diff --git a/bskyweb/cmd/bskyweb/server.go b/bskyweb/cmd/bskyweb/server.go
index f3230c0d87..17b169bf16 100644
--- a/bskyweb/cmd/bskyweb/server.go
+++ b/bskyweb/cmd/bskyweb/server.go
@@ -331,6 +331,9 @@ func serve(cctx *cli.Context) error {
 	e.GET("/starter-pack-short/:code", server.WebGeneric)
 	e.GET("/start/:handleOrDID/:rkey", server.WebStarterPack)
 
+	// auth callback
+	e.GET("/auth/web/callback", server.WebGeneric)
+
 	// ipcc
 	e.GET("/ipcc", server.WebIpCC)
 
diff --git a/bskyweb/static/oauth-client-metadata.json b/bskyweb/static/oauth-client-metadata.json
index 7756f2f6f7..7593b5df85 100644
--- a/bskyweb/static/oauth-client-metadata.json
+++ b/bskyweb/static/oauth-client-metadata.json
@@ -3,7 +3,7 @@
 	"client_name": "Bluesky (Hailey Demo)",
 	"client_uri": "https://bsky.hailey.at",
 	"redirect_uris": [
-		"https://bsky.hailey.at/auth/callback"
+		"https://bsky.hailey.at/auth/web/callback"
 	],
 	"scope": "atproto transition:generic",
 	"token_endpoint_auth_method": "none",
diff --git a/bskyweb/static/oauth-client-metadata.native.json b/bskyweb/static/oauth-client-metadata.native.json
index fd3ca49d39..483c26b2be 100644
--- a/bskyweb/static/oauth-client-metadata.native.json
+++ b/bskyweb/static/oauth-client-metadata.native.json
@@ -3,7 +3,7 @@
 	"client_name": "Bluesky Native App (Hailey Demo)",
 	"client_uri": "https://bsky.hailey.at",
 	"redirect_uris": [
-		"at.hailey.bsky:/auth/callback"
+		"at.hailey.bsky:/auth/native/callback"
 	],
 	"scope": "atproto transition:generic",
 	"token_endpoint_auth_method": "none",
diff --git a/src/Navigation.tsx b/src/Navigation.tsx
index 97c351bc86..7cf2ce424f 100644
--- a/src/Navigation.tsx
+++ b/src/Navigation.tsx
@@ -135,6 +135,7 @@ import {router} from '#/routes'
 import {Referrer} from '../modules/expo-bluesky-swiss-army'
 import {useAccountSwitcher} from './lib/hooks/useAccountSwitcher'
 import {useNonReactiveCallback} from './lib/hooks/useNonReactiveCallback'
+import {AuthCallback} from './screens/Login/AuthCallback'
 import {useLoggedOutViewControls} from './state/shell/logged-out'
 import {useCloseAllActiveElements} from './state/util'
 
@@ -600,6 +601,13 @@ function commonScreens(Stack: typeof Flat, unreadCountLabel?: string) {
           requireAuth: true,
         }}
       />
+      <Stack.Screen
+        name="AuthCallback"
+        getComponent={() => AuthCallback}
+        options={{
+          title: title(msg`Authenticating...`),
+        }}
+      />
     </>
   )
 }
diff --git a/src/lib/routes/types.ts b/src/lib/routes/types.ts
index b1db5caa64..616794dbc8 100644
--- a/src/lib/routes/types.ts
+++ b/src/lib/routes/types.ts
@@ -82,6 +82,7 @@ export type CommonNavigatorParams = {
   StarterPackWizard: undefined
   StarterPackEdit: {rkey?: string}
   VideoFeed: VideoFeedSourceContext
+  AuthCallback: undefined
 }
 
 export type BottomTabNavigatorParams = CommonNavigatorParams & {
diff --git a/src/routes.ts b/src/routes.ts
index 7fc673e2be..659517e1e4 100644
--- a/src/routes.ts
+++ b/src/routes.ts
@@ -90,4 +90,5 @@ export const router = new Router<AllNavigatableRoutes>({
   StarterPackShort: '/starter-pack-short/:code',
   StarterPackWizard: '/starter-pack/create',
   VideoFeed: '/video-feed',
+  AuthCallback: '/auth/web/callback',
 })
diff --git a/src/screens/Login/AuthCallback.tsx b/src/screens/Login/AuthCallback.tsx
new file mode 100644
index 0000000000..90682ac54c
--- /dev/null
+++ b/src/screens/Login/AuthCallback.tsx
@@ -0,0 +1,27 @@
+import {useEffect} from 'react'
+import {useNavigation} from '@react-navigation/native'
+
+import {type NavigationProp} from '#/lib/routes/types'
+import {useSessionApi} from '#/state/session'
+import {getWebOAuthClient} from '#/state/session/oauth'
+
+export function AuthCallback() {
+  const {loginOauth} = useSessionApi()
+  const navigation = useNavigation<NavigationProp>()
+
+  // TODO: handle errors, loading state, etc...
+  useEffect(() => {
+    const urlStr = window.location.href
+    const url = new URL(urlStr)
+    const params = new URLSearchParams(url.hash.substring(1))
+
+    ;(async () => {
+      const client = getWebOAuthClient()
+      const res = await client.callback(params)
+      await loginOauth(res.session, 'LoginForm') // TODO: right context?
+      navigation.navigate('Home')
+    })()
+  }, [loginOauth, navigation])
+
+  return null
+}
diff --git a/src/state/session/oauth.tsx b/src/state/session/oauth.tsx
index 6327bdb3bf..a8c4eae2a3 100644
--- a/src/state/session/oauth.tsx
+++ b/src/state/session/oauth.tsx
@@ -12,7 +12,7 @@ export function createWebOAuthClient() {
       client_id: 'https://bsky.hailey.at/oauth-client-metadata.json',
       client_name: 'Bluesky (Hailey Demo)',
       client_uri: 'https://bsky.hailey.at',
-      redirect_uris: ['https://bsky.hailey.at/auth/callback'],
+      redirect_uris: ['https://bsky.hailey.at/auth/web/callback'],
       scope: 'atproto transition:generic',
       token_endpoint_auth_method: 'none',
       response_types: ['code'],
@@ -30,7 +30,7 @@ export function createNativeOAuthClient() {
       client_id: 'https://bsky.hailey.at/oauth-client-metadata.native.json',
       client_name: 'Bluesky Native App (Hailey Demo)',
       client_uri: 'https://bsky.hailey.at',
-      redirect_uris: ['at.hailey.bsky:/auth/callback'],
+      redirect_uris: ['at.hailey.bsky:/auth/native/callback'],
       scope: 'atproto transition:generic',
       token_endpoint_auth_method: 'none',
       response_types: ['code'],