diff --git a/.env.example b/.env.example
index d3ba41f..7459089 100644
--- a/.env.example
+++ b/.env.example
@@ -5,3 +5,18 @@ MAILCHIMP_TAG=v2 Website Signups
# The Graph (optional — falls back to hardcoded values)
THEGRAPH_API_KEY=
+
+# PymtHouse integration (required for Studio auth/device flow)
+# Issuer must be the full OIDC issuer URL, e.g. http://localhost:3001/api/v1/oidc
+# (site origin is derived from this URL in code — no PMTHOUSE_BASE_URL)
+PYMTHOUSE_ISSUER_URL=
+# Public OIDC client id (app_...)
+PYMTHOUSE_PUBLIC_CLIENT_ID=
+# Confidential helper client id (m2m_...)
+PYMTHOUSE_M2M_CLIENT_ID=
+# Confidential helper secret (pmth_cs_...)
+PYMTHOUSE_M2M_CLIENT_SECRET=
+
+# Website session signing secret
+# Generate with: openssl rand -base64 32
+LP_SESSION_SECRET=
diff --git a/.gitignore b/.gitignore
index 219d8bd..41ec2d2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -50,3 +50,5 @@ img/
.vscode/
*.code-workspace
.playwright-mcp/
+
+certificates
\ No newline at end of file
diff --git a/app/(studio)/studio/header-qa/page.tsx b/app/(studio)/studio/header-qa/page.tsx
index cda6f97..cfa92b5 100644
--- a/app/(studio)/studio/header-qa/page.tsx
+++ b/app/(studio)/studio/header-qa/page.tsx
@@ -34,7 +34,7 @@ export default function HeaderQaPage() {
))}
+ {deviceFlow && (
+
+ Complete sign-in to approve your pending device login.
+
+ )}
+ {loginError && (
+
+ We could not continue the device authorization flow. Please sign
+ in and try again.
+
+ )}
@@ -167,6 +228,7 @@ export default function LoginPage() {