diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 7dc48a3..92b57f7 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -303,6 +303,17 @@
   } catch {
     // ignore
   }
+  // navi-style: reload so /me answers 401 and the SPA shows its internal
+  // login screen; going to /auth/login here would silently auto-login
+  // through the still-alive SSO session
+  window.location.reload();
+}
+
+// the sign-in gate is rendered instead of the shell after a 401 on load
+const showLogin = ref(false);
+
+function loginNow() {
+  // explicit user click starts OAuth — no silent SSO bounce on load
   window.location.href = "/auth/login";
 }
 const canCreateSecret = computed(() => Boolean(form.title.trim() && parseCreateFields().length));
@@ -1109,8 +1120,12 @@
     await loadSecrets();
     await syncTabFromRoute(true);
     window.addEventListener("popstate", onPopState);
-  } catch {
-    window.location.href = "/auth/login";
+  } catch (err) {
+    if (err?.status === 401) {
+      showLogin.value = true;
+    } else {
+      window.location.href = "/auth/login";
+    }
   }
 });
 
@@ -1179,7 +1194,18 @@
 
 <template>
   <GnToastProvider ref="toastProvider">
+    <div v-if="showLogin" class="login-screen">
+      <article class="card login-screen-card">
+        <img src="/logo.svg" alt="" class="login-screen-logo" />
+        <h1 class="login-screen-title">{{ t("login.title") }}</h1>
+        <p class="login-screen-subtitle">{{ t("login.subtitle") }}</p>
+        <GnButton variant="primary" icon="ph ph-sign-in" @click="loginNow">
+          {{ t("login.action") }}
+        </GnButton>
+      </article>
+    </div>
     <GnNavigationShell
+      v-else
       brand="GNEXUS CREDS"
       logo-src="/logo.svg"
       title="GNEXUS CREDS"
diff --git a/frontend/src/api.js b/frontend/src/api.js
index c2bf929..6d2c383 100644
--- a/frontend/src/api.js
+++ b/frontend/src/api.js
@@ -21,7 +21,9 @@
       }
       const payload = await response.json();
       if (!response.ok) {
-        throw new Error(payload?.error?.message || "Request failed");
+        const error = new Error(payload?.error?.message || "Request failed");
+        error.status = response.status;
+        throw error;
       }
       return payload;
     } catch (err) {
diff --git a/frontend/src/i18n/messages/en.js b/frontend/src/i18n/messages/en.js
index e2ae01c..47d7019 100644
--- a/frontend/src/i18n/messages/en.js
+++ b/frontend/src/i18n/messages/en.js
@@ -7,6 +7,9 @@
   "nav.audit": "Audit",
   "nav.tokens": "Tokens",
   "nav.extension": "Extension",
+  "login.title": "Welcome to GNEXUS CREDS",
+  "login.subtitle": "Sign in to access your secrets",
+  "login.action": "Sign in with GNEXUS",
   "nav.settings": "Settings",
   "nav.admin": "Admin",
 
diff --git a/frontend/src/i18n/messages/ru.js b/frontend/src/i18n/messages/ru.js
index ea64881..1c284b3 100644
--- a/frontend/src/i18n/messages/ru.js
+++ b/frontend/src/i18n/messages/ru.js
@@ -5,6 +5,9 @@
   "nav.audit": "Аудит",
   "nav.tokens": "Токены",
   "nav.extension": "Расширение",
+  "login.title": "Добро пожаловать в GNEXUS CREDS",
+  "login.subtitle": "Войдите, чтобы получить доступ к секретам",
+  "login.action": "Войти через GNEXUS",
   "nav.settings": "Настройки",
   "nav.admin": "Админ",
 
diff --git a/frontend/src/i18n/messages/uk.js b/frontend/src/i18n/messages/uk.js
index 958eeed..5200464 100644
--- a/frontend/src/i18n/messages/uk.js
+++ b/frontend/src/i18n/messages/uk.js
@@ -5,6 +5,9 @@
   "nav.audit": "Аудит",
   "nav.tokens": "Токени",
   "nav.extension": "Розширення",
+  "login.title": "Вітаємо у GNEXUS CREDS",
+  "login.subtitle": "Увійдіть, щоб отримати доступ до секретів",
+  "login.action": "Увійти через GNEXUS",
   "nav.settings": "Налаштування",
   "nav.admin": "Адмін",
 
diff --git a/frontend/src/styles.css b/frontend/src/styles.css
index dc60236..1c4de8b 100644
--- a/frontend/src/styles.css
+++ b/frontend/src/styles.css
@@ -214,6 +214,39 @@
   justify-content: flex-end;
 }
 
+/* navi-style sign-in gate: full-screen overlay card with a single button;
+   OAuth must start from the click, not from page load */
+.login-screen {
+  min-height: 100vh;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 24px;
+}
+
+.login-screen-card {
+  width: 100%;
+  max-width: 380px;
+  padding: 40px 32px;
+  text-align: center;
+  min-width: 0;
+}
+
+.login-screen-logo {
+  width: 56px;
+  height: 56px;
+  margin: 0 auto 18px;
+  display: block;
+}
+
+.login-screen-title {
+  margin-bottom: 6px;
+}
+
+.login-screen-subtitle {
+  margin-bottom: 22px;
+}
+
 /* language pick on the Settings page: a form control, not a toolbar action */
 .create-actions .language-select {
   flex: 0 1 320px;