diff --git a/dashcaddy-api/src/app.js b/dashcaddy-api/src/app.js
index cf03b17..b9c8595 100644
--- a/dashcaddy-api/src/app.js
+++ b/dashcaddy-api/src/app.js
@@ -196,15 +196,23 @@ async function createApp() {
   // three auth paths to the v1 mount so the gate is tolerant of that drift.
   // Must run before configureMiddleware() so CSRF/auth see the canonical path.
   // This is deliberately narrow — NOT a general `/api` -> `/api/v1` alias.
-  // /api/auth/totp/check-session is added because the auto-login page JS in
-  // sso-gate.js (buildLoginPage) uses the legacy prefix; without this rewrite
-  // the JS gets a 404 and the page hangs at "Signing in to Plex..." forever
-  // (user-reported 2026-07-09).
+  //
+  // Path mapping (legacy -> canonical):
+  //   /api/auth/gate/<id>           -> /api/v1/auth/gate/<id>           (mounted at /auth/gate/:serviceId)
+  //   /api/auth/app-token/<id>      -> /api/v1/auth/app-token/<id>      (mounted at /auth/app-token/:serviceId)
+  //   /api/auth/totp/check-session  -> /api/v1/totp/check-session       (mounted at /totp/check-session — no /auth prefix)
+  //
+  // The totp case drops `/auth` because the canonical route is /totp/check-session
+  // (no /auth prefix) but the legacy JS still uses /api/auth/totp/check-session.
+  // Without this rewrite the JS gets a 404 and the page hangs at
+  // "Signing in to Plex..." forever (user-reported 2026-07-09).
   app.use((req, res, next) => {
-    if (req.url.startsWith('/api/auth/gate/')
-        || req.url.startsWith('/api/auth/app-token/')
-        || req.url.startsWith('/api/auth/totp/check-session')) {
+    if (req.url.startsWith('/api/auth/gate/') || req.url.startsWith('/api/auth/app-token/')) {
       req.url = '/api/v1' + req.url.slice(4); // '/api'.length === 4
+    } else if (req.url.startsWith('/api/auth/totp/check-session')) {
+      // Legacy: /api/auth/totp/check-session -> /api/v1/totp/check-session
+      // Drop both '/api' and '/auth' prefixes (9 chars total).
+      req.url = '/api/v1' + req.url.slice(9); // '/api/auth'.length === 9
     }
     next();
   });