIDC_SCOPE?.trim() ||
+      "openid profile email offline_access",
+    redirectUri:
+      process.env.MECATL_OIDC_REDIRECT_URI?.trim() || defaultRedirectUri(),
+  };
+}
+
+/** A half-set configuration is surfaced (never silently ignored) — but the
+ * proxy stays on the static path so a typo cannot brick every request. */
+function configProblem(): string {
+  const issuer = process.env.MECATL_OIDC_ISSUER?.trim();
+  const clientId = process.env.MECATL_OIDC_CLIENT_ID?.trim();
+  if (issuer && !clientId)
+    return "MECATL_OIDC_ISSUER is set but MECATL_OIDC_CLIENT_ID is missing.";
+  if (clientId && !issuer)
+    return "MECATL_OIDC_CLIENT_ID is set but MECATL_OIDC_ISSUER is missing.";
+  return "";
+}
+
+type Discovery = {
+  authorizationEndpoint: string;
+  tokenEndpoint: string;
+  /** "" when the provider does not advertise RFC 7009 revocation. */
+  revocationEndpoint: string;
+  issParameterSupported: boolean;
+};
+
+type LoginAttempt = { verifier: string; expires: number };
+
+/** Stashed on globalThis so Next dev's module reloads don't sign the
+ * operator out mid-session. Process memory only — see the module comment. */
+type OidcRuntime = {
+  store: OidcTokenStore;
+  attempts: Map<string, LoginAttempt>;
+  discovery: { issuer: string; doc: Discovery } | null;
+};
+
+const globalStash = globalThis as typeof globalThis & {
+  __mecatlOidcRuntime?: OidcRuntime;
+};
+if (!globalStash.__mecatlOidcRuntime) {
+  globalStash.__mecatlOidcRuntime = {
+    store: new OidcTokenStore(),
+    attempts: new Map(),
+    discovery: null,
+  };
+}
+const runtime: OidcRuntime = globalStash.__mecatlOidcRuntime;
+
+const ATTEMPT_TTL_MS = 10 * 60_000;
+const MAX_PENDING_ATTEMPTS = 32;
+
+function pruneAttempts(now = Date.now()): void {
+  for (const [state, attempt] of runtime.attempts) {
+    if (attempt.expires < now) runtime.attempts.delete(state);
+  }
+  // Map iteration is insertion-ordered, so overflow drops the oldest.
+  while (runtime.attempts.size >= MAX_PENDING_ATTEMPTS) {
+    const oldest = runtime.attempts.keys().next().value;
+    if (oldest === undefined) break;
+    runtime.attempts.delete(oldest);
+  }
+}
+
+function requireHttpsEndpoint(value: unknown, label: string): string {
+  if (typeof value !== "string" || !value)
+    throw new Error(`OIDC discovery does not include ${label}`);
+  let endpoint: URL;
+  try {
+    endpoint = new URL(value);
+  } catch {
+    // Harness-authored message only — never echo the provider's value.
+    throw new Error(`OIDC ${label} is not a valid URL`);
+  }
+  if (endpoint.protocol !== "https:")
+    throw new Error(`OIDC ${label} must use HTTPS`);
+  return endpoint.toString();
+}
+
+async function fetchDiscovery(
+  issuer: string,
+  signal?: AbortSignal,
+): Promise<Discovery> {
+  if (runtime.discovery?.issuer === issuer) return runtime.discovery.doc;
+  const wellKnown = requireHttpsEndpoint(
+    `${issuer}/.well-known/openid-configuration`,
+    "issuer",
+  );
+  const response = await fetch(wellKnown, {
+    headers: { accept: "application/json" },
+    cache: "no-store",
+    redirect: "manual",
+    signal: signal ?? AbortSignal.timeout(8_000),
+  });
+  if (!response.ok)
+    throw new Error(`OIDC discovery failed (HTTP ${response.status})`);
+  const body = (await response.json().catch(() => null)) as Record<
+    string,
+    unknown
+  > | null;
+  if (!body) throw new Error("OIDC discovery returned malformed JSON");
+  const documentIssuer =
+    typeof body.issuer === "string" ? body.issuer.replace(/\/+$/, "") : "";
+  if (documentIssuer !== issuer)
+    throw new Error("OIDC discovery issuer does not match MECATL_OIDC_ISSUER");
+  const doc: Discovery = {
+    authorizationEndpoint: requireHttpsEndpoint(
+      body.authorization_endpoint,
+      "authorization endpoint",
+    ),
+    tokenEndpoint: requireHttpsEndpoint(body.token_endpoint, "token endpoint"),
+    revocationEndpoint:
+      typeof body.revocation_endpoint === "string" && body.revocation_endpoint
+        ? requireHttpsEndpoint(body.revocation_endpoint, "revocation endpoint")
+        : "",
+    issParameterSupported:
+      body.authorization_response_iss_parameter_supported === true,
+  };
+  runtime.discovery = { issuer, doc };
+  return doc;
+}
+
+/** Begin one Authorization Code + PKCE attempt. Called ONLY from the login
+ * route the UI's Sign in button opens — no browser window ever opens without
+ * that explicit user action (H3.3). */
+export async function beginOidcLogin(): Promise<{ authorizationUrl: string }> {
+  const cfg = oidcConfig();
+  if (!cfg)
+    throw new Error(
+      configProblem() ||
+        "OIDC is not configured — set MECATL_OIDC_ISSUER and MECATL_OIDC_CLIENT_ID.",
+    );
+  const doc = await fetchDiscovery(cfg.issuer);
+  const state = randomUrlSafe(24);
+  const verifier = randomUrlSafe(48);
+  pruneAttempts();
+  runtime.attempts.set(state, {
+    verifier,
+    expires: Date.now() + ATTEMPT_TTL_MS,
+  });
+  return {
+    authorizationUrl: buildAuthorizationUrl({
+      authorizationEndpoint: doc.authorizationEndpoint,
+      clientId: cfg.clientId,
+      redirectUri: cfg.redirectUri,
+      scope: cfg.scope,
+      state,
+      codeChallenge: pkceChallengeS256(verifier),
+      audience: cfg.audience || undefined,
+    }),
+  };
+}
+
+export type CallbackOutcome = { ok: true } | { ok: false; error: string };
+
+export async function completeOidcCallback(
+  search: URLSearchParams,
+): Promise<CallbackOutcome> {
+  const cfg = oidcConfig();
+  if (!cfg) return { ok: false, error: "OIDC is not configured." };
+  const params = readCallbackParams(search);
+  const attempt = params.state ? runtime.attempts.get(params.state) : undefined;
+  if (params.state) runtime.attempts.delete(params.state);
+  if (!attempt || attempt.expires < Date.now()) {
+    return {
+      ok: false,
+      error:
+        "This sign-in attempt is unknown or has expired. Start again from Settings.",
+    };
+  }
+  let doc: Discovery;
+  try {
+    doc = await fetchDiscovery(cfg.issuer);
+  } catch (error) {
+    return { ok: false, error: safeMessage(error) };
+  }
+  const verdict = evaluateCallback(params, {
+    expectedIssuer: cfg.issuer,
+    issRequired: doc.issParameterSupported,
+  });
+  if (!verdict.ok) return { ok: false, error: verdict.reason };
+
+  const body = new URLSearchParams({
+    grant_type: "authorization_code",
+    code: verdict.code,
+    client_id: cfg.clientId,
+    redirect_uri: cfg.redirectUri,
+    code_verifier: attempt.verifier,
+  });
+  let response: Response;
+  try {
+    response = await fetch(doc.tokenEndpoint, {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body,
+      cache: "no-store",
+      signal: AbortSignal.timeout(15_000),
+    });
+  } catch {
+    return {
+      ok: false,
+      error: "Could not reach the identity provider's token endpoint.",
+    };
+  }
+  const result = (await response.json().catch(() => ({}))) as Record<
+    string,
+    unknown
+  >;
+  const accessToken =
+    typeof result.access_token === "string" ? result.access_token : "";
+  if (!response.ok || !accessToken) {
+    // Never echo a token-endpoint body — the bounded machine `error` code is
+    // the only fragment allowed out (ADR 0277's no-provider-bodies rule).
+    const code =
+      typeof result.error === "string" ? boundProviderError(result.error) : "";
+    return {
+      ok: false,
+      error: code
+        ? `The token exchange failed (${code}).`
+        : "The token exchange failed.",
+    };
+  }
+  const now = Date.now();
+  runtime.store.setTokens({
+    accessToken,
+    refreshToken:
+      typeof result.refresh_token === "string" ? result.refresh_token : "",
+    expiresAt: tokenExpiryMs(result.expires_in, now),
+    claims:
+      (typeof result.id_token === "string" &&
+        claimsFromIdToken(result.id_token)) ||
+      {},
+  });
+  return { ok: true };
+}
+
+async function refreshExchange(
+  cfg: OidcEnvConfig,
+  prior: StoredTokens,
+): Promise<RefreshResult> {
+  const doc = await fetchDiscovery(cfg.issuer); // a throw is caught as transient
+  // No `scope` on refresh: RFC 6749 section 6 makes it optional (the server
+  // reuses the granted scopes) and some providers reject it as malformed —
+  // the bug that silently killed the MCP gateway's auto-refresh once already
+  // (see scripts/local-controller.mjs refreshGatewayAccessToken).
+  const body = new URLSearchParams({
+    grant_type: "refresh_token",
+    refresh_token: prior.refreshToken,
+    client_id: cfg.clientId,
+  });
+  const response = await fetch(doc.tokenEndpoint, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body,
+    cache: "no-store",
+    signal: AbortSignal.timeout(10_000),
+  });
+  const result = (await response.json().catch(() => ({}))) as Record<
+    string,
+    unknown
+  >;
+  if (!response.ok) {
+    return isInvalidGrantResponse(response.status, result)
+      ? { kind: "invalid-grant" }
+      : { kind: "transient" };
+  }
+  const tokens = tokensFromRefreshResponse(result, prior, Date.now());
+  return tokens ? { kind: "refreshed", tokens } : { kind: "transient" };
+}
+
+/**
+ * The proxy's external-mode Authorization decision (H3.2): the current OIDC
+ * access token when OIDC is configured (refreshed on demand inside the
+ * 30-second refresh-ahead window), the static MECATL_AUTH_TOKEN when it is
+ * not, and an honest 401/502 decision the proxy relays otherwise.
+ */
+export async function resolveExternalAuthorization(): Promise<ProxyAuthDecision> {
+  const cfg = oidcConfig();
+  const staticToken = process.env.MECATL_AUTH_TOKEN;
+  if (!cfg) {
+    return resolveProxyAuthorization({
+      oidcConfigured: false,
+      oidc: null,
+      staticToken,
+    });
+  }
+  const outcome = await runtime.store.bearer((prior) =>
+    refreshExchange(cfg, prior),
+  );
+  return resolveProxyAuthorization({
+    oidcConfigured: true,
+    oidc: outcome,
+    staticToken,
+  });
+}
+
+export type OidcLoginStatus = {
+  configured: boolean;
+  state: "not-configured" | "signed-out" | "signed-in" | "expired";
+  /** Set when the env configuration is half-complete. */
+  problem?: string;
+  issuer?: string;
+  subject?: string;
+  email?: string;
+  /** ISO timestamp of the current access token's expiry (display only). */
+  expiresAt?: string;
+};
+
+/** Status for the settings card. Never includes token material. */
+export function oidcLoginStatus(): OidcLoginStatus {
+  const cfg = oidcConfig();
+  if (!cfg) {
+    const problem = configProblem();
+    return {
+      configured: false,
+      state: "not-configured",
+      ...(problem ? { problem } : {}),
+    };
+  }
+  const snapshot = runtime.store.snapshot();
+  if (snapshot.state !== "signed-in") {
+    return { configured: true, state: snapshot.state, issuer: cfg.issuer };
+  }
+  return {
+    configured: true,
+    state: "signed-in",
+    issuer: cfg.issuer,
+    subject: snapshot.claims.preferredUsername || snapshot.claims.sub,
+    email: snapshot.claims.email,
+    expiresAt: new Date(snapshot.expiresAt).toISOString(),
+  };
+}
+
+const REVOCATION_BUDGET_MS = 5_000;
+
+/**
+ * Sign out: local credential removal FIRST, then bounded best-effort RFC 7009
+ * revocation under one operation-wide budget (ADR 0277's logout shape; the
+ * 5-second budget mirrors ADR 0274). Provider failure never restores local
+ * state, and repeating logout while signed out succeeds.
+ */
+export async function oidcSignOut(): Promise<{ ok: true; revoked: boolean }> {
+  const cfg = oidcConfig();
+  const tokens = runtime.store.current();
+  runtime.store.clear("signed-out");
+  if (!cfg || !tokens) return { ok: true, revoked: false };
+  const budget = AbortSignal.timeout(REVOCATION_BUDGET_MS);
+  let revoked = false;
+  try {
+    const doc = await fetchDiscovery(cfg.issuer, budget);
+    if (doc.revocationEndpoint) {
+      const revoke = async (token: string, hint: string) => {
+        if (!token) return true;
+        const response = await fetch(doc.revocationEndpoint, {
+          method: "POST",
+          headers: { "content-type": "application/x-www-form-urlencoded" },
+          body: new URLSearchParams({
+            token,
+            token_type_hint: hint,
+            client_id: cfg.clientId,
+          }),
+          cache: "no-store",
+          signal: budget,
+        });
+        return response.ok;
+      };
+      const refreshRevoked = await revoke(tokens.refreshToken, "refresh_token");
+      const accessRevoked = await revoke(tokens.accessToken, "access_token");
+      revoked = refreshRevoked && accessRevoked;
+    }
+  } catch {
+    // Best-effort only — local sign-out already happened.
+  }
+  return { ok: true, revoked };
+}
+
+function safeMessage(error: unknown): string {
+  return error instanceof Error && error.message
+    ? error.message
+    : "OIDC sign-in failed.";
+}
diff --git a/studio/src/lib/oidc/pkce.test.ts b/studio/src/lib/oidc/pkce.test.ts
new file mode 100644
index 0000000000..4a9e6fcd85
--- /dev/null
+++ b/studio/src/lib/oidc/pkce.test.ts
@@ -0,0 +1,171 @@
+import { describe, expect, it } from "vitest";
+import {
+  boundProviderError,
+  buildAuthorizationUrl,
+  evaluateCallback,
+  pkceChallengeS256,
+  randomUrlSafe,
+  readCallbackParams,
+} from "./pkce";
+
+describe("randomUrlSafe", () => {
+  it("emits URL-safe values with no padding", () => {
+    for (let i = 0; i < 20; i++) {
+      expect(randomUrlSafe(32)).toMatch(/^[A-Za-z0-9_-]{43}$/);
+    }
+  });
+
+  it("does not repeat", () => {
+    const seen = new Set(Array.from({ length: 100 }, () => randomUrlSafe(32)));
+    expect(seen.size).toBe(100);
+  });
+});
+
+describe("pkceChallengeS256", () => {
+  it("matches the RFC 7636 appendix B vector", () => {
+    expect(
+      pkceChallengeS256("dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk"),
+    ).toBe("E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM");
+  });
+});
+
+describe("buildAuthorizationUrl", () => {
+  const base = {
+    authorizationEndpoint: "https://issuer.example/authorize",
+    clientId: "studio",
+    redirectUri: "http://localhost:3000/api/auth/oidc/callback",
+    scope: "openid profile email offline_access",
+    state: "the-state",
+    codeChallenge: "the-challenge",
+  };
+
+  it("carries the full Authorization Code + PKCE parameter set", () => {
+    const url = new URL(buildAuthorizationUrl(base));
+    expect(url.origin + url.pathname).toBe("https://issuer.example/authorize");
+    expect(url.searchParams.get("response_type")).toBe("code");
+    expect(url.searchParams.get("client_id")).toBe("studio");
+    expect(url.searchParams.get("redirect_uri")).toBe(base.redirectUri);
+    expect(url.searchParams.get("scope")).toBe(base.scope);
+    expect(url.searchParams.get("state")).toBe("the-state");
+    expect(url.searchParams.get("code_challenge")).toBe("the-challenge");
+    expect(url.searchParams.get("code_challenge_method")).toBe("S256");
+    expect(url.searchParams.get("audience")).toBeNull();
+  });
+
+  it("includes audience only when configured", () => {
+    const url = new URL(
+      buildAuthorizationUrl({ ...base, audience: "https://mecated.example" }),
+    );
+    expect(url.searchParams.get("audience")).toBe("https://mecated.example");
+  });
+});
+
+describe("boundProviderError", () => {
+  it("restricts to the RFC 6749 printable subset and clamps", () => {
+    expect(boundProviderError('bad "quote" \\ and\nnewline\tand ünïcode')).toBe(
+      "bad quote  andnewlineand ncode",
+    );
+    expect(boundProviderError("x".repeat(500)).length).toBe(200);
+  });
+
+  it("strips a script payload's angle-bracket-free remainder harmlessly", () => {
+    // The characters survive (printable subset), but the callback page's own
+    // HTML escaping is the render-time defense; this bound is transport-side.
+    expect(boundProviderError("access_denied")).toBe("access_denied");
+  });
+});
+
+describe("evaluateCallback", () => {
+  const check = {
+    expectedIssuer: "https://issuer.example",
+    issRequired: false,
+  };
+
+  it("accepts a plain code when iss is not advertised", () => {
+    expect(
+      evaluateCallback(
+        { code: "c0de", error: "", errorDescription: "", iss: "" },
+        check,
+      ),
+    ).toEqual({
+      ok: true,
+      code: "c0de",
+    });
+  });
+
+  it("returns the bounded provider error", () => {
+    const verdict = evaluateCallback(
+      {
+        code: "",
+        error: 'access_denied"<script>',
+        errorDescription: "user \\ said no",
+        iss: "",
+      },
+      check,
+    );
+    expect(verdict.ok).toBe(false);
+    if (!verdict.ok) {
+      expect(verdict.reason).toContain("access_denied<script>");
+      expect(verdict.reason).toContain("user  said no");
+      expect(verdict.reason).not.toContain('"');
+      expect(verdict.reason).not.toContain("\\");
+    }
+  });
+
+  it("rejects a callback without a code", () => {
+    const verdict = evaluateCallback(
+      { code: "", error: "", errorDescription: "", iss: "" },
+      check,
+    );
+    expect(verdict).toMatchObject({ ok: false });
+  });
+
+  it("rejects a mismatched iss (RFC 9207)", () => {
+    const verdict = evaluateCallback(
+      {
+        code: "c0de",
+        error: "",
+        errorDescription: "",
+        iss: "https://evil.example",
+      },
+      check,
+    );
+    expect(verdict).toMatchObject({ ok: false });
+  });
+
+  it("accepts a matching iss, tolerating a trailing slash", () => {
+    const verdict = evaluateCallback(
+      {
+        code: "c0de",
+        error: "",
+        errorDescription: "",
+        iss: "https://issuer.example/",
+      },
+      check,
+    );
+    expect(verdict).toEqual({ ok: true, code: "c0de" });
+  });
+
+  it("requires iss when discovery advertised RFC 9207 support", () => {
+    const verdict = evaluateCallback(
+      { code: "c0de", error: "", errorDescription: "", iss: "" },
+      { ...check, issRequired: true },
+    );
+    expect(verdict).toMatchObject({ ok: false });
+  });
+});
+
+describe("readCallbackParams", () => {
+  it("reads every field, defaulting absent ones to empty", () => {
+    const params = readCallbackParams(
+      new URLSearchParams("state=s&code=c&iss=https%3A%2F%2Fi.example"),
+    );
+    expect(params).toEqual({
+      state: "s",
+      code: "c",
+      error: "",
+      errorDescription: "",
+      iss: "https://i.example",
+    });
+  });
+});
diff --git a/studio/src/lib/oidc/pkce.ts b/studio/src/lib/oidc/pkce.ts
new file mode 100644
index 0000000000..9c51ca782c
--- /dev/null
+++ b/studio/src/lib/oidc/pkce.ts
@@ -0,0 +1,129 @@
+/**
+ * Pure Authorization Code + PKCE helpers for Studio's remote OIDC login
+ * (requirement H3, modeled on the MCP-gateway OAuth machinery in
+ * `scripts/local-controller.mjs` and mecatui's `internal/adapter/clientauth`
+ * per ADR 0277). No I/O and no process state — the server-tier session module
+ * (`src/lib/oidc-session.ts`) owns fetches and storage.
+ */
+import { createHash, randomBytes } from "node:crypto";
+
+/** URL-safe random value for `state` and the PKCE `code_verifier`
+ * (RFC 7636 section 4.1's unreserved charset via base64url, no padding). */
+export function randomUrlSafe(bytes = 32): string {
+  return randomBytes(bytes).toString("base64url");
+}
+
+/** RFC 7636 S256: BASE64URL(SHA256(ASCII(code_verifier))). */
+export function pkceChallengeS256(verifier: string): string {
+  return createHash("sha256").update(verifier).digest("base64url");
+}
+
+export function buildAuthorizationUrl(options: {
+  authorizationEndpoint: string;
+  clientId: string;
+  redirectUri: string;
+  scope: string;
+  state: string;
+  codeChallenge: string;
+  /** Sent as the `audience` parameter when set — some providers (e.g. Auth0)
+   * need it to mint a JWT access token bearing the daemon's `--oidc-audience`
+   * claim; providers that don't know the parameter ignore it. */
+  audience?: string;
+}): string {
+  const url = new URL(options.authorizationEndpoint);
+  url.searchParams.set("response_type", "code");
+  url.searchParams.set("client_id", options.clientId);
+  url.searchParams.set("redirect_uri", options.redirectUri);
+  url.searchParams.set("scope", options.scope);
+  url.searchParams.set("state", options.state);
+  url.searchParams.set("code_challenge", options.codeChallenge);
+  url.searchParams.set("code_challenge_method", "S256");
+  if (options.audience) url.searchParams.set("audience", options.audience);
+  return url.toString();
+}
+
+/**
+ * Bound a provider-controlled OAuth callback `error`/`error_description`
+ * before it may reach the operator — ADR 0277's narrow exception: each value
+ * is independently restricted to the RFC 6749 printable subset
+ * (%x20-21 / %x23-5B / %x5D-7E — printable ASCII minus `"` and `\`) and
+ * length-clamped. Everything else a provider says stays out of errors.
+ */
+export function boundProviderError(value: string, max = 200): string {
+  let out = "";
+  for (const ch of value) {
+    const code = ch.charCodeAt(0);
+    if (code >= 0x20 && code <= 0x7e && code !== 0x22 && code !== 0x5c) {
+      out += ch;
+    }
+    if (out.length >= max) break;
+  }
+  return out;
+}
+
+export type CallbackParams = {
+  state: string;
+  code: string;
+  error: string;
+  errorDescription: string;
+  iss: string;
+};
+
+export function readCallbackParams(search: URLSearchParams): CallbackParams {
+  return {
+    state: search.get("state") || "",
+    code: search.get("code") || "",
+    error: search.get("error") || "",
+    errorDescription: search.get("error_description") || "",
+    iss: search.get("iss") || "",
+  };
+}
+
+export type CallbackVerdict =
+  | { ok: true; code: string }
+  | { ok: false; reason: string };
+
+const normalizeIssuer = (issuer: string) => issuer.replace(/\/+$/, "");
+
+/**
+ * Validate an authorization-response callback AFTER its `state` has matched a
+ * pending attempt (the state→attempt lookup is the caller's job — an unknown
+ * state never reaches this function). Mirrors mecatui's `clientauth.Login`:
+ * provider errors are bounded, a missing code fails, and RFC 9207 `iss` is
+ * checked when present and REQUIRED when discovery advertised support.
+ */
+export function evaluateCallback(
+  params: Pick<CallbackParams, "code" | "error" | "errorDescription" | "iss">,
+  check: { expectedIssuer: string; issRequired: boolean },
+): CallbackVerdict {
+  if (params.error) {
+    const detail = boundProviderError(params.errorDescription);
+    return {
+      ok: false,
+      reason: `The identity provider reported: ${boundProviderError(params.error)}${detail ? ` — ${detail}` : ""}`,
+    };
+  }
+  if (!params.code) {
+    return {
+      ok: false,
+      reason: "The callback did not include an authorization code.",
+    };
+  }
+  if (!params.iss) {
+    if (check.issRequired) {
+      return {
+        ok: false,
+        reason:
+          "The authorization server advertises RFC 9207 but the callback carried no iss parameter.",
+      };
+    }
+  } else if (
+    normalizeIssuer(params.iss) !== normalizeIssuer(check.expectedIssuer)
+  ) {
+    return {
+      ok: false,
+      reason: "The callback iss did not match the configured issuer.",
+    };
+  }
+  return { ok: true, code: params.code };
+}
diff --git a/studio/src/lib/oidc/resolve-authorization.test.ts b/studio/src/lib/oidc/resolve-authorization.test.ts
new file mode 100644
index 0000000000..9963a38f00
--- /dev/null
+++ b/studio/src/lib/oidc/resolve-authorization.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+import {
+  normalizeStaticToken,
+  resolveProxyAuthorization,
+} from "./resolve-authorization";
+
+describe("normalizeStaticToken", () => {
+  it("applies the proxy's historical MECATL_AUTH_TOKEN normalization", () => {
+    expect(normalizeStaticToken("  abc  ")).toBe("abc");
+    expect(normalizeStaticToken("Bearer abc")).toBe("abc");
+    expect(normalizeStaticToken("bearer   abc")).toBe("abc");
+    expect(normalizeStaticToken(undefined)).toBe("");
+    expect(normalizeStaticToken("   ")).toBe("");
+  });
+});
+
+describe("resolveProxyAuthorization ordering", () => {
+  it("without OIDC config: static token injected, unset means no header (pre-H3 behavior)", () => {
+    expect(
+      resolveProxyAuthorization({
+        oidcConfigured: false,
+        oidc: null,
+        staticToken: "Bearer static-1",
+      }),
+    ).toEqual({ kind: "bearer", token: "static-1" });
+    expect(
+      resolveProxyAuthorization({
+        oidcConfigured: false,
+        oidc: null,
+        staticToken: undefined,
+      }),
+    ).toEqual({ kind: "none" });
+  });
+
+  it("with OIDC config: the OIDC token wins and the static token is never a fallback", () => {
+    expect(
+      resolveProxyAuthorization({
+        oidcConfigured: true,
+        oidc: { kind: "bearer", token: "oidc-1" },
+        staticToken: "static-1",
+      }),
+    ).toEqual({ kind: "bearer", token: "oidc-1" });
+
+    // Signed out: 401 with actionable copy — NOT a silent static downgrade.
+    const signedOut = resolveProxyAuthorization({
+      oidcConfigured: true,
+      oidc: { kind: "login-required", reason: "signed-out" },
+      staticToken: "static-1",
+    });
+    expect(signedOut).toMatchObject({
+      kind: "unauthorized",
+      status: 401,
+      code: "oidc_login_required",
+    });
+  });
+
+  it("surfaces an expired session as 401 with 'sign in again' copy", () => {
+    const expired = resolveProxyAuthorization({
+      oidcConfigured: true,
+      oidc: { kind: "login-required", reason: "expired" },
+      staticToken: undefined,
+    });
+    expect(expired).toMatchObject({
+      kind: "unauthorized",
+      status: 401,
+      code: "oidc_session_expired",
+    });
+    if (expired.kind === "unauthorized") {
+      expect(expired.error.toLowerCase()).toContain("sign in again");
+    }
+  });
+
+  it("maps a transient refresh failure to 502, not a sign-in prompt", () => {
+    expect(
+      resolveProxyAuthorization({
+        oidcConfigured: true,
+        oidc: { kind: "refresh-failed" },
+        staticToken: "static-1",
+      }),
+    ).toMatchObject({ kind: "unavailable", status: 502 });
+  });
+});
diff --git a/studio/src/lib/oidc/resolve-authorization.ts b/studio/src/lib/oidc/resolve-authorization.ts
new file mode 100644
index 0000000000..c5f46414cc
--- /dev/null
+++ b/studio/src/lib/oidc/resolve-authorization.ts
@@ -0,0 +1,66 @@
+/**
+ * The external-mode Authorization ordering for `server-proxy.ts` (requirement
+ * H3.2), pure so the fallback ordering is unit-testable:
+ *
+ * - OIDC NOT configured → the static `MECATL_AUTH_TOKEN` path, byte-identical
+ *   to the pre-H3 behavior (normalized, or no header at all when unset).
+ * - OIDC configured → the OIDC outcome DECIDES; the static token is never a
+ *   fallback (a static token cannot satisfy an OIDC-protected daemon, and
+ *   silently downgrading would mask an expired session).
+ */
+import type { BearerOutcome } from "./token-store";
+
+export type ProxyAuthDecision =
+  | { kind: "none" }
+  | { kind: "bearer"; token: string }
+  | {
+      kind: "unauthorized";
+      status: 401;
+      code: "oidc_login_required" | "oidc_session_expired";
+      error: string;
+    }
+  | { kind: "unavailable"; status: 502; error: string };
+
+/** The exact normalization the proxy has always applied to MECATL_AUTH_TOKEN. */
+export function normalizeStaticToken(raw: string | undefined): string {
+  return (raw ?? "").trim().replace(/^Bearer\s+/i, "");
+}
+
+export function resolveProxyAuthorization(options: {
+  oidcConfigured: boolean;
+  /** The token store's outcome; only read when oidcConfigured. */
+  oidc: BearerOutcome | null;
+  staticToken: string | undefined;
+}): ProxyAuthDecision {
+  if (!options.oidcConfigured) {
+    const token = normalizeStaticToken(options.staticToken);
+    return token ? { kind: "bearer", token } : { kind: "none" };
+  }
+  const outcome = options.oidc;
+  if (outcome?.kind === "bearer") {
+    return { kind: "bearer", token: outcome.token };
+  }
+  if (outcome?.kind === "login-required") {
+    return outcome.reason === "expired"
+      ? {
+          kind: "unauthorized",
+          status: 401,
+          code: "oidc_session_expired",
+          error:
+            "The OIDC session expired — sign in again from Settings to keep using this deployment.",
+        }
+      : {
+          kind: "unauthorized",
+          status: 401,
+          code: "oidc_login_required",
+          error:
+            "This deployment requires OIDC sign-in — open Settings and sign in to continue.",
+        };
+  }
+  return {
+    kind: "unavailable",
+    status: 502,
+    error:
+      "Could not refresh the OIDC access token — the identity provider may be unreachable. Try again shortly.",
+  };
+}
diff --git a/studio/src/lib/oidc/token-store.test.ts b/studio/src/lib/oidc/token-store.test.ts
new file mode 100644
index 0000000000..b72d44664b
--- /dev/null
+++ b/studio/src/lib/oidc/token-store.test.ts
@@ -0,0 +1,225 @@
+import { describe, expect, it } from "vitest";
+import {
+  type BearerOutcome,
+  claimsFromIdToken,
+  isInvalidGrantResponse,
+  OidcTokenStore,
+  REFRESH_AHEAD_MS,
+  type RefreshResult,
+  type StoredTokens,
+  tokenDecision,
+  tokenExpiryMs,
+  tokensFromRefreshResponse,
+} from "./token-store";
+
+const NOW = 1_700_000_000_000;
+
+function tokens(overrides: Partial<StoredTokens> = {}): StoredTokens {
+  return {
+    accessToken: "access-1",
+    refreshToken: "refresh-1",
+    expiresAt: NOW + 3_600_000,
+    claims: { sub: "user-1", email: "op@example.com" },
+    ...overrides,
+  };
+}
+
+describe("tokenDecision", () => {
+  it("uses a token outside the refresh-ahead window", () => {
+    expect(tokenDecision(tokens(), NOW)).toBe("use");
+  });
+
+  it("refreshes inside the 30-second refresh-ahead window", () => {
+    expect(
+      tokenDecision(tokens({ expiresAt: NOW + REFRESH_AHEAD_MS - 1 }), NOW),
+    ).toBe("refresh");
+    expect(tokenDecision(tokens({ expiresAt: NOW - 1 }), NOW)).toBe("refresh");
+  });
+
+  it("requires login when there is nothing to refresh with", () => {
+    expect(tokenDecision(null, NOW)).toBe("login-required");
+    expect(
+      tokenDecision(tokens({ expiresAt: NOW - 1, refreshToken: "" }), NOW),
+    ).toBe("login-required");
+  });
+});
+
+describe("isInvalidGrantResponse", () => {
+  it("classifies only the exact structured error code (ADR 0277)", () => {
+    expect(isInvalidGrantResponse(400, { error: "invalid_grant" })).toBe(true);
+    expect(
+      isInvalidGrantResponse(400, {
+        error: "server_error",
+        // Prose never classifies — the clientauth discipline.
+        error_description: "the grant was invalid_grant maybe",
+      }),
+    ).toBe(false);
+    expect(isInvalidGrantResponse(400, { error: "invalid_grant " })).toBe(
+      false,
+    );
+    expect(isInvalidGrantResponse(200, { error: "invalid_grant" })).toBe(false);
+    expect(isInvalidGrantResponse(400, "invalid_grant")).toBe(false);
+    expect(isInvalidGrantResponse(400, null)).toBe(false);
+  });
+});
+
+describe("tokenExpiryMs", () => {
+  it("defaults to 300s and floors at 60s", () => {
+    expect(tokenExpiryMs(undefined, NOW)).toBe(NOW + 300_000);
+    expect(tokenExpiryMs("garbage", NOW)).toBe(NOW + 300_000);
+    expect(tokenExpiryMs(5, NOW)).toBe(NOW + 60_000);
+    expect(tokenExpiryMs(900, NOW)).toBe(NOW + 900_000);
+  });
+});
+
+describe("claimsFromIdToken", () => {
+  const payload = (claims: object) =>
+    `h.${Buffer.from(JSON.stringify(claims)).toString("base64url")}.s`;
+
+  it("parses display claims", () => {
+    expect(
+      claimsFromIdToken(
+        payload({ sub: "u1", email: "a@b.c", preferred_username: "ada" }),
+      ),
+    ).toEqual({ sub: "u1", email: "a@b.c", preferredUsername: "ada" });
+  });
+
+  it("returns null on garbage", () => {
+    expect(claimsFromIdToken("not-a-jwt")).toBeNull();
+    expect(claimsFromIdToken("a.%%%.c")).toBeNull();
+  });
+});
+
+describe("tokensFromRefreshResponse", () => {
+  it("adopts a rotated refresh token", () => {
+    const next = tokensFromRefreshResponse(
+      { access_token: "access-2", refresh_token: "refresh-2", expires_in: 120 },
+      tokens(),
+      NOW,
+    );
+    expect(next).toMatchObject({
+      accessToken: "access-2",
+      refreshToken: "refresh-2",
+      expiresAt: NOW + 120_000,
+    });
+  });
+
+  it("keeps the prior refresh token and claims when the provider omits them", () => {
+    const next = tokensFromRefreshResponse(
+      { access_token: "access-2" },
+      tokens(),
+      NOW,
+    );
+    expect(next?.refreshToken).toBe("refresh-1");
+    expect(next?.claims).toEqual(tokens().claims);
+  });
+
+  it("refuses a response without an access token", () => {
+    expect(tokensFromRefreshResponse({}, tokens(), NOW)).toBeNull();
+  });
+});
+
+describe("OidcTokenStore.bearer", () => {
+  const store = (initial: StoredTokens | null, now = () => NOW) => {
+    const s = new OidcTokenStore(now);
+    if (initial) s.setTokens(initial);
+    return s;
+  };
+
+  it("serves a valid token without touching the provider", async () => {
+    let exchanges = 0;
+    const s = store(tokens());
+    const outcome = await s.bearer(async () => {
+      exchanges++;
+      return { kind: "transient" };
+    });
+    expect(outcome).toEqual({ kind: "bearer", token: "access-1" });
+    expect(exchanges).toBe(0);
+  });
+
+  it("refreshes inside the window and stores the rotation", async () => {
+    const s = store(tokens({ expiresAt: NOW + 10_000 }));
+    const outcome = await s.bearer(async (prior) => ({
+      kind: "refreshed",
+      tokens: { ...prior, accessToken: "access-2", refreshToken: "refresh-2" },
+    }));
+    expect(outcome).toEqual({ kind: "bearer", token: "access-2" });
+    expect(s.current()?.refreshToken).toBe("refresh-2");
+  });
+
+  it("drops the credential on invalid_grant and reports the expiry honestly", async () => {
+    const s = store(tokens({ expiresAt: NOW + 10_000 }));
+    const outcome = await s.bearer(async () => ({ kind: "invalid-grant" }));
+    expect(outcome).toEqual({ kind: "login-required", reason: "expired" });
+    expect(s.current()).toBeNull();
+    // The reason is sticky for the NEXT request too — the 401 copy says
+    // "session expired", not "not signed in".
+    const next = await s.bearer(async () => ({ kind: "transient" }));
+    expect(next).toEqual({ kind: "login-required", reason: "expired" });
+    expect(s.snapshot()).toEqual({ state: "expired" });
+  });
+
+  it("keeps a still-valid token through a transient refresh failure", async () => {
+    const s = store(tokens({ expiresAt: NOW + 10_000 }));
+    const outcome = await s.bearer(async () => ({ kind: "transient" }));
+    expect(outcome).toEqual({ kind: "bearer", token: "access-1" });
+    expect(s.current()).not.toBeNull();
+  });
+
+  it("reports refresh-failed (retaining tokens) when transient and already expired", async () => {
+    const s = store(tokens({ expiresAt: NOW - 1_000 }));
+    const outcome = await s.bearer(async () => ({ kind: "transient" }));
+    expect(outcome).toEqual({ kind: "refresh-failed" });
+    expect(s.current()).not.toBeNull(); // a later demand retries
+  });
+
+  it("treats a thrown exchange as transient", async () => {
+    const s = store(tokens({ expiresAt: NOW + 10_000 }));
+    const outcome = await s.bearer(async () => {
+      throw new Error("network down");
+    });
+    expect(outcome).toEqual({ kind: "bearer", token: "access-1" });
+  });
+
+  it("single-flights concurrent refreshes so a one-time refresh token is never raced", async () => {
+    const s = store(tokens({ expiresAt: NOW + 10_000 }));
+    let exchanges = 0;
+    let release: (result: RefreshResult) => void = () => {};
+    const gate = new Promise<RefreshResult>((resolve) => {
+      release = resolve;
+    });
+    const exchange = async (prior: StoredTokens) => {
+      exchanges++;
+      const result = await gate;
+      return result.kind === "refreshed"
+        ? {
+            kind: "refreshed" as const,
+            tokens: { ...prior, accessToken: "access-2" },
+          }
+        : result;
+    };
+    const first = s.bearer(exchange);
+    const second = s.bearer(exchange);
+    release({ kind: "refreshed", tokens: tokens() });
+    const outcomes: BearerOutcome[] = await Promise.all([first, second]);
+    expect(exchanges).toBe(1);
+    for (const outcome of outcomes) {
+      expect(outcome).toEqual({ kind: "bearer", token: "access-2" });
+    }
+  });
+
+  it("requires login when signed out, and expires an unrefreshable token", async () => {
+    const fresh = store(null);
+    expect(await fresh.bearer(async () => ({ kind: "transient" }))).toEqual({
+      kind: "login-required",
+      reason: "signed-out",
+    });
+    const unrefreshable = store(
+      tokens({ expiresAt: NOW - 1, refreshToken: "" }),
+    );
+    expect(
+      await unrefreshable.bearer(async () => ({ kind: "transient" })),
+    ).toEqual({ kind: "login-required", reason: "expired" });
+    expect(unrefreshable.snapshot()).toEqual({ state: "expired" });
+  });
+});
diff --git a/studio/src/lib/oidc/token-store.ts b/studio/src/lib/oidc/token-store.ts
new file mode 100644
index 0000000000..4f67f4d628
--- /dev/null
+++ b/studio/src/lib/oidc/token-store.ts
@@ -0,0 +1,218 @@
+/**
+ * The OIDC token store for Studio's server tier (requirement H3): process
+ * memory only — tokens never reach the browser (CLAUDE.md rule 3) and are
+ * never written to disk, so a Next server restart deliberately requires a
+ * fresh sign-in (v1 defers durable/keyring storage; ADR 0277's encrypted
+ * credential store is the eventual model).
+ *
+ * Refresh discipline mirrors mecatui's `internal/adapter/clientauth`
+ * (ADR 0270/0277): refresh only on token DEMAND inside the 30-second
+ * refresh-ahead window (demand-driven refresh IS the activity gate — there is
+ * no background timer to keep an idle provider SSO session alive),
+ * single-flight so a rotated one-time refresh token is never raced, and
+ * `invalid_grant` classified STRUCTURALLY (the exact RFC 6749 section 5.2
+ * `error` code off the token endpoint's JSON body — provider prose and nested
+ * descriptions never classify) before the credential is dropped.
+ */
+
+export const REFRESH_AHEAD_MS = 30_000;
+
+/** Display-only identity claims parsed (unverified) from the id_token. The
+ * daemon does the real validation; Studio never authorizes on these. */
+export type OidcClaims = {
+  sub?: string;
+  email?: string;
+  preferredUsername?: string;
+};
+
+export type StoredTokens = {
+  accessToken: string;
+  /** Empty when the provider issued none (refresh then impossible). */
+  refreshToken: string;
+  /** Epoch milliseconds. */
+  expiresAt: number;
+  claims: OidcClaims;
+};
+
+export type SignedOutReason = "signed-out" | "expired";
+
+export type BearerOutcome =
+  | { kind: "bearer"; token: string }
+  | { kind: "login-required"; reason: SignedOutReason }
+  /** A transient refresh failure with no still-valid access token to fall
+   * back on. Tokens are retained so a later demand can retry. */
+  | { kind: "refresh-failed" };
+
+export type RefreshResult =
+  | { kind: "refreshed"; tokens: StoredTokens }
+  | { kind: "invalid-grant" }
+  | { kind: "transient" };
+
+/** The provider exchange, injected so the store stays pure and offline-testable. */
+export type RefreshExchange = (prior: StoredTokens) => Promise<RefreshResult>;
+
+export function tokenDecision(
+  tokens: StoredTokens | null,
+  now: number,
+): "use" | "refresh" | "login-required" {
+  if (!tokens?.accessToken) return "login-required";
+  if (tokens.expiresAt - now > REFRESH_AHEAD_MS) return "use";
+  return tokens.refreshToken ? "refresh" : "login-required";
+}
+
+/**
+ * RFC 6749 section 5.2 structured classification, mirroring clientauth's
+ * `isInvalidGrant` (an `oauth2.RetrieveError` with the EXACT ErrorCode): a
+ * failed token response whose JSON body carries `error: "invalid_grant"`
+ * byte-exactly. `error_description` prose never classifies.
+ */
+export function isInvalidGrantResponse(status: number, body: unknown): boolean {
+  return (
+    (status < 200 || status >= 300) &&
+    typeof body === "object" &&
+    body !== null &&
+    (body as { error?: unknown }).error === "invalid_grant"
+  );
+}
+
+/** Expiry from a token response's `expires_in`, floored/defaulted like the
+ * controller's gateway refresh (default 300s, floor 60s). */
+export function tokenExpiryMs(expiresIn: unknown, now: number): number {
+  return now + Math.max(60, Number(expiresIn) || 300) * 1000;
+}
+
+/** Unverified, display-only parse of a JWT payload (see OidcClaims). */
+export function claimsFromIdToken(idToken: string): OidcClaims | null {
+  const payload = idToken.split(".")[1];
+  if (!payload) return null;
+  try {
+    const decoded = JSON.parse(
+      Buffer.from(payload, "base64url").toString("utf8"),
+    ) as Record<string, unknown>;
+    const readString = (key: string) =>
+      typeof decoded[key] === "string" ? (decoded[key] as string) : undefined;
+    return {
+      sub: readString("sub"),
+      email: readString("email"),
+      preferredUsername: readString("preferred_username"),
+    };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Build the replacement credential from a SUCCESSFUL refresh response:
+ * adopt a rotated refresh token when the provider sent one, otherwise keep
+ * the prior one (RFC 6749 section 6 — rotation is optional), and keep the
+ * prior claims unless a fresh id_token parses.
+ */
+export function tokensFromRefreshResponse(
+  body: Record<string, unknown>,
+  prior: StoredTokens,
+  now: number,
+): StoredTokens | null {
+  const accessToken =
+    typeof body.access_token === "string" ? body.access_token : "";
+  if (!accessToken) return null;
+  const rotated =
+    typeof body.refresh_token === "string" && body.refresh_token
+      ? body.refresh_token
+      : prior.refreshToken;
+  const claims =
+    (typeof body.id_token === "string" && claimsFromIdToken(body.id_token)) ||
+    prior.claims;
+  return {
+    accessToken,
+    refreshToken: rotated,
+    expiresAt: tokenExpiryMs(body.expires_in, now),
+    claims,
+  };
+}
+
+export type StoreSnapshot =
+  | { state: "signed-out" | "expired" }
+  | { state: "signed-in"; claims: OidcClaims; expiresAt: number };
+
+export class OidcTokenStore {
+  private tokens: StoredTokens | null = null;
+  private reason: SignedOutReason = "signed-out";
+  private inflight: Promise<BearerOutcome> | null = null;
+
+  constructor(private readonly now: () => number = Date.now) {}
+
+  setTokens(tokens: StoredTokens): void {
+    this.tokens = tokens;
+    this.reason = "signed-out";
+  }
+
+  /** Drop the credential. `reason` records WHY for the next 401's copy. */
+  clear(reason: SignedOutReason = "signed-out"): void {
+    this.tokens = null;
+    this.reason = reason;
+  }
+
+  current(): StoredTokens | null {
+    return this.tokens;
+  }
+
+  snapshot(): StoreSnapshot {
+    if (this.tokens) {
+      return {
+        state: "signed-in",
+        claims: this.tokens.claims,
+        expiresAt: this.tokens.expiresAt,
+      };
+    }
+    return { state: this.reason };
+  }
+
+  /**
+   * Obtain a bearer for one proxied request: reuse a token outside the
+   * refresh-ahead window, refresh (single-flight) inside it, and report
+   * login-required with an honest reason otherwise.
+   */
+  async bearer(exchange: RefreshExchange): Promise<BearerOutcome> {
+    const decision = tokenDecision(this.tokens, this.now());
+    if (decision === "use" && this.tokens) {
+      return { kind: "bearer", token: this.tokens.accessToken };
+    }
+    if (decision === "login-required") {
+      if (this.tokens) this.clear("expired"); // expired with no refresh token
+      return { kind: "login-required", reason: this.reason };
+    }
+    if (!this.inflight) {
+      this.inflight = this.refresh(exchange).finally(() => {
+        this.inflight = null;
+      });
+    }
+    return this.inflight;
+  }
+
+  private async refresh(exchange: RefreshExchange): Promise<BearerOutcome> {
+    const prior = this.tokens;
+    if (!prior) return { kind: "login-required", reason: this.reason };
+    let result: RefreshResult;
+    try {
+      result = await exchange(prior);
+    } catch {
+      result = { kind: "transient" };
+    }
+    if (result.kind === "refreshed") {
+      this.setTokens(result.tokens);
+      return { kind: "bearer", token: result.tokens.accessToken };
+    }
+    if (result.kind === "invalid-grant") {
+      // The provider rejected the refresh token itself — the session is over.
+      // Drop the credential (clientauth parity) so the UI can say so.
+      this.clear("expired");
+      return { kind: "login-required", reason: "expired" };
+    }
+    // Transient (network/5xx/malformed body): keep the credential. A token
+    // that has not actually expired yet still serves this request.
+    if (prior.expiresAt > this.now()) {
+      return { kind: "bearer", token: prior.accessToken };
+    }
+    return { kind: "refresh-failed" };
+  }
+}
diff --git a/studio/src/lib/request-trust.test.ts b/studio/src/lib/request-trust.test.ts
index 501fa3d670..d25338f5c1 100644
--- a/studio/src/lib/request-trust.test.ts
+++ b/studio/src/lib/request-trust.test.ts
@@ -37,7 +37,7 @@ describe("studioAllowedOrigins", () => {
 
 /** The CSRF/DNS-rebinding truth table, mirroring the hermetic suite's idiom
  * (tests/rendered-html.test.mjs) for the shared server-tier check the proxy
- * routes run. */
+ * routes AND the OIDC auth routes run. */
 describe("requestIsTrusted", () => {
   const allowed = new Set(["http://localhost:3000"]);
   const table: Array<{
@@ -47,7 +47,7 @@ describe("requestIsTrusted", () => {
   }> = [
     {
       name: "same-origin navigation with no Origin header",
-      request: fakeRequest("http://localhost:3000/api/mecatl-control/status", {
+      request: fakeRequest("http://localhost:3000/api/auth/oidc/start", {
         host: "localhost:3000",
       }),
       trusted: true,
@@ -62,7 +62,7 @@ describe("requestIsTrusted", () => {
     },
     {
       name: "cross-site request (CSRF): hostile Origin",
-      request: fakeRequest("http://localhost:3000/api/mecatl/v1/sessions", {
+      request: fakeRequest("http://localhost:3000/api/auth/oidc/logout", {
         host: "localhost:3000",
         origin: "https://evil.example",
       }),
@@ -77,7 +77,7 @@ describe("requestIsTrusted", () => {
     },
     {
       name: "host absent falls back to the request URL's host",
-      request: fakeRequest("http://localhost:3000/api/mecatl-control/status"),
+      request: fakeRequest("http://localhost:3000/api/auth/oidc/status"),
       trusted: true,
     },
   ];
@@ -92,7 +92,7 @@ describe("requestIsTrusted", () => {
     const https = new Set(["https://studio.example"]);
     expect(
       requestIsTrusted(
-        fakeRequest("http://studio.example/api/mecatl/v1/models", {
+        fakeRequest("http://studio.example/api/auth/oidc/status", {
           host: "studio.example",
           "x-forwarded-proto": "https",
         }),
@@ -101,7 +101,7 @@ describe("requestIsTrusted", () => {
     ).toBe(true);
     expect(
       requestIsTrusted(
-        fakeRequest("http://studio.example/api/mecatl/v1/models", {
+        fakeRequest("http://studio.example/api/auth/oidc/status", {
           host: "studio.example",
           "x-forwarded-proto": "http",
         }),
diff --git a/studio/src/lib/server-proxy.ts b/studio/src/lib/server-proxy.ts
index f542ce652d..73427d6694 100644
--- a/studio/src/lib/server-proxy.ts
+++ b/studio/src/lib/server-proxy.ts
@@ -1,5 +1,6 @@
 import "server-only";
 
+import { resolveExternalAuthorization } from "@/lib/oidc-session";
 import { requestIsTrusted } from "@/lib/request-trust";
 
 const controllerBaseURL = "http://127.0.0.1:8788";
@@ -131,12 +132,22 @@ export async function proxyMecatl(request: Request, path: string[]) {
   target.search = new URL(request.url).search;
   const headers = copyRequestHeaders(request);
   if (external) {
-    const token = process.env.MECATL_AUTH_TOKEN?.trim();
-    if (token)
-      headers.set(
-        "authorization",
-        `Bearer ${token.replace(/^Bearer\s+/i, "")}`,
+    // Bearer injection (rule 3 — credentials never come from the browser):
+    // an OIDC-configured deployment injects the CURRENT access token
+    // (refreshed server-side on demand, requirement H3); without OIDC config
+    // this is the static MECATL_AUTH_TOKEN path, unchanged. A signed-out or
+    // expired OIDC session answers 401 with actionable copy instead of
+    // forwarding a request the daemon would reject opaquely.
+    const auth = await resolveExternalAuthorization();
+    if (auth.kind === "unauthorized")
+      return Response.json(
+        { error: auth.error, code: auth.code },
+        { status: auth.status },
       );
+    if (auth.kind === "unavailable")
+      return Response.json({ error: auth.error }, { status: auth.status });
+    if (auth.kind === "bearer")
+      headers.set("authorization", `Bearer ${auth.token}`);
   } else {
     headers.set("x-mecatl-studio-request", "1");
   }
diff --git a/user-docs/building/what-you-get/studio.md b/user-docs/building/what-you-get/studio.md
index 80d5169441..4413a4eeae 100644
--- a/user-docs/building/what-you-get/studio.md
+++ b/user-docs/building/what-you-get/studio.md
@@ -12,8 +12,8 @@ Studio reads and writes the daemon's state rather than keeping its own.
 
 :::note Landing in progress
 Studio is landing as a stacked series of pull requests. This page grows with
-each one; right now everything except external-mode sign-in and the advanced chat
-tiers is in the tree.
+each one; right now everything except the advanced chat tiers (attachments, steering,
+threads, live re-attach, modes, mobile) is in the tree.
 :::
 
 ## Starting it
@@ -102,3 +102,11 @@ material never crosses to the browser. The MCP gateway URL is user-entered
 but always validated, and egress is HTTPS-only (loopback HTTP sits behind an
 operator env opt-in). In external mode all of this reads as owned by the
 deployment. The About-this-daemon card reports the safe identity probe.
+
+## External-mode sign-in (OIDC)
+
+When an external daemon sits behind an OIDC-aware gateway, the settings
+provider page offers sign-in: Studio's server tier runs the PKCE flow itself
+and holds tokens in process memory only — nothing token-shaped reaches the
+browser or disk. With OIDC unconfigured, the static `MECATL_AUTH_TOKEN` path
+is untouched. Managed mode never uses either.