diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index 3285416..539ca90 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -217,15 +217,23 @@ async function createApp() {
   //   /api/v1/auth/app-token/<id>   -> /api/v1/auth/app-token/<id>      (drift)
   //   /api/auth/totp/check-session  -> /api/v1/totp/check-session       (mounted at /totp/check-session — no /auth prefix)
   //   /api/v1/auth/totp/check-session->/api/v1/totp/check-session       (drift)
+  //   /api/auth/sso-exchange         -> /api/v1/auth/sso-exchange       (mounted at /auth/sso-exchange, same shape as gate/app-token)
   //
   // The totp case drops `/auth` because the canonical route is /totp/check-session
   // (no /auth prefix) but the legacy JS still uses /api/auth/totp/check-session
   // (and a stale-browser version of the page uses /api/v1/auth/totp/check-session).
   // Without these rewrites the JS gets a 404 and the page hangs at
   // "Signing in to Plex..." forever (user-reported 2026-07-09).
+  //
+  // sso-exchange added 2026-07-24: same Caddy handle_path /dashcaddy-api/*
+  // strips only the /dashcaddy-api prefix, so the login-page JS's fetch to
+  // /dashcaddy-api/api/auth/sso-exchange arrives here as /api/auth/sso-exchange
+  // — needs the same rewrite as gate/app-token, not the check-session one
+  // (this route's canonical mount already includes /auth/).
   app.use((req, res, next) => {
     if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/v1/auth/gate/')
-        || req.url.startsWith('/api/auth/app-token/') || req.url.startsWith('/api/v1/auth/app-token/')) {
+        || req.url.startsWith('/api/auth/app-token/') || req.url.startsWith('/api/v1/auth/app-token/')
+        || req.url.startsWith('/api/auth/sso-exchange')) {
       req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
     } else if (req.url.startsWith('/api/auth/totp/check-session')) {
       // Legacy: /api/auth/totp/check-session -> /api/v1/totp/check-session