diff --git a/app/assets/stylesheets/oauth.css b/app/assets/stylesheets/oauth.css
new file mode 100644
index 0000000000..e3a06d4f12
--- /dev/null
+++ b/app/assets/stylesheets/oauth.css
@@ -0,0 +1,125 @@
+/* Authorizing an app (oauth/authorizations) and the apps you've connected (my/connected_apps) */
+
+@layer components {
+  .oauth-consent {
+    display: flex;
+    flex-direction: column;
+    gap: var(--block-space);
+  }
+
+  .oauth-client__name {
+    overflow-wrap: anywhere;
+  }
+
+  .oauth-client__self-name {
+    overflow-wrap: anywhere;
+  }
+
+  /* A long email still leaves room for "Not you?": the row wraps, and the address breaks */
+  .oauth-consent__identity {
+    flex-wrap: wrap;
+
+    > span {
+      min-inline-size: 0;
+      overflow-wrap: anywhere;
+    }
+  }
+
+  .oauth-client__warning {
+    background-color: var(--color-highlight);
+    border-radius: 0.5em;
+    padding: var(--block-space-half) var(--inline-space);
+  }
+
+  .oauth-access {
+    border: 0;
+    margin: 0;
+    padding: 0;
+  }
+
+  .oauth-access__legend {
+    margin-block-end: var(--block-space-half);
+    padding: 0;
+  }
+
+  .oauth-access__choice {
+    align-items: start;
+
+    /* A long account name breaks inside its card rather than widening it */
+    > span {
+      min-inline-size: 0;
+      overflow-wrap: anywhere;
+    }
+
+    border: var(--border);
+    border-radius: 0.5em;
+    cursor: pointer;
+    display: flex;
+    gap: var(--inline-space);
+    padding: var(--block-space-half) var(--inline-space);
+
+    &:has(:checked) {
+      border-color: var(--color-ink);
+    }
+
+    &:has(:focus-visible) {
+      outline: 2px solid var(--color-ink);
+      outline-offset: 2px;
+    }
+  }
+
+  .oauth-access__radio {
+    accent-color: var(--color-ink);
+    flex-shrink: 0;
+    margin-block-start: 0.2em;
+  }
+
+  .oauth-consent__actions {
+    flex-wrap: wrap;
+  }
+
+  .connected-apps {
+    display: flex;
+    flex-direction: column;
+    gap: var(--block-space);
+  }
+
+  .connected-apps__group {
+    display: flex;
+    flex-direction: column;
+  }
+
+  .connected-apps__empty {
+    border: 2px dashed var(--color-ink-lighter);
+    border-radius: 0.5em;
+    padding: var(--block-space) var(--inline-space-double);
+  }
+
+  .connected-app {
+    align-items: start;
+    border-block-end: var(--border);
+    display: flex;
+    gap: var(--inline-space);
+    justify-content: space-between;
+    padding-block: var(--block-space-half);
+
+    &:last-child {
+      border-block-end: 0;
+    }
+
+    /* Narrow screens: the disconnect button drops under the details */
+    @media (max-width: 480px) {
+      flex-direction: column;
+    }
+  }
+
+  .connected-app__disconnect {
+    flex-shrink: 0;
+  }
+
+  .connected-app__details {
+    gap: 0.15em;
+    min-inline-size: 0;
+    overflow-wrap: anywhere;
+  }
+}
diff --git a/app/controllers/my/connected_apps_controller.rb b/app/controllers/my/connected_apps_controller.rb
index fb427f5043..ad7e0ccf75 100644
--- a/app/controllers/my/connected_apps_controller.rb
+++ b/app/controllers/my/connected_apps_controller.rb
@@ -29,7 +29,7 @@ def destroy
 
   private
     def set_connected_apps
-      tokens = oauth_tokens.unlapsed.includes(:oauth_client).order(:created_at)
+      tokens = oauth_tokens.unlapsed.includes(:oauth_client, :account).order(:created_at)
       @connected_apps = tokens.group_by(&:oauth_client).sort_by { |client, _| client.name.downcase }
     end
 
diff --git a/app/controllers/oauth/authorizations/switches_controller.rb b/app/controllers/oauth/authorizations/switches_controller.rb
new file mode 100644
index 0000000000..8cbec24fd0
--- /dev/null
+++ b/app/controllers/oauth/authorizations/switches_controller.rb
@@ -0,0 +1,50 @@
+# "Not you?" on the consent screen. Signs the person out, then brings whoever
+# signs in next back to the same authorization request. The request is rebuilt
+# from its parameters once they have passed every check the consent screen's
+# did, never taken as a URL, so the only place this can return anyone to is
+# consent for that request. The account choice isn't carried: it was the
+# signed-out identity's, so the account check that guards granting doesn't
+# apply here. The resource is carried, so an audienced request comes back as
+# one, and its consent asks the new identity to pick an account.
+class Oauth::Authorizations::SwitchesController < Oauth::AuthorizationsController
+  AUTHORIZATION_PARAMS = %i[ client_id redirect_uri response_type scope state code_challenge code_challenge_method resource ]
+
+  # Account eligibility belongs to the identity being signed out, so neither
+  # account check applies; the request-level audience check still does.
+  skip_before_action :set_account, :set_accounts
+  before_action :require_browser_session
+
+
+  # A request too long to keep in the session can't be resumed, so the person
+  # stays signed in rather than signing out to nowhere.
+  def create
+    return_to = new_oauth_authorization_url(script_name: nil, **authorization_params)
+
+    if return_to.bytesize <= RETURN_URL_MAXIMUM_LENGTH
+      terminate_session
+      reset_session
+      session[:return_to_after_authenticating] = return_to
+
+      redirect_to_login_url
+    else
+      render_error "invalid_request", "This request is too long to pick up again after switching. Sign out, sign in as the right person, then connect from the app again."
+    end
+  end
+
+  private
+    # Switching signs a browser out. A request authenticated by a bearer token
+    # has no session to end, so it is refused rather than half-handled.
+    def require_browser_session
+      head :forbidden unless Current.session
+    end
+
+    # Switching identity is a POST but authorizes nothing, so a metadata
+    # document client is only read here, never registered.
+    def persist_metadata_document?
+      false
+    end
+
+    def authorization_params
+      params.permit(*AUTHORIZATION_PARAMS).to_h.symbolize_keys
+    end
+end
diff --git a/app/controllers/oauth/authorizations_controller.rb b/app/controllers/oauth/authorizations_controller.rb
index 088419ed72..803ad476f5 100644
--- a/app/controllers/oauth/authorizations_controller.rb
+++ b/app/controllers/oauth/authorizations_controller.rb
@@ -71,7 +71,7 @@ def create
       Oauth::Audit.record "code.issued", client: @client, identity_id: Current.identity.id, actor: "user"
       redirect_to success_redirect_uri(code), allow_other_host: true
     else
-      oauth_error "invalid_request", "Unknown client"
+      render_error "invalid_request", "Unknown client"
     end
   end
 
@@ -118,8 +118,9 @@ def set_client
       end
 
       unless performed?
+        # There's no client to send the browser back to, so the person is told here.
         if @client.nil?
-          oauth_error "invalid_request", "Unknown client"
+          render_error "invalid_request", "Unknown client"
         elsif !@client.allows_grant_type?("authorization_code")
           oauth_error "unauthorized_client", "Client may not use the authorization code grant"
         end
@@ -134,11 +135,15 @@ def metadata_document_client
       if denial?
         metadata_document_client_for_denial
       elsif Oauth::Availability.metadata_documents_enabled?(params[:client_id])
-        resolution = Oauth::ClientMetadata::Resolver.new(params[:client_id], requester: Current.identity).resolve(persist: request.post?)
+        resolution = Oauth::ClientMetadata::Resolver.new(params[:client_id], requester: Current.identity).resolve(persist: persist_metadata_document?)
         resolution.client || refuse_metadata_document(resolution)
       end
     end
 
+    def persist_metadata_document?
+      request.post?
+    end
+
     # A denial never registers a client, and stays reachable while metadata
     # documents are off: the stored row answers when it allows the redirect.
     # Otherwise (no row, or a stale one the consent screen saw past) the
@@ -267,10 +272,17 @@ def redirect_with_error(error, description)
       end
     end
 
+    # Shown here rather than sent back to the app, and counted like any OAuth
+    # error the app would have been sent.
     def render_error(error, description)
+      instrument_oauth_error error
       @error = error
       @error_description = description
-      render :error, status: :bad_request
+
+      respond_to do |format|
+        format.html { render :error, status: :bad_request }
+        format.json { render_oauth_error error, description, status: :bad_request }
+      end
     end
 
     def success_redirect_uri(code)
diff --git a/app/controllers/oauth/base_controller.rb b/app/controllers/oauth/base_controller.rb
index 9534561fb9..11e7568559 100644
--- a/app/controllers/oauth/base_controller.rb
+++ b/app/controllers/oauth/base_controller.rb
@@ -168,10 +168,13 @@ def prevent_referrer
     # them in Yabeda). The client is named by its type alone: a self-registered
     # client's id is anyone's to mint, so it can't be a metric label.
     def oauth_error(error, description = nil, status: :bad_request)
+      instrument_oauth_error error
+      render_oauth_error error, description, status: status
+    end
+
+    def instrument_oauth_error(error)
       ActiveSupport::Notifications.instrument "error.oauth",
         endpoint: controller_name, error_code: error, client_type: oauth_error_client&.client_type || "unknown"
-
-      render_oauth_error error, description, status: status
     end
 
     # A throttled request is counted as a rate-limit hit and not as an error,
diff --git a/app/helpers/oauth_helper.rb b/app/helpers/oauth_helper.rb
new file mode 100644
index 0000000000..1ada31e0cb
--- /dev/null
+++ b/app/helpers/oauth_helper.rb
@@ -0,0 +1,118 @@
+module OauthHelper
+  # Bidirectional controls can make a name read as something else, or push the
+  # host beside it out of place. A self-registered name is the app's own claim,
+  # so they go before it is shown anywhere.
+  BIDI_CONTROLS = /[؜‎‏‪-‮⁦-⁩]/
+
+  # Grouped by what the app is (Oauth::Client#connection_kind), in this order;
+  # a group with nothing in it isn't shown.
+  CONNECTED_APP_GROUPS = {
+    web: "Apps and assistants on the web",
+    local: "Apps on your devices",
+    fizzy: "Fizzy apps"
+  }
+
+  ACCESS_LEVELS = {
+    "read" => {
+      label: "Read only",
+      description: "See your boards, cards, comments and the people in your %{accounts}. It can't change anything."
+    },
+    "read write" => {
+      label: "Read and write",
+      description: "See everything you can, and act as you: create, edit, move, close and delete cards, comments and boards."
+    }
+  }
+
+  # A name of nothing but direction controls is no name, so it reads as one.
+  def oauth_client_self_name(client)
+    client.name.to_s.gsub(BIDI_CONTROLS, "").presence || "Unnamed app"
+  end
+
+  # Who the person is dealing with, as far as we can vouch for it. A trusted or
+  # operator-registered app is known by its name. A self-registered app's name
+  # is only its claim, so it goes by where its access goes: the callback's
+  # host, port included when it isn't the default, or this device.
+  def oauth_client_display_identity(client, redirect_uri)
+    if client.dynamically_registered?
+      oauth_redirect_host(redirect_uri) || "an app on your device"
+    else
+      oauth_client_self_name(client)
+    end
+  end
+
+  # Lowercase, as a browser reads it. nil for a callback that stays on this
+  # device: loopback, or an app's own URL scheme.
+  def oauth_redirect_host(redirect_uri)
+    uri = URI.parse(redirect_uri.to_s)
+
+    if uri.host.present? && !Oauth.loopback_host?(uri.host) && uri.scheme.to_s.downcase.in?(%w[ http https ])
+      uri.port == uri.default_port ? uri.host.downcase : "#{uri.host.downcase}:#{uri.port}"
+    end
+  rescue URI::InvalidURIError
+    nil
+  end
+
+  # Every place outside this device a client's access can go, as consent would
+  # name each one. A client may register several callbacks, and its grants may
+  # have come through any of them, so none speaks for the rest.
+  def oauth_client_remote_hosts(client)
+    client.redirect_uris.filter_map { |uri| oauth_redirect_host(uri) }.uniq
+  end
+
+  # The access levels a client may be granted, weakest first, each with what
+  # it lets the app do in plain words. A grant reaches every account the
+  # person belongs to, unless it's bound to the one picked at consent.
+  def oauth_access_levels(client, one_account: false)
+    levels = client.scopes.include?("write") ? ACCESS_LEVELS.keys : %w[ read ]
+
+    levels.map do |scope|
+      level = ACCESS_LEVELS.fetch(scope)
+      [ scope, level.merge(description: format(level[:description], accounts: one_account ? "account" : "accounts")) ]
+    end
+  end
+
+  def oauth_strongest_permission(tokens)
+    if tokens.any?(&:write?)
+      "write"
+    elsif tokens.any?
+      "read"
+    end
+  end
+
+  def oauth_access_label(permission)
+    ACCESS_LEVELS.fetch(Oauth.canonical_scope(permission))[:label]
+  end
+
+  # What an app's grants together let it do, as [ permission, accounts ]
+  # pairs, accounts nil for every account the person belongs to. An unbound
+  # grant reaches every account; a bound one adds only its own, and only
+  # where it grants more, so no pair claims more than some grant gives.
+  def oauth_connected_app_reach(tokens)
+    # A grant bound to an account since deleted, cancelled, or left reaches
+    # nothing: refreshing it would be refused, so it isn't shown as reach.
+    unbound, bound = tokens.partition { |token| !token.account_bound? }
+    bound = bound.select { |token| token.account && oauth_active_account_ids.include?(token.account_id) }
+    everywhere = oauth_strongest_permission(unbound)
+
+    reach = bound.group_by(&:account).filter_map do |account, account_tokens|
+      permission = oauth_strongest_permission(account_tokens)
+      [ permission, account ] if everywhere.nil? || (permission == "write" && everywhere == "read")
+    end
+
+    [ (everywhere && [ everywhere, nil ]), *reach.group_by(&:first).map { |permission, pairs| [ permission, pairs.map(&:last) ] } ].compact
+  end
+
+  # The accounts the signed-in person is still active in, read once per render
+  # however many apps the page lists.
+  def oauth_active_account_ids
+    @oauth_active_account_ids ||= Current.identity.users_with_active_accounts.pluck(:account_id).to_set
+  end
+
+  def connected_app_groups(connected_apps)
+    by_kind = connected_apps.group_by { |client, _| client.connection_kind }
+
+    CONNECTED_APP_GROUPS.filter_map do |kind, heading|
+      [ kind, heading, by_kind[kind] ] if by_kind[kind].present?
+    end
+  end
+end
diff --git a/app/models/oauth/client.rb b/app/models/oauth/client.rb
index e38b47a1da..617119110b 100644
--- a/app/models/oauth/client.rb
+++ b/app/models/oauth/client.rb
@@ -203,6 +203,21 @@ def self_registered?
     dynamically_registered? || metadata_document?
   end
 
+  # What kind of app this is, as this server sees it rather than as it names
+  # itself: Connected Apps groups by it. Our own apps are the trusted ones. An
+  # app whose every callback stays on this device, a loopback address or an
+  # app's own URL scheme, is a tool running here, such as a CLI or a desktop
+  # assistant. Anything else receives its access somewhere on the web.
+  def connection_kind
+    if trusted?
+      :fizzy
+    elsif redirect_uris.all? { |uri| on_device_uri?(uri) }
+      :local
+    else
+      :web
+    end
+  end
+
   def confidential?
     token_endpoint_auth_method.in?(SECRET_AUTH_METHODS)
   end
@@ -304,6 +319,16 @@ def validate_redirect_uri(uri)
       errors.add :redirect_uris, "includes an invalid URI"
     end
 
+    # As consent tells it (OauthHelper): a loopback host on http or https, or an
+    # app's own scheme. Redirect matching keeps its http-only loopback_uri?.
+    def on_device_uri?(uri)
+      parsed = URI.parse(uri)
+      web = parsed.scheme.to_s.downcase.in?(%w[ http https ])
+      !web || Oauth.loopback_host?(parsed.host)
+    rescue URI::InvalidURIError
+      false
+    end
+
     # http only: an app scheme naming a loopback host (cursor://localhost) is
     # dispatched to an app, not served on loopback (RFC 8252 §7.3).
     def loopback_uri?(uri)
diff --git a/app/views/my/connected_apps/_connected_app.html.erb b/app/views/my/connected_apps/_connected_app.html.erb
index 3c8b2a2f35..22641c09d1 100644
--- a/app/views/my/connected_apps/_connected_app.html.erb
+++ b/app/views/my/connected_apps/_connected_app.html.erb
@@ -1,44 +1,74 @@
-<tr>
-  <td><strong><%= client.name %></strong></td>
-  <td><%= tokens.map { |t| t.permission.humanize }.uniq.sort.join(", ") %></td>
-  <td><%= local_datetime_tag tokens.map(&:created_at).min, style: :datetime %></td>
-  <td>
-    <div data-controller="dialog" data-dialog-modal-value="true" data-action="keydown.esc->dialog#close:stop">
-      <button type="button" class="btn txt-negative btn--circle txt-x-small borderless fill-transparent" data-action="dialog#open">
-        <%= icon_tag "trash" %>
-        <span class="for-screen-reader">Disconnect this app</span>
-      </button>
-
-      <dialog class="dialog panel fill-white shadow gap flex-column" style="--panel-size: 44ch" data-dialog-target="dialog" aria-labelledby="<%= dom_id(client, :disconnect_title) %>">
-        <h3 class="txt-large txt-bold margin-none" id="<%= dom_id(client, :disconnect_title) %>">Disconnect <%= client.name %>?</h3>
-        <p class="txt-medium margin-none">This will revoke all of its access.</p>
-
-        <%= form_with url: my_connected_app_path(client), method: :delete, class: "flex flex-column gap" do |form| %>
-          <% if webhooks.any? %>
-            <div class="txt-align-start">
-              <p class="margin-none">It set up <%= webhooks.one? ? "this webhook" : "these webhooks" %>, which will keep running unless you remove <%= webhooks.one? ? "it" : "them" %>:</p>
-              <ul class="margin-block-half">
-                <% webhooks.each do |webhook| %>
-                  <li>
-                    <strong><%= webhook.name %></strong> on <%= webhook.board.name %><%= " in #{webhook.account.name}" unless webhook.account == Current.account %>
-                    <%= hidden_field_tag "webhook_ids[]", webhook.id, id: nil %>
-                  </li>
-                <% end %>
-              </ul>
-
-              <label class="flex gap-half align-center justify-start">
-                <%= check_box_tag :remove_webhooks, "1", false, class: "checkbox", id: dom_id(client, :remove_webhooks) %>
-                Also remove <%= webhooks.one? ? "it" : "these" %>
-              </label>
-            </div>
-          <% end %>
-
-          <div class="flex gap-half justify-center">
-            <button type="button" class="btn" data-action="dialog#close">Cancel</button>
-            <%= form.button "Disconnect", class: "btn txt-negative" %>
+<% remote_hosts = oauth_client_remote_hosts(client) %>
+
+<article class="connected-app" id="<%= dom_id(client, :connected_app) %>">
+  <div class="connected-app__details flex flex-column">
+    <%# A self-registered app goes by the name it gave itself, since that's the
+        name people know it by, but never without where its access goes %>
+    <h3 class="connected-app__name txt-medium margin-none" id="<%= dom_id(client, :connected_app_name) %>"><bdi><%= oauth_client_self_name(client) %></bdi></h3>
+
+    <% if client.dynamically_registered? %>
+      <p class="txt-x-small txt-subtle margin-none">
+        <% if remote_hosts.any? %>
+          Name set by the app at <%= remote_hosts.to_sentence(two_words_connector: " or ", last_word_connector: " or ") %>
+        <% else %>
+          Name set by an app on your device
+        <% end %>
+      </p>
+    <% elsif client.metadata_document? %>
+      <p class="txt-x-small txt-subtle margin-none">Name set by the app at <%= URI.parse(client.client_id).host %></p>
+    <% elsif client.trusted? %>
+      <p class="txt-x-small txt-subtle margin-none">Made by 37signals</p>
+    <% end %>
+
+    <% oauth_connected_app_reach(tokens).each do |permission, accounts| %>
+      <p class="connected-app__access txt-small margin-none">
+        <strong><%= oauth_access_label(permission) %></strong>, <% if accounts %>in <%= to_sentence(accounts.map { |account| tag.bdi(account.name) }) %><% else %>in every account you belong to<% end %>
+      </p>
+    <% end %>
+
+    <%# updated_at moves each time the app renews its access %>
+    <p class="txt-x-small txt-subtle margin-none">
+      Connected <%= local_datetime_tag tokens.map(&:created_at).min, style: :date %>
+      &middot; access last renewed <%= local_datetime_tag tokens.map(&:updated_at).max, style: :daysago %>
+      <% if tokens.many? %>&middot; <%= pluralize(tokens.size, "connection") %><% end %>
+    </p>
+  </div>
+
+  <div class="connected-app__disconnect" data-controller="dialog" data-dialog-modal-value="true" data-action="keydown.esc->dialog#close:stop">
+    <button type="button" class="btn txt-negative borderless txt-small" data-action="dialog#open" aria-describedby="<%= dom_id(client, :connected_app_name) %>">
+      <%= icon_tag "trash" %>
+      <span>Disconnect</span>
+    </button>
+
+    <dialog class="dialog panel fill-white shadow gap flex-column" style="--panel-size: 44ch" data-dialog-target="dialog" aria-labelledby="<%= dom_id(client, :disconnect_title) %>">
+      <h3 class="txt-large txt-bold margin-none" id="<%= dom_id(client, :disconnect_title) %>">Disconnect <bdi><%= oauth_client_self_name(client) %></bdi>?</h3>
+      <p class="txt-medium margin-none">It loses its access to Fizzy right away. To use it again, you'd connect it again.</p>
+
+      <%= form_with url: my_connected_app_path(client), method: :delete, class: "flex flex-column gap" do |form| %>
+        <% if webhooks.any? %>
+          <div class="txt-align-start">
+            <p class="margin-none">It set up <%= webhooks.one? ? "this webhook" : "these webhooks" %>, which will keep running unless you remove <%= webhooks.one? ? "it" : "them" %>:</p>
+            <ul class="margin-block-half">
+              <% webhooks.each do |webhook| %>
+                <li>
+                  <strong><%= webhook.name %></strong> on <%= webhook.board.name %><%= " in #{webhook.account.name}" unless webhook.account == Current.account %>
+                  <%= hidden_field_tag "webhook_ids[]", webhook.id, id: nil %>
+                </li>
+              <% end %>
+            </ul>
+
+            <label class="flex gap-half align-center justify-start">
+              <%= check_box_tag :remove_webhooks, "1", false, class: "checkbox", id: dom_id(client, :remove_webhooks) %>
+              Also remove <%= webhooks.one? ? "it" : "these" %>
+            </label>
           </div>
         <% end %>
-      </dialog>
-    </div>
-  </td>
-</tr>
+
+        <div class="flex gap-half justify-center">
+          <button type="button" class="btn" data-action="dialog#close">Cancel</button>
+          <%= form.button "Disconnect", class: "btn txt-negative" %>
+        </div>
+      <% end %>
+    </dialog>
+  </div>
+</article>
diff --git a/app/views/my/connected_apps/index.html.erb b/app/views/my/connected_apps/index.html.erb
index 49cb77e80b..83eca19f0a 100644
--- a/app/views/my/connected_apps/index.html.erb
+++ b/app/views/my/connected_apps/index.html.erb
@@ -12,25 +12,23 @@
   <h1 class="header__title"><%= @page_title %></h1>
 <% end %>
 
-<section class="panel panel--wide shadow center webhooks">
+<section class="connected-apps panel panel--wide shadow center txt-align-start">
   <% if @connected_apps.any? %>
-    <p class="margin-none-block-start">Apps you've authorized to access Fizzy on your behalf.</p>
-    <table class="access_tokens_table margin-block-end-double max-width txt-small">
-      <thead>
-        <tr>
-          <th>App</th>
-          <th>Permissions</th>
-          <th>Connected</th>
-          <th></th>
-        </tr>
-      </thead>
-      <tbody>
-        <% @connected_apps.each do |client, tokens| %>
+    <p class="margin-none-block-start">Apps you've authorized to use Fizzy as you. Each one can reach what you can, with the access shown. Don't recognize one? Disconnect it, and its access ends right away.</p>
+
+    <% connected_app_groups(@connected_apps).each do |kind, heading, apps| %>
+      <section class="connected-apps__group" aria-labelledby="<%= "connected_apps_#{kind}" %>">
+        <h2 id="<%= "connected_apps_#{kind}" %>" class="divider txt-medium margin-none"><%= heading %></h2>
+
+        <% apps.each do |client, tokens| %>
           <%= render "my/connected_apps/connected_app", client: client, tokens: tokens, webhooks: @webhooks_by_client.fetch(client.id, []) %>
         <% end %>
-      </tbody>
-    </table>
+      </section>
+    <% end %>
   <% else %>
-    <p class="margin-none-block-start">No apps are connected to your account. When you authorize an app to access Fizzy, it will appear here.</p>
+    <div class="connected-apps__empty flex flex-column gap-half">
+      <p class="margin-none"><strong>Nothing connected yet.</strong></p>
+      <p class="txt-small txt-subtle margin-none">AI assistants and other apps you connect to Fizzy show up here, so you can see what each one can do and disconnect it whenever you like.</p>
+    </div>
   <% end %>
 </section>
diff --git a/app/views/oauth/authorizations/_access.html.erb b/app/views/oauth/authorizations/_access.html.erb
new file mode 100644
index 0000000000..9173a6d0f2
--- /dev/null
+++ b/app/views/oauth/authorizations/_access.html.erb
@@ -0,0 +1,24 @@
+<%# Fizzy's two access levels, each in plain words. Write includes read, so
+    the choice is one or the other; a client registered for read alone gets
+    the single option, shown so the person still sees what they're granting. %>
+<fieldset class="oauth-access flex flex-column gap-half">
+  <legend class="oauth-access__legend"><strong>Access</strong></legend>
+
+  <% oauth_access_levels(client, one_account: local_assigns[:one_account]).each do |value, level| %>
+    <label class="oauth-access__choice">
+      <%= form.radio_button :scope, value, checked: value == scope, class: "oauth-access__radio" %>
+      <span class="flex flex-column">
+        <strong><%= level[:label] %></strong>
+        <span class="txt-small txt-subtle"><%= level[:description] %></span>
+      </span>
+    </label>
+  <% end %>
+
+  <p class="oauth-access__reach txt-x-small txt-subtle margin-none">
+    <% if local_assigns[:one_account] %>
+      It works as you, so it can only reach what you can, in the account above.
+    <% else %>
+      It works as you, so it can only reach what you can, in every account you belong to.
+    <% end %>
+  </p>
+</fieldset>
diff --git a/app/views/oauth/authorizations/_account_picker.html.erb b/app/views/oauth/authorizations/_account_picker.html.erb
index bc0b513505..f1372a0f5a 100644
--- a/app/views/oauth/authorizations/_account_picker.html.erb
+++ b/app/views/oauth/authorizations/_account_picker.html.erb
@@ -1,6 +1,22 @@
-<%# An audienced grant (the hosted MCP server) reaches one account: the one picked here. %>
-<div class="flex flex-column gap-half">
-  <strong><%= form.label :account_id, "Account" %></strong>
-  <%= form.select :account_id, options_from_collection_for_select(accounts, :id, :name, accounts.first&.id), {}, class: "input input--select" %>
-  <p class="txt-small txt-muted margin-none">The app can reach this account only.</p>
-</div>
+<%# Which account this connection reaches. The controller sets accounts (the
+    identity's accounts) and the preselected one; the choice posts as
+    account_id. With one account there is nothing to choose, so it's named,
+    and carried in a hidden field. %>
+<fieldset class="oauth-access flex flex-column gap-half">
+  <legend class="oauth-access__legend"><strong>Account</strong></legend>
+
+  <% if accounts.one? %>
+    <% account = accounts.first %>
+    <%= form.hidden_field :account_id, value: account.id %>
+    <p class="margin-none"><bdi><%= account.name %></bdi></p>
+  <% else %>
+    <% accounts.each_with_index do |account, index| %>
+      <label class="oauth-access__choice">
+        <%= form.radio_button :account_id, account.id, checked: selected_account_id.present? ? account.id == selected_account_id : index.zero?, required: true, class: "oauth-access__radio" %>
+        <span><bdi><%= account.name %></bdi></span>
+      </label>
+    <% end %>
+  <% end %>
+
+  <p class="txt-x-small txt-subtle margin-none">The app reaches this account only. Connect it again to add another.</p>
+</fieldset>
diff --git a/app/views/oauth/authorizations/_client.html.erb b/app/views/oauth/authorizations/_client.html.erb
new file mode 100644
index 0000000000..c5d28c76ed
--- /dev/null
+++ b/app/views/oauth/authorizations/_client.html.erb
@@ -0,0 +1,28 @@
+<%# Who is asking, as far as Fizzy can vouch for it. A self-registered app's
+    name is only its claim, typed by whoever registered it, so it's shown as
+    exactly that: what the app says it is, quoted and subdued, under a heading
+    that names where the access goes (bc3 reads the same). bdi keeps any
+    right-to-left letters in the name from moving the quotes. %>
+<header class="oauth-client flex flex-column gap-half">
+  <h2 class="oauth-client__name txt-large margin-none"><bdi><%= client.dynamically_registered? && redirect_host.nil? ? identity.upcase_first : identity %></bdi></h2>
+
+  <% if client.dynamically_registered? %>
+    <p class="oauth-client__self-name txt-small txt-subtle margin-none">
+      Says it&rsquo;s &ldquo;<bdi><%= oauth_client_self_name(client) %></bdi>&rdquo;
+    </p>
+
+    <p class="oauth-client__warning txt-small margin-none" role="note">
+      <% if redirect_host %>
+        <strong>We haven&rsquo;t checked this app.</strong> Anyone can run an app at any address, so only authorize it if you trust <strong><%= redirect_host %></strong>.
+      <% else %>
+        <strong>We haven&rsquo;t checked this app.</strong> It runs on your device and will get this access, so only authorize it if you started it.
+      <% end %>
+    </p>
+  <% elsif client.metadata_document? %>
+    <p class="oauth-client__self-name txt-small txt-subtle margin-none">
+      Name set by the app at <strong><%= URI.parse(client.client_id).host %></strong>
+    </p>
+  <% elsif client.trusted? %>
+    <p class="oauth-client__made-by txt-small txt-subtle margin-none">Made by 37signals</p>
+  <% end %>
+</header>
diff --git a/app/views/oauth/authorizations/error.html.erb b/app/views/oauth/authorizations/error.html.erb
index 3493d9a7c2..40b7bb0413 100644
--- a/app/views/oauth/authorizations/error.html.erb
+++ b/app/views/oauth/authorizations/error.html.erb
@@ -1,15 +1,15 @@
-<article class="panel panel--wide shadow center txt-align-start">
+<%# Shown on Fizzy, never redirected: the request couldn't be trusted enough
+    to send the browser back to the app (see redirect_with_error) %>
+<% @page_title = "Can't authorize this app" %>
+
+<article class="oauth-consent panel panel--wide shadow center txt-align-start">
   <div class="flex flex-column gap">
-    <h2 class="margin-none">Authorization Error</h2>
+    <h2 class="txt-large margin-none"><%= @page_title %></h2>
 
-    <p class="txt-muted margin-none">
-      <%= @error_description %>
-    </p>
+    <p class="margin-none"><%= @error_description %></p>
 
-    <p class="txt-small txt-muted margin-none">
-      Error code: <code><%= @error %></code>
+    <p class="txt-small txt-subtle margin-none">
+      Nothing was shared. Close this window and start again from the app. If it keeps happening, let whoever made the app know, and mention this error code: <code><%= @error %></code>
     </p>
-
-    <%= link_to "Go back", request.referer || root_path, class: "btn btn--outline center txt-medium" %>
   </div>
 </article>
diff --git a/app/views/oauth/authorizations/new.html.erb b/app/views/oauth/authorizations/new.html.erb
index cf797dd821..80f1ffb94e 100644
--- a/app/views/oauth/authorizations/new.html.erb
+++ b/app/views/oauth/authorizations/new.html.erb
@@ -1,10 +1,25 @@
-<% @page_title = "Authorize #{@client.name}" %>
+<% identity = oauth_client_display_identity(@client, @redirect_uri) %>
+<% redirect_host = oauth_redirect_host(@redirect_uri) %>
+<%# A self-registered web app is headed by where its access goes, as bc3's
+    consent reads: "Authorize the app at <host>". %>
+<% @page_title = "Authorize #{@client.dynamically_registered? && redirect_host ? "the app at #{redirect_host}" : identity}" %>
 
 <% content_for :header do %>
   <h1 class="header__title"><%= @page_title %></h1>
 <% end %>
 
-<article class="panel panel--wide shadow center txt-align-start">
+<article class="oauth-consent panel panel--wide shadow center txt-align-start">
+  <%= render "oauth/authorizations/client", client: @client, identity: identity, redirect_host: redirect_host %>
+
+  <%# Not you? signs out and returns whoever signs in to this same request %>
+  <div class="oauth-consent__identity flex align-center gap-half txt-small txt-subtle">
+    <span>Signed in as <strong><%= Current.identity.email_address %></strong></span>
+    <%= button_to "Not you?", oauth_authorization_switch_path,
+          params: { client_id: @client.client_id, redirect_uri: @redirect_uri, response_type: "code", scope: @scope,
+            state: @state, code_challenge: @code_challenge, code_challenge_method: "S256", resource: @resource }.compact,
+          class: "btn btn--plain txt-link txt-small", form: { data: { turbo: false } } %>
+  </div>
+
   <%= form_with url: oauth_authorization_path, method: :post, data: { turbo: false }, html: { class: "flex flex-column gap" } do |f| %>
     <%= f.hidden_field :client_id, value: @client.client_id %>
     <%= f.hidden_field :redirect_uri, value: @redirect_uri %>
@@ -14,30 +29,23 @@
     <%= f.hidden_field :response_type, value: "code" %>
     <%= f.hidden_field :resource, value: @resource if @resource %>
 
-    <div class="flex flex-column gap-half">
-      <strong>Application</strong>
-      <p class="margin-none"><%= @client.name %></p>
-      <% if @client.dynamically_registered? %>
-        <% redirect = URI.parse(@redirect_uri) %>
-        <% if redirect.scheme&.downcase == "http" && Oauth.loopback_host?(redirect.host) %>
-          <p class="txt-small txt-muted margin-none">Registered by a local tool. Only authorize if you trust it.</p>
-        <% else %>
-          <p class="txt-small txt-muted margin-none">Self-registered app that will receive access at <strong><%= "#{redirect.scheme.downcase}://" unless redirect.scheme.casecmp?("https") %><%= redirect.port == redirect.default_port ? redirect.host : "#{redirect.host}:#{redirect.port}" %></strong>. Only authorize if you trust it.</p>
-        <% end %>
-      <% elsif @client.metadata_document? %>
-        <p class="txt-small txt-muted margin-none">Name set by the app at <strong><%= URI.parse(@client.client_id).host %></strong>.</p>
-      <% end %>
-    </div>
+    <%# Account binding sets @accounts: a connection then reaches the one account chosen here %>
+    <% if @accounts %>
+      <%= render "oauth/authorizations/account_picker", form: f, accounts: @accounts, selected_account_id: @account_id %>
+    <% end %>
 
-    <%= render "oauth/authorizations/account_picker", form: f, accounts: @accounts if @accounts %>
+    <%= render "oauth/authorizations/access", form: f, client: @client, scope: @scope, one_account: @accounts.present? %>
 
-    <div class="flex flex-column gap-half">
-      <strong><%= f.label :scope, "Permission" %></strong>
-      <% scope_options = @client.scopes.include?("write") ? { "Read" => "read", "Read + Write" => "read write" } : { "Read" => "read" } %>
-      <%= f.select :scope, options_for_select(scope_options, @scope), {}, class: "input input--select" %>
-    </div>
+    <p class="oauth-consent__destination txt-small txt-subtle margin-none">
+      <% if redirect_host %>
+        Either way, you'll go back to <strong><%= redirect_host %></strong>.
+      <% else %>
+        Either way, you'll go back to the app on your device.
+      <% end %>
+      You can disconnect it at any time in <%= link_to "Connected apps", my_connected_apps_path, class: "txt-link" %>.
+    </p>
 
-    <div class="flex gap">
+    <div class="oauth-consent__actions flex gap">
       <%= f.button type: :submit, class: "btn btn--link txt-medium" do %>
         <span>Authorize</span>
       <% end %>
diff --git a/config/routes.rb b/config/routes.rb
index c069aacb24..4a1e357032 100644
--- a/config/routes.rb
+++ b/config/routes.rb
@@ -5,7 +5,11 @@
   get "/.well-known/oauth-protected-resource", to: "oauth/protected_resource_metadata#show"
 
   namespace :oauth do
-    resource :authorization, only: %i[ new create ]
+    resource :authorization, only: %i[ new create ] do
+      scope module: :authorizations do
+        resource :switch, only: :create
+      end
+    end
     # The delegation exchange shares the token endpoint, told apart by its grant type.
     post "token", to: "token_exchanges#create", as: nil,
       constraints: Oauth::TokenDelegation.method(:request?)
diff --git a/test/controllers/my/connected_apps_controller_test.rb b/test/controllers/my/connected_apps_controller_test.rb
index 9eb5eb9dd4..fc43c5bbbd 100644
--- a/test/controllers/my/connected_apps_controller_test.rb
+++ b/test/controllers/my/connected_apps_controller_test.rb
@@ -1,6 +1,8 @@
 require "test_helper"
 
 class My::ConnectedAppsControllerTest < ActionDispatch::IntegrationTest
+  include OauthAvailabilityTestHelper
+
   setup do
     sign_in_as :david
     @identity = identities(:david)
@@ -15,6 +17,67 @@ class My::ConnectedAppsControllerTest < ActionDispatch::IntegrationTest
     assert_match client.name, response.body
   end
 
+  test "an app whose grants are bound to accounts is shown reaching only those" do
+    resource = "https://mcp.example.com/mcp"
+    saved, Rails.application.config.x.oauth.mcp_resources = Rails.application.config.x.oauth.mcp_resources, [ resource ]
+    @identity.access_tokens.create! oauth_client: oauth_clients(:mcp_client), permission: :read, audience: resource, account: accounts("37s")
+
+    get my_connected_apps_path
+
+    assert_select ".connected-app__access", text: /in #{accounts("37s").name}\z/
+    assert_select ".connected-app__access bdi", text: accounts("37s").name
+    assert_no_match "in every account you belong to", response.body
+  ensure
+    Rails.application.config.x.oauth.mcp_resources = saved
+  end
+
+  test "an app's reach pairs each permission with the accounts it holds it in" do
+    resource = "https://mcp.example.com/mcp"
+    saved, Rails.application.config.x.oauth.mcp_resources = Rails.application.config.x.oauth.mcp_resources, [ resource ]
+    @identity.access_tokens.create! oauth_client: oauth_clients(:mcp_client), permission: :write, audience: resource, account: accounts("37s")
+    accounts(:initech).users.create! identity: @identity, name: "David"
+    @identity.access_tokens.create! oauth_client: oauth_clients(:mcp_client), permission: :read, audience: resource, account: accounts(:initech)
+
+    get my_connected_apps_path
+
+    assert_select ".connected-app__access", count: 2
+    assert_select ".connected-app__access", text: /Read and write.*in #{accounts("37s").name}\z/m
+    assert_select ".connected-app__access", text: /\ARead only.*in #{accounts(:initech).name}\z/m
+  ensure
+    Rails.application.config.x.oauth.mcp_resources = saved
+  end
+
+  test "a grant bound to a deleted account reaches nothing, and the page still renders" do
+    resource = "https://mcp.example.com/mcp"
+    saved, Rails.application.config.x.oauth.mcp_resources = Rails.application.config.x.oauth.mcp_resources, [ resource ]
+    grant = @identity.access_tokens.create! oauth_client: oauth_clients(:mcp_client), permission: :read, audience: resource, account: accounts("37s")
+    grant.update_columns account_id: ActiveRecord::FixtureSet.identify("deleted", :uuid)
+
+    get my_connected_apps_path
+
+    assert_response :success
+    assert_select ".connected-app__access", count: 0
+  ensure
+    Rails.application.config.x.oauth.mcp_resources = saved
+  end
+
+  test "a grant bound to an account that's since cancelled reaches nothing, and the app is still listed to disconnect" do
+    resource = "https://mcp.example.com/mcp"
+    saved, Rails.application.config.x.oauth.mcp_resources = Rails.application.config.x.oauth.mcp_resources, [ resource ]
+    client = oauth_clients(:mcp_client)
+    user = accounts(:initech).users.create! identity: @identity, name: "David"
+    @identity.access_tokens.create! oauth_client: client, permission: :read, audience: resource, account: accounts(:initech)
+    accounts(:initech).create_cancellation!(initiated_by: user)
+
+    get my_connected_apps_path
+
+    assert_response :success
+    assert_match client.name, response.body
+    assert_select ".connected-app__access", count: 0
+  ensure
+    Rails.application.config.x.oauth.mcp_resources = saved
+  end
+
   test "index and destroy work untenanted, so an identity without an account can still disconnect apps" do
     client = oauth_clients(:mcp_client)
     @identity.access_tokens.create!(oauth_client: client, permission: :read)
@@ -75,4 +138,47 @@ class My::ConnectedAppsControllerTest < ActionDispatch::IntegrationTest
     delete my_connected_app_path(client)
     assert_response :not_found
   end
+
+  test "index groups apps by kind and says what each can do" do
+    @identity.access_tokens.create!(oauth_client: oauth_clients(:mcp_client), permission: :read)
+    @identity.access_tokens.create!(oauth_client: oauth_clients(:confidential_client), permission: :write)
+
+    get my_connected_apps_path
+
+    assert_response :success
+    assert_select ".connected-apps__group", count: 2
+    assert_select "#connected_apps_web + .connected-app, #connected_apps_web ~ .connected-app", text: /Confidential Connector.*Read and write/m
+    assert_select "#connected_apps_local ~ .connected-app", text: /Test MCP Client.*Name set by an app on your device.*Read only/m
+    assert_select "#connected_apps_fizzy", count: 0
+    assert_select ".connected-app", text: /access last renewed/
+  end
+
+  test "index names where a self-registered web app's access goes" do
+    @identity.access_tokens.create!(oauth_client: oauth_clients(:confidential_client), permission: :read)
+
+    get my_connected_apps_path
+
+    assert_select ".connected-app", text: /Name set by the app at connector.example.com/
+  end
+
+  test "index shows an empty state when nothing is connected" do
+    get my_connected_apps_path
+
+    assert_response :success
+    assert_select ".connected-apps__empty", text: /Nothing connected yet/
+    assert_select ".connected-app", count: 0
+  end
+
+  test "index names every remote host a self-registered app can send its access to, not just the first" do
+    client = with_dcr_allowed_https_hosts "one.example.com", "two.example.com" do
+      Oauth::Client.create! name: "Two Homes", dynamically_registered: true,
+        redirect_uris: %w[ http://127.0.0.1:8888/callback https://one.example.com/cb https://two.example.com:8443/cb ]
+    end
+    @identity.access_tokens.create!(oauth_client: client, permission: :read)
+
+    get my_connected_apps_path
+
+    assert_select "#connected_apps_web ~ .connected-app", text: /Name set by the app at one.example.com or two.example.com:8443/
+    assert_no_match "Name set by an app on your device", response.body
+  end
 end
diff --git a/test/helpers/oauth_helper_test.rb b/test/helpers/oauth_helper_test.rb
new file mode 100644
index 0000000000..e73d904ef7
--- /dev/null
+++ b/test/helpers/oauth_helper_test.rb
@@ -0,0 +1,77 @@
+require "test_helper"
+
+class OauthHelperTest < ActionView::TestCase
+  test "a self name of nothing but direction controls reads as an unnamed app" do
+    assert_equal "Unnamed app", oauth_client_self_name(Oauth::Client.new(name: "\u202E\u2066\u2069"))
+  end
+
+  test "a self-registered app is identified by its callback's host, port included when it isn't the default" do
+    client = Oauth::Client.new name: "Hosted", dynamically_registered: true
+
+    assert_equal "connector.example.com", oauth_client_display_identity(client, "https://connector.example.com/callback")
+    assert_equal "connector.example.com:8443", oauth_client_display_identity(client, "https://connector.example.com:8443/callback")
+    assert_equal "an app on your device", oauth_client_display_identity(client, "http://127.0.0.1:8888/callback")
+    assert_equal "an app on your device", oauth_client_display_identity(client, "com.example.app:/callback")
+  end
+
+  test "a registered app is identified by its name" do
+    assert_equal "Trusted First-Party App", oauth_client_display_identity(oauth_clients(:trusted_client), "https://app.example.com/oauth/callback")
+  end
+
+  test "a read-only client is offered read alone" do
+    reader = Oauth::Client.new scopes: %w[ read ]
+
+    assert_equal %w[ read ], oauth_access_levels(reader).map(&:first)
+    assert_equal [ "read", "read write" ], oauth_access_levels(oauth_clients(:mcp_client)).map(&:first)
+  end
+
+  test "connected apps are grouped by kind, in a fixed order, skipping empty groups" do
+    web = oauth_clients(:confidential_client)
+    local = oauth_clients(:mcp_client)
+
+    groups = connected_app_groups([ [ local, [] ], [ web, [] ] ])
+
+    assert_equal %i[ web local ], groups.map(&:first)
+    assert_equal [ [ web, [] ] ], groups.first.last
+  end
+
+  test "the account picker offers each account, preselecting the chosen one" do
+    accounts = Account.order(:name).first(2)
+
+    form_with(url: "/oauth/authorization") do |form|
+      render partial: "oauth/authorizations/account_picker", locals: { form: form, accounts: accounts, selected_account_id: accounts.second.id }
+    end
+
+    assert_select "input[type=radio][name=account_id]", count: accounts.size
+    assert_select "input[type=radio][name=account_id][checked][value=?]", accounts.second.id.to_s
+  end
+
+  test "the account picker names a lone account and carries it hidden" do
+    account = Account.first
+
+    form_with(url: "/oauth/authorization") do |form|
+      render partial: "oauth/authorizations/account_picker", locals: { form: form, accounts: [ account ], selected_account_id: nil }
+    end
+
+    assert_select "input[type=radio]", count: 0
+    assert_select "input[type=hidden][name=account_id][value=?]", account.id.to_s
+    assert_select "bdi", text: account.name
+  end
+
+  test "a client's remote hosts skip its on-device callbacks and repeats" do
+    client = Oauth::Client.new redirect_uris: %w[ http://127.0.0.1/cb https://a.example.com/x https://a.example.com/y com.example.app:/cb https://b.example.com:8443/cb ]
+
+    assert_equal %w[ a.example.com b.example.com:8443 ], oauth_client_remote_hosts(client)
+  end
+
+  test "read's description names the people in every account, or in the one account a bound grant reaches" do
+    client = oauth_clients(:mcp_client)
+
+    assert_match "the people in your accounts.", oauth_access_levels(client).to_h.fetch("read")[:description]
+    assert_match "the people in your account.", oauth_access_levels(client, one_account: true).to_h.fetch("read")[:description]
+  end
+
+  test "a redirect's host reads in lowercase, as a browser reads it" do
+    assert_equal "connector.example.com:8443", oauth_redirect_host("https://Connector.EXAMPLE.com:8443/cb")
+  end
+end
diff --git a/test/integration/oauth_audience_test.rb b/test/integration/oauth_audience_test.rb
index d03874cebc..b1cdf961a8 100644
--- a/test/integration/oauth_audience_test.rb
+++ b/test/integration/oauth_audience_test.rb
@@ -25,9 +25,9 @@ class OauthAudienceTest < ActionDispatch::IntegrationTest
     get_consent resource: MCP_RESOURCE
 
     assert_response :success
-    assert_select "select[name=account_id] option", 2
-    assert_select "select[name=account_id] option[value=?]", accounts("37s").id
-    assert_select "select[name=account_id] option[value=?]", accounts(:initech).id
+    assert_select "input[type=radio][name=account_id]", 2
+    assert_select "input[type=radio][name=account_id][value=?]", accounts("37s").id
+    assert_select "input[type=radio][name=account_id][value=?]", accounts(:initech).id
     assert_select "input[type=hidden][name=resource][value=?]", MCP_RESOURCE
   end
 
diff --git a/test/integration/oauth_authorization_switch_test.rb b/test/integration/oauth_authorization_switch_test.rb
new file mode 100644
index 0000000000..4a0e9fe4ec
--- /dev/null
+++ b/test/integration/oauth_authorization_switch_test.rb
@@ -0,0 +1,134 @@
+require "test_helper"
+
+class OauthAuthorizationSwitchTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as :david
+    @client = oauth_clients(:mcp_client)
+  end
+
+  test "the consent screen offers to switch who is signed in" do
+    untenanted { get new_oauth_authorization_path, params: authorization_params }
+
+    assert_select "form[action=?] button", oauth_authorization_switch_path(script_name: nil), text: "Not you?"
+  end
+
+  test "switching signs out and saves the authorization request, rebuilt from its checked parameters" do
+    assert_difference -> { identities(:david).sessions.count }, -1 do
+      post_switch authorization_params.merge(return_to: "https://evil.example.com/", account_id: "123")
+    end
+
+    assert_redirected_to new_session_path(script_name: nil)
+    assert_not cookies[:session_token].present?
+    assert_equal expected_return_url, session[:return_to_after_authenticating]
+  end
+
+  test "switching an audienced request signs out even when the signed-in identity has no account left" do
+    resource = "https://mcp.example.com/mcp"
+    saved, Rails.application.config.x.oauth.mcp_resources = Rails.application.config.x.oauth.mcp_resources, [ resource ]
+    identities(:david).users.each { |user| user.account.create_cancellation!(initiated_by: user) unless user.account.cancellation }
+
+    assert_difference -> { identities(:david).sessions.count }, -1 do
+      post_switch authorization_params.merge(resource: resource)
+    end
+
+    assert_redirected_to new_session_path(script_name: nil)
+  ensure
+    Rails.application.config.x.oauth.mcp_resources = saved
+  end
+
+  test "switching with a bearer token and no browser session is refused, not half-handled" do
+    token = identities(:david).access_tokens.create!(permission: :write)
+    reset!
+
+    assert_no_difference -> { identities(:david).sessions.count } do
+      post_switch authorization_params, as: :json, headers: { "Authorization" => "Bearer #{token.raw_token}" }
+    end
+
+    assert_response :forbidden
+  end
+
+  test "switching requires a same-origin request" do
+    with_forgery_protection do
+      assert_no_difference -> { identities(:david).sessions.count } do
+        post_switch authorization_params, headers: { "Sec-Fetch-Site" => "cross-site" }
+      end
+    end
+
+    assert_response :unprocessable_entity
+  end
+
+  test "a redirect the client didn't register is refused, leaving the person signed in and nothing saved" do
+    assert_no_difference -> { identities(:david).sessions.count } do
+      post_switch authorization_params(redirect_uri: "https://evil.example.com/callback")
+    end
+
+    assert_response :bad_request
+    assert cookies[:session_token].present?
+    assert_nil session[:return_to_after_authenticating]
+  end
+
+  test "an unknown client is refused, leaving the person signed in" do
+    assert_no_difference -> { identities(:david).sessions.count } do
+      post_switch authorization_params(client_id: "forged")
+    end
+
+    assert_response :bad_request
+    assert_select "code", text: "invalid_request"
+    assert_nil session[:return_to_after_authenticating]
+  end
+
+  test "a request too long to resume is refused before signing out" do
+    assert_no_difference -> { identities(:david).sessions.count } do
+      post_switch authorization_params(state: "x" * 2048)
+    end
+
+    assert_response :bad_request
+    assert_select "p", text: /too long to pick up again/
+    assert cookies[:session_token].present?
+    assert_nil session[:return_to_after_authenticating]
+  end
+
+  test "whoever signs in next lands back on consent for the same request, and the saved request is used once" do
+    post_switch authorization_params
+    sign_in_as :kevin
+
+    assert_equal expected_return_url, response.location
+    assert_nil session[:return_to_after_authenticating]
+
+    get response.location
+    assert_response :success
+    assert_select ".oauth-consent__identity strong", text: identities(:kevin).email_address
+
+    sign_in_as :kevin
+    assert_not_equal expected_return_url, response.location
+  end
+
+  private
+    def authorization_params(**overrides)
+      {
+        client_id: @client.client_id,
+        redirect_uri: @client.redirect_uris.first,
+        response_type: "code",
+        code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+        code_challenge_method: "S256",
+        scope: "read",
+        state: "xyz123"
+      }.merge(overrides)
+    end
+
+    def expected_return_url
+      new_oauth_authorization_url(script_name: nil, **authorization_params)
+    end
+
+    def post_switch(params, **options)
+      untenanted { post oauth_authorization_switch_path, params: params, **options }
+    end
+
+    def with_forgery_protection
+      original = ActionController::Base.allow_forgery_protection
+      ActionController::Base.allow_forgery_protection = true
+      yield
+    ensure
+      ActionController::Base.allow_forgery_protection = original
+    end
+end
diff --git a/test/integration/oauth_client_metadata_documents_test.rb b/test/integration/oauth_client_metadata_documents_test.rb
index 599f24c697..350ee2acff 100644
--- a/test/integration/oauth_client_metadata_documents_test.rb
+++ b/test/integration/oauth_client_metadata_documents_test.rb
@@ -56,6 +56,25 @@ class OauthClientMetadataDocumentsTest < ActionDispatch::IntegrationTest
     assert_predicate response.parsed_body["refresh_token"], :present?
   end
 
+  test "switching who is signed in registers nothing" do
+    sign_in_as :david
+
+    untenanted { post oauth_authorization_switch_path, params: authorization }
+
+    assert_response :redirect
+    assert_nil Oauth::Client.find_presented(URL)
+  end
+
+  test "Connected apps names the host that set a metadata document client's name" do
+    sign_in_as :david
+    untenanted { post oauth_authorization_path, params: authorization }
+    identities(:david).access_tokens.create! oauth_client: Oauth::Client.find_presented(URL), permission: :read
+
+    untenanted { get my_connected_apps_path }
+
+    assert_select ".connected-app", text: /Name set by the app at claude\.ai/
+  end
+
   test "denying registers nothing" do
     sign_in_as :david
 
@@ -85,7 +104,7 @@ class OauthClientMetadataDocumentsTest < ActionDispatch::IntegrationTest
     untenanted { get new_oauth_authorization_path, params: authorization.merge(client_id: url, redirect_uri: "https://tools.example.com/cb") }
 
     assert_response :bad_request
-    assert_equal "Unknown client", response.parsed_body["error_description"]
+    assert_select "p", text: "Unknown client"
     assert_not_requested stub
   end
 
@@ -109,7 +128,7 @@ class OauthClientMetadataDocumentsTest < ActionDispatch::IntegrationTest
     end
 
     assert_response :bad_request
-    assert_equal "Unknown client", response.parsed_body["error_description"]
+    assert_select "p", text: "Unknown client"
   end
 
   test "a client_id array never reaches a metadata document client" do
@@ -141,7 +160,7 @@ class OauthClientMetadataDocumentsTest < ActionDispatch::IntegrationTest
     untenanted { get new_oauth_authorization_path, params: authorization.merge(client_id: client.client_id) }
 
     assert_response :bad_request
-    assert_equal "Unknown client", response.parsed_body["error_description"]
+    assert_select "p", text: "Unknown client"
   end
 
   test "an unvetted redirect gets no error redirect before consent" do
diff --git a/test/integration/oauth_consent_screen_test.rb b/test/integration/oauth_consent_screen_test.rb
new file mode 100644
index 0000000000..f6f11572d6
--- /dev/null
+++ b/test/integration/oauth_consent_screen_test.rb
@@ -0,0 +1,93 @@
+require "test_helper"
+
+class OauthConsentScreenTest < ActionDispatch::IntegrationTest
+  setup do
+    sign_in_as :david
+  end
+
+  test "a self-registered web app goes by its callback's host, its own name quoted beside it" do
+    client = Oauth::Client.create! name: "Totally Fizzy", dynamically_registered: true,
+      redirect_uris: %w[ https://connector.example.com/callback ]
+
+    get_consent_screen client
+
+    assert_response :success
+    assert_select "title", text: /Authorize the app at connector\.example\.com/
+    assert_select "h1", text: "Authorize the app at connector.example.com"
+    assert_select ".oauth-client__name", text: "connector.example.com"
+    assert_select ".oauth-client__self-name", text: /\ASays it’s “Totally Fizzy”\z/
+    assert_select ".oauth-client__warning", text: /\AWe haven’t checked this app\. Anyone can run an app at any address, so only authorize it if you trust connector\.example\.com\.\z/
+    assert_select ".oauth-consent__destination strong", text: "connector.example.com"
+  end
+
+  test "a self-registered app on this device is named as one" do
+    get_consent_screen oauth_clients(:mcp_client)
+
+    assert_response :success
+    assert_select ".oauth-client__name", text: "An app on your device"
+    assert_select ".oauth-client__self-name", text: /\ASays it’s “Test MCP Client”\z/
+    assert_select ".oauth-client__warning", text: /\AWe haven’t checked this app\. It runs on your device and will get this access, so only authorize it if you started it\.\z/
+    assert_select ".oauth-consent__destination", text: /the app on your device/
+  end
+
+  test "a trusted app is known by its name and carries no warning" do
+    get_consent_screen oauth_clients(:trusted_client)
+
+    assert_response :success
+    assert_select ".oauth-client__name", text: "Trusted First-Party App"
+    assert_select ".oauth-client__made-by", text: "Made by 37signals"
+    assert_select ".oauth-client__self-name", count: 0
+    assert_select ".oauth-client__warning", count: 0
+  end
+
+  test "bidirectional controls are stripped from a self-registered name" do
+    client = Oauth::Client.create! name: "Good‮ppa‬ App", dynamically_registered: true,
+      redirect_uris: %w[ http://127.0.0.1:8888/callback ]
+
+    get_consent_screen client
+
+    assert_response :success
+    assert_no_match "‮", response.body
+    assert_select ".oauth-client__self-name bdi", text: "Goodppa App"
+  end
+
+  test "each access level says what it lets the app do" do
+    get_consent_screen oauth_clients(:mcp_client), scope: "read write"
+
+    assert_response :success
+    assert_select ".oauth-access__choice", count: 2
+    assert_select ".oauth-access__choice", text: /Read only.*the people in your accounts\. It can't change anything/m
+    assert_select ".oauth-access__choice", text: /Read and write.*delete cards/m
+    assert_select ".oauth-access__reach", text: /every account you belong to/
+  end
+
+  test "the person sees who they're signed in as" do
+    get_consent_screen oauth_clients(:mcp_client)
+
+    assert_select ".oauth-consent__identity strong", text: identities(:david).email_address
+  end
+
+  test "an error before consent is shown on Fizzy, with what to do next" do
+    get_consent_screen oauth_clients(:mcp_client), redirect_uri: "https://evil.example.com/callback"
+
+    assert_response :bad_request
+    assert_select "h2", text: "Can't authorize this app"
+    assert_select "p", text: /Nothing was shared/
+    assert_select "code", text: "invalid_request"
+  end
+
+  private
+    def get_consent_screen(client, **overrides)
+      untenanted do
+        get new_oauth_authorization_path, params: {
+          client_id: client.client_id,
+          redirect_uri: client.redirect_uris.first,
+          response_type: "code",
+          code_challenge: "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM",
+          code_challenge_method: "S256",
+          scope: "read",
+          state: "xyz123"
+        }.merge(overrides)
+      end
+    end
+end
diff --git a/test/integration/oauth_dcr_redirect_allowlist_test.rb b/test/integration/oauth_dcr_redirect_allowlist_test.rb
index d0072ac2fc..272938e6b2 100644
--- a/test/integration/oauth_dcr_redirect_allowlist_test.rb
+++ b/test/integration/oauth_dcr_redirect_allowlist_test.rb
@@ -89,7 +89,7 @@ class OauthDcrRedirectAllowlistTest < ActionDispatch::IntegrationTest
     end
     assert_response :success
     assert_includes response.headers["Content-Security-Policy"], "cursor:"
-    assert_select "strong", text: "cursor://anysphere.cursor-mcp"
+    assert_select ".oauth-consent__destination", text: /the app on your device/
 
     untenanted do
       post oauth_authorization_path, params: {
diff --git a/test/integration/oauth_flow_test.rb b/test/integration/oauth_flow_test.rb
index 664d623a6d..ab4fbeab50 100644
--- a/test/integration/oauth_flow_test.rb
+++ b/test/integration/oauth_flow_test.rb
@@ -56,6 +56,25 @@ class OauthFlowTest < ActionDispatch::IntegrationTest
       }
     end
 
+    assert_response :bad_request
+    assert_select "h2", text: "Can't authorize this app"
+    assert_select "p", text: "Unknown client"
+    assert_select "code", text: "invalid_request"
+  end
+
+  test "authorization answers an invalid client_id as JSON when JSON is asked for" do
+    sign_in_as :david
+
+    untenanted do
+      get new_oauth_authorization_path(format: :json), params: {
+        client_id: "nonexistent",
+        redirect_uri: "http://127.0.0.1/cb",
+        response_type: "code",
+        code_challenge: "test",
+        code_challenge_method: "S256"
+      }
+    end
+
     assert_response :bad_request
     assert_equal "invalid_request", response.parsed_body["error"]
   end
@@ -367,8 +386,8 @@ class OauthFlowTest < ActionDispatch::IntegrationTest
     get_consent_screen scope: "read write"
 
     assert_response :success
-    assert_select "select[name=scope] option[selected]", count: 1
-    assert_select "select[name=scope] option[selected][value=?]", "read write"
+    assert_select "input[type=radio][name=scope][checked]", count: 1
+    assert_select "input[type=radio][name=scope][checked][value=?]", "read write"
   end
 
   test "authorization preselects Read + Write when the client requests write" do
@@ -377,7 +396,7 @@ class OauthFlowTest < ActionDispatch::IntegrationTest
     get_consent_screen scope: "write"
 
     assert_response :success
-    assert_select "select[name=scope] option[selected][value=?]", "read write"
+    assert_select "input[type=radio][name=scope][checked][value=?]", "read write"
   end
 
   test "authorization preselects Read for a read request" do
@@ -386,7 +405,7 @@ class OauthFlowTest < ActionDispatch::IntegrationTest
     get_consent_screen scope: "read"
 
     assert_response :success
-    assert_select "select[name=scope] option[selected][value=?]", "read"
+    assert_select "input[type=radio][name=scope][checked][value=?]", "read"
   end
 
   test "authorization offers no write option to a read-only client" do
@@ -396,8 +415,8 @@ class OauthFlowTest < ActionDispatch::IntegrationTest
     get_consent_screen client: client, scope: "read"
 
     assert_response :success
-    assert_select "select[name=scope] option", count: 1
-    assert_select "select[name=scope] option[value=?]", "read"
+    assert_select "input[type=radio][name=scope]", count: 1
+    assert_select "input[type=radio][name=scope][value=?]", "read"
   end
 
   test "consent grants the canonical read write scope" do
diff --git a/test/integration/oauth_instrumentation_test.rb b/test/integration/oauth_instrumentation_test.rb
index a0033bd27a..39d62ae9eb 100644
--- a/test/integration/oauth_instrumentation_test.rb
+++ b/test/integration/oauth_instrumentation_test.rb
@@ -62,6 +62,17 @@ class OauthInstrumentationTest < ActionDispatch::IntegrationTest
     assert_equal [ { endpoint: "tokens", error_code: "invalid_grant", client_type: "unknown" } ], payloads
   end
 
+  test "an authorization error shown on the error page is counted too" do
+    sign_in_as :david
+
+    payloads = notifications("error.oauth") do
+      untenanted { get new_oauth_authorization_path, params: { client_id: "nobody_#{SecureRandom.hex}", response_type: "code" } }
+    end
+
+    assert_response :bad_request
+    assert_equal [ { endpoint: "authorizations", error_code: "invalid_request", client_type: "unknown" } ], payloads
+  end
+
   test "a rejected registration is a clients error" do
     payloads = notifications("error.oauth") do
       untenanted { post oauth_clients_path, as: :json, params: { redirect_uris: %w[ http://example.com/callback ] } }
diff --git a/test/models/oauth/client_test.rb b/test/models/oauth/client_test.rb
index 89eca65cf6..f10d6b7c20 100644
--- a/test/models/oauth/client_test.rb
+++ b/test/models/oauth/client_test.rb
@@ -626,6 +626,15 @@ class Oauth::ClientTest < ActiveSupport::TestCase
     assert_not Oauth::Client.exists?(client.id)
   end
 
+  test "connection_kind tells our apps, tools on this device and web apps apart" do
+    assert_equal :fizzy, oauth_clients(:trusted_client).connection_kind
+    assert_equal :local, oauth_clients(:mcp_client).connection_kind
+    assert_equal :web, oauth_clients(:confidential_client).connection_kind
+    assert_equal :local, Oauth::Client.new(redirect_uris: %w[ com.example.app:/callback http://[::1]/cb ]).connection_kind
+    assert_equal :web, Oauth::Client.new(redirect_uris: %w[ http://127.0.0.1/cb https://example.com/cb ]).connection_kind
+    assert_equal :local, Oauth::Client.new(redirect_uris: %w[ https://127.0.0.1/cb https://localhost:8443/cb ]).connection_kind
+  end
+
   private
     def register_metadata_document_client(**attributes)
       Oauth::Client.create! name: "Claude", client_id: "https://claude.ai/client.json", redirect_uris: %w[ https://claude.ai/callback ], client_id_metadata_document: true, **attributes