diff --git a/frontend/src/App.jsx b/frontend/src/App.jsx
index 4d320ba..d376925 100644
--- a/frontend/src/App.jsx
+++ b/frontend/src/App.jsx
@@ -90,11 +90,11 @@ const App = () => {
       const response = await fetch('/api/auth/login', { method: 'POST' });
       const data = await response.json();
       setAuthStatus(prev => ({ ...prev, ...data }));
-      if (data.auth_url) {
-        window.open(data.auth_url, '_blank');
-      } else if (data.status === 'error') {
+      if (data.status === 'error') {
         alert(data.message || 'Login failed. Check container logs.');
       }
+      // Don't try window.open — popup blockers kill it.
+      // The auth_url will be shown as a clickable link in the pending state.
     } catch (error) {
       console.error('Error initiating login:', error);
       alert('Failed to connect to auth endpoint');
@@ -255,13 +255,18 @@ const App = () => {
             {authStatus?.status === 'logged_in' ? (
               <span className="auth-ok" title={authStatus.account}>● {authStatus.account || 'Logged in'}</span>
             ) : authStatus?.status === 'pending' ? (
-              <form className="header-code-form" onSubmit={handleSubmitCode}>
-                <input type="text" placeholder="Paste auth code here" value={authCode}
-                  onChange={e => setAuthCode(e.target.value)} className="header-code-input" />
-                <button type="submit" className="header-code-btn" disabled={codeSubmitting}>
-                  {codeSubmitting ? '…' : '→'}
-                </button>
-              </form>
+              <div className="header-auth-pending">
+                {authStatus.auth_url && (
+                  <a href={authStatus.auth_url} target="_blank" rel="noreferrer" className="header-auth-link">1. Open login →</a>
+                )}
+                <form className="header-code-form" onSubmit={handleSubmitCode}>
+                  <input type="text" placeholder="2. Paste code" value={authCode}
+                    onChange={e => setAuthCode(e.target.value)} className="header-code-input" />
+                  <button type="submit" className="header-code-btn" disabled={codeSubmitting}>
+                    {codeSubmitting ? '…' : '→'}
+                  </button>
+                </form>
+              </div>
             ) : (
               <button className="auth-login-btn" onClick={handleLogin} disabled={loginLoading}>
                 {loginLoading ? '⏳ Connecting…' : '🔐 Login with Claude Max'}