diff --git a/crates/tracedecay-dashboard-api/src/access.rs b/crates/tracedecay-dashboard-api/src/access.rs
index 506ec7653e..f7e8a0a2e4 100644
--- a/crates/tracedecay-dashboard-api/src/access.rs
+++ b/crates/tracedecay-dashboard-api/src/access.rs
@@ -2,15 +2,22 @@
 //!
 //! Loopback is reachable by every local account, so binding to 127.0.0.1 is
 //! not an access boundary. Each dashboard listener mints a random token that
-//! only its launch URL carries. A browser trades that URL once for an
-//! `HttpOnly`, `SameSite=Strict` cookie; programmatic clients send the token as
-//! the Basic-auth password.
+//! only its launch URL carries.
+//!
+//! The token is never stored in a cookie: browsers scope cookies by host, not
+//! port, so a cookie would ride along to every other service on the same
+//! loopback host. Instead the launch URL is traded for a redirect that moves
+//! the token into the URL fragment (never sent on the wire, never in a
+//! `Referer`); the page script keeps it in origin-scoped storage and sends it
+//! as the Basic-auth password on each request, as programmatic clients do.
+//! The embedded page shell carries no secret, so it is served without a
+//! credential; every `/api` route needs one.
 
 use std::fmt;
 use std::net::SocketAddr;
 use std::sync::Arc;
 
-use axum::http::{HeaderMap, HeaderValue, Method, Uri, header};
+use axum::http::{HeaderMap, Method, Uri, header};
 use base64::Engine as _;
 use base64::engine::general_purpose::STANDARD as BASE64;
 
@@ -42,7 +49,8 @@ impl DashboardAccessToken {
         })
     }
 
-    /// The URL a person opens; the listener trades it for a session cookie.
+    /// The URL a person opens; the listener trades it for a redirect that
+    /// hands the token to the page through the URL fragment.
     pub fn launch_url(&self, addr: SocketAddr) -> String {
         format!("http://{addr}/?{LAUNCH_QUERY_KEY}={}", self.token)
     }
@@ -61,56 +69,44 @@ impl fmt::Debug for DashboardAccessToken {
 
 pub(crate) enum DashboardCredential {
     Admitted,
-    /// A valid launch URL: answer with a redirect that drops the token from
-    /// the address bar and sets the session cookie.
+    /// A valid launch URL on the page shell: answer with a redirect that drops
+    /// the token from the query and delivers it in the fragment.
     Launch {
         location: String,
-        set_cookie: HeaderValue,
     },
     Missing,
 }
 
 pub(crate) fn classify_credential(
     access: &DashboardAccessToken,
-    port: u16,
     method: &Method,
     uri: &Uri,
     headers: &HeaderMap,
 ) -> DashboardCredential {
-    let cookie_name = session_cookie_name(port);
-    // A launch URL is exchanged even when a session already exists, so the
-    // token never stays in the address bar or history.
-    if let Some(launch) = launch_exchange(access, &cookie_name, method, uri) {
-        return launch;
+    if is_page_shell(method, uri) {
+        // A launch URL is exchanged even when the page already holds the
+        // token, so the token never stays in the query or history.
+        return launch_exchange(access, uri).unwrap_or(DashboardCredential::Admitted);
     }
     let basic = headers.get(header::AUTHORIZATION).is_some_and(|value| {
         constant_time_eq(value.as_bytes(), access.basic_authorization.as_bytes())
     });
-    let cookie = headers
-        .get_all(header::COOKIE)
-        .iter()
-        .filter_map(|value| value.to_str().ok())
-        .flat_map(|value| value.split(';'))
-        .filter_map(|pair| pair.trim().split_once('='))
-        .any(|(name, value)| {
-            name == cookie_name && constant_time_eq(value.as_bytes(), access.token.as_bytes())
-        });
-    if basic || cookie {
+    if basic {
         DashboardCredential::Admitted
     } else {
         DashboardCredential::Missing
     }
 }
 
-fn launch_exchange(
-    access: &DashboardAccessToken,
-    cookie_name: &str,
-    method: &Method,
-    uri: &Uri,
-) -> Option<DashboardCredential> {
-    if !matches!(*method, Method::GET | Method::HEAD) {
-        return None;
-    }
+/// The embedded single-page app (index, `/static/**`, client-side routes) is
+/// public code the browser must fetch before it can hold a token. Everything
+/// under `/api` is data and stays credentialed.
+fn is_page_shell(method: &Method, uri: &Uri) -> bool {
+    let path = uri.path();
+    matches!(*method, Method::GET | Method::HEAD) && path != "/api" && !path.starts_with("/api/")
+}
+
+fn launch_exchange(access: &DashboardAccessToken, uri: &Uri) -> Option<DashboardCredential> {
     let query = uri.query()?;
     let mut launch = false;
     let remaining: Vec<&str> = query
@@ -126,30 +122,17 @@ fn launch_exchange(
     if !launch {
         return None;
     }
+    let path = uri.path();
     let location = if remaining.is_empty() {
-        uri.path().to_owned()
+        format!("{path}#{LAUNCH_QUERY_KEY}={}", access.token)
     } else {
-        format!("{}?{}", uri.path(), remaining.join("&"))
+        format!(
+            "{path}?{}#{LAUNCH_QUERY_KEY}={}",
+            remaining.join("&"),
+            access.token
+        )
     };
-    let set_cookie = HeaderValue::from_str(&format!(
-        "{cookie_name}={}; Path=/; HttpOnly; SameSite=Strict",
-        access.token
-    ))
-    .ok()?;
-    Some(DashboardCredential::Launch {
-        location,
-        set_cookie,
-    })
-}
-
-/// Browsers scope cookies by host, not port, so the name carries the port to
-/// keep concurrent dashboards on one loopback host from overwriting each
-/// other's session.
-// ponytail: any listener on another 127.0.0.1 port that this browser visits
-// also receives the cookie; closing that needs per-request header tokens in
-// the SPA (EventSource cannot send headers), so the cookie stays until then.
-fn session_cookie_name(port: u16) -> String {
-    format!("tracedecay_dashboard_{port}")
+    Some(DashboardCredential::Launch { location })
 }
 
 fn constant_time_eq(left: &[u8], right: &[u8]) -> bool {
diff --git a/crates/tracedecay-dashboard-api/src/authority_tests.rs b/crates/tracedecay-dashboard-api/src/authority_tests.rs
index f36b88df20..7ad4b41acf 100644
--- a/crates/tracedecay-dashboard-api/src/authority_tests.rs
+++ b/crates/tracedecay-dashboard-api/src/authority_tests.rs
@@ -154,6 +154,7 @@ async fn admitted_automation_route_carries_the_backend_sized_deadline() {
 }
 
 mod automatic_fact_receipts_routes;
+mod credential_isolation;
 
 /// The loopback authority every admitted-router fixture binds. Requests
 /// must carry it as their `Host` header for the admission layer to admit
@@ -182,7 +183,9 @@ fn admitted_request(uri: impl AsRef<str>) -> Request<Body> {
 
 /// Other local accounts reach the same loopback port, so the Host and
 /// Origin checks alone must not admit a request: only the listener's
-/// token does, as a Basic password, a session cookie, or a launch URL.
+/// token does, as a Basic password or a launch URL. The page shell is the one
+/// public surface: it carries no secret and a browser cannot attach headers to
+/// a navigation or `<script>` fetch.
 #[tokio::test]
 async fn loopback_requests_need_the_listener_access_token() {
     async fn probe() -> StatusCode {
@@ -244,7 +247,12 @@ async fn loopback_requests_need_the_listener_access_token() {
             .unwrap(),
     )
     .await;
-    assert_eq!(wrong_launch.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(
+        wrong_launch.status(),
+        StatusCode::NO_CONTENT,
+        "a forged launch URL is just the public shell, never a redirect that carries a token"
+    );
+    assert!(!wrong_launch.headers().contains_key(header::LOCATION));
     let posted_launch = send(
         request(Method::POST, launch_path)
             .body(Body::empty())
@@ -252,6 +260,21 @@ async fn loopback_requests_need_the_listener_access_token() {
     )
     .await;
     assert_eq!(posted_launch.status(), StatusCode::UNAUTHORIZED);
+    let api_launch = send(
+        request(
+            Method::GET,
+            &format!("/api/automation/scheduler/status?{}", &launch_path[2..]),
+        )
+        .body(Body::empty())
+        .unwrap(),
+    )
+    .await;
+    assert_eq!(
+        api_launch.status(),
+        StatusCode::UNAUTHORIZED,
+        "the launch token in an API query authenticates nothing"
+    );
+    let token = launch_path.strip_prefix("/?token=").expect("launch token");
     let launch = send(
         request(Method::GET, &format!("{launch_path}&view=brain"))
             .body(Body::empty())
@@ -259,47 +282,40 @@ async fn loopback_requests_need_the_listener_access_token() {
     )
     .await;
     assert_eq!(launch.status(), StatusCode::SEE_OTHER);
-    assert_eq!(launch.headers()[header::LOCATION], "/?view=brain");
-    let set_cookie = launch.headers()[header::SET_COOKIE]
-        .to_str()
-        .expect("cookie text");
-    let token = launch_path.strip_prefix("/?token=").expect("launch token");
     assert_eq!(
-        set_cookie,
-        format!("tracedecay_dashboard_{port}={token}; Path=/; HttpOnly; SameSite=Strict")
+        launch.headers()[header::LOCATION],
+        format!("/?view=brain#token={token}").as_str()
+    );
+    assert!(
+        !launch.headers().contains_key(header::SET_COOKIE),
+        "a cookie would be replayed to every other loopback port"
     );
+    assert_eq!(launch.headers()[header::CACHE_CONTROL], "no-store");
+    assert_eq!(launch.headers()[header::REFERRER_POLICY], "no-referrer");
 
-    let session = send(
-        request(Method::POST, "/api/automation/scheduler/pause")
-            .header(
-                header::COOKIE,
-                format!("theme=dark; tracedecay_dashboard_{port}={token}"),
-            )
-            .body(Body::empty())
-            .unwrap(),
-    )
-    .await;
-    assert_eq!(session.status(), StatusCode::NO_CONTENT);
     let relaunch = send(
         request(Method::GET, launch_path)
-            .header(
-                header::COOKIE,
-                format!("tracedecay_dashboard_{port}={token}"),
-            )
+            .header(header::AUTHORIZATION, access.basic_authorization())
             .body(Body::empty())
             .unwrap(),
     )
     .await;
     assert_eq!(relaunch.status(), StatusCode::SEE_OTHER);
-    assert_eq!(relaunch.headers()[header::LOCATION], "/");
-    let other_port_cookie = send(
+    assert_eq!(
+        relaunch.headers()[header::LOCATION],
+        format!("/#token={token}").as_str()
+    );
+    let session_cookie = send(
         request(Method::POST, "/api/automation/scheduler/pause")
-            .header(header::COOKIE, format!("tracedecay_dashboard_1={token}"))
+            .header(
+                header::COOKIE,
+                format!("tracedecay_dashboard_{port}={token}"),
+            )
             .body(Body::empty())
             .unwrap(),
     )
     .await;
-    assert_eq!(other_port_cookie.status(), StatusCode::UNAUTHORIZED);
+    assert_eq!(session_cookie.status(), StatusCode::UNAUTHORIZED);
 }
 
 /// The router as production serves it.
diff --git a/crates/tracedecay-dashboard-api/src/authority_tests/credential_isolation.rs b/crates/tracedecay-dashboard-api/src/authority_tests/credential_isolation.rs
new file mode 100644
index 0000000000..c5d24c049f
--- /dev/null
+++ b/crates/tracedecay-dashboard-api/src/authority_tests/credential_isolation.rs
@@ -0,0 +1,238 @@
+//! A browser authenticated to one dashboard must not hand a replayable
+//! credential to any other service on the same loopback host.
+//!
+//! Browsers scope cookies by host, not port, so any `Set-Cookie` a dashboard
+//! sends is replayed to every other loopback port the browser visits. The
+//! fixture therefore models the two browser stores that matter: a host-scoped
+//! cookie jar, and origin-scoped page storage (origin includes the port) that
+//! the page script fills from the launch URL fragment. A real second listener
+//! records the raw bytes it receives.
+
+use std::collections::HashMap;
+
+use axum::Router;
+use axum::body::Body;
+use axum::http::{Method, Request, Response, StatusCode, header};
+use axum::routing::{get, post};
+use tokio::io::{AsyncReadExt, AsyncWriteExt};
+use tokio::net::TcpListener;
+use tower::ServiceExt;
+
+use crate::{DashboardAccessToken, with_dashboard_http_admission};
+
+const PAUSE: &str = "/api/automation/scheduler/pause";
+
+/// One dashboard as a browser reaches it: the admission-wrapped router plus
+/// the port its `Host` header must name.
+struct Dashboard {
+    port: u16,
+    token: DashboardAccessToken,
+    app: Router,
+}
+
+impl Dashboard {
+    fn start(port: u16) -> Self {
+        async fn ok() -> StatusCode {
+            StatusCode::NO_CONTENT
+        }
+        let token = DashboardAccessToken::mint().expect("dashboard access token");
+        let app = with_dashboard_http_admission(
+            Router::new().route("/", get(ok)).route(PAUSE, post(ok)),
+            std::net::SocketAddr::from(([127, 0, 0, 1], port)),
+            token.clone(),
+        );
+        Self { port, token, app }
+    }
+
+    fn launch_path(&self) -> String {
+        let url = self.token.launch_url(([127, 0, 0, 1], self.port).into());
+        url.strip_prefix(&format!("http://127.0.0.1:{}", self.port))
+            .expect("launch URL names the bound listener")
+            .to_owned()
+    }
+
+    async fn send(&self, method: Method, uri: &str, authorization: Option<&str>) -> Response<Body> {
+        let mut request = Request::builder()
+            .method(method)
+            .uri(uri)
+            .header(header::HOST, format!("127.0.0.1:{}", self.port));
+        if let Some(authorization) = authorization {
+            request = request.header(header::AUTHORIZATION, authorization);
+        }
+        self.app
+            .clone()
+            .oneshot(request.body(Body::empty()).expect("request"))
+            .await
+            .expect("admission response")
+    }
+}
+
+/// The browser state that survives between requests to loopback services.
+#[derive(Default)]
+struct Browser {
+    /// `name=value` pairs keyed by host only, as RFC 6265 scopes them.
+    cookie_jar: Vec<String>,
+    /// Page storage keyed by origin (`host:port`); only the page script of
+    /// that origin reads it back.
+    page_storage: HashMap<u16, String>,
+}
+
+impl Browser {
+    fn store_cookies(&mut self, response: &Response<Body>) {
+        for set_cookie in response.headers().get_all(header::SET_COOKIE) {
+            let pair = set_cookie.to_str().expect("cookie text");
+            self.cookie_jar
+                .push(pair.split(';').next().unwrap().to_owned());
+        }
+    }
+
+    /// Opens the launch URL, follows the redirect, and lets the page script
+    /// adopt the fragment, exactly as the dashboard bundle does.
+    async fn open(&mut self, dashboard: &Dashboard) {
+        let launch = dashboard
+            .send(Method::GET, &dashboard.launch_path(), None)
+            .await;
+        assert_eq!(launch.status(), StatusCode::SEE_OTHER);
+        self.store_cookies(&launch);
+        let location = launch.headers()[header::LOCATION]
+            .to_str()
+            .expect("location")
+            .to_owned();
+        let (path, fragment) = location.split_once('#').expect("token rides the fragment");
+        let token = fragment
+            .strip_prefix("token=")
+            .expect("fragment carries the launch token");
+        // A fragment is never part of the request the browser sends.
+        let shell = dashboard.send(Method::GET, path, None).await;
+        assert_eq!(shell.status(), StatusCode::NO_CONTENT);
+        self.store_cookies(&shell);
+        self.page_storage.insert(dashboard.port, token.to_owned());
+    }
+
+    /// An API write from a dashboard's own page script.
+    async fn page_write(&self, dashboard: &Dashboard) -> StatusCode {
+        use base64::Engine as _;
+        let token = self
+            .page_storage
+            .get(&dashboard.port)
+            .expect("the page adopted a token");
+        let basic = format!(
+            "Basic {}",
+            base64::engine::general_purpose::STANDARD.encode(format!("tracedecay:{token}"))
+        );
+        dashboard
+            .send(Method::POST, PAUSE, Some(&basic))
+            .await
+            .status()
+    }
+
+    /// Visits another loopback service: the browser attaches every cookie its
+    /// jar holds for the host, and nothing from any dashboard's page storage.
+    async fn visit_raw_listener(&self) -> String {
+        let listener = TcpListener::bind(("127.0.0.1", 0)).await.expect("bind");
+        let service = listener.local_addr().unwrap().port();
+        let capture = tokio::spawn(async move {
+            let (mut stream, _) = listener.accept().await.expect("accept");
+            let mut received = Vec::new();
+            let mut buffer = [0_u8; 1024];
+            while !received.windows(4).any(|window| window == b"\r\n\r\n") {
+                let read = stream.read(&mut buffer).await.expect("read");
+                assert_ne!(read, 0, "the browser closed before finishing its request");
+                received.extend_from_slice(&buffer[..read]);
+            }
+            stream
+                .write_all(b"HTTP/1.1 204 No Content\r\nconnection: close\r\n\r\n")
+                .await
+                .expect("respond");
+            String::from_utf8(received).expect("request text")
+        });
+        let mut request = format!("GET / HTTP/1.1\r\nHost: 127.0.0.1:{service}\r\n");
+        if !self.cookie_jar.is_empty() {
+            request.push_str(&format!("Cookie: {}\r\n", self.cookie_jar.join("; ")));
+        }
+        request.push_str("\r\n");
+        let mut stream = tokio::net::TcpStream::connect(("127.0.0.1", service))
+            .await
+            .expect("connect");
+        stream.write_all(request.as_bytes()).await.expect("send");
+        capture.await.expect("capture task")
+    }
+}
+
+#[tokio::test]
+async fn an_unrelated_loopback_listener_receives_no_replayable_credential() {
+    let dashboard = Dashboard::start(43_201);
+    let mut browser = Browser::default();
+    browser.open(&dashboard).await;
+    assert_eq!(
+        browser.page_write(&dashboard).await,
+        StatusCode::NO_CONTENT,
+        "the dashboard's own page stays authenticated"
+    );
+
+    let captured = browser.visit_raw_listener().await;
+    let secret = dashboard
+        .launch_path()
+        .strip_prefix("/?token=")
+        .expect("launch token")
+        .to_owned();
+    assert!(
+        !captured.contains(&secret),
+        "the other listener saw the dashboard token:\n{captured}"
+    );
+    let lowered = captured.to_ascii_lowercase();
+    assert!(
+        !lowered.contains("cookie:") && !lowered.contains("authorization:"),
+        "the other listener received credential-bearing headers:\n{captured}"
+    );
+}
+
+#[tokio::test]
+async fn concurrent_dashboards_keep_separate_credentials() {
+    let first = Dashboard::start(43_202);
+    let second = Dashboard::start(43_203);
+    let mut browser = Browser::default();
+    browser.open(&first).await;
+    browser.open(&second).await;
+    assert_eq!(browser.page_write(&first).await, StatusCode::NO_CONTENT);
+    assert_eq!(browser.page_write(&second).await, StatusCode::NO_CONTENT);
+
+    let first_token = browser.page_storage[&first.port].clone();
+    let basic = {
+        use base64::Engine as _;
+        format!(
+            "Basic {}",
+            base64::engine::general_purpose::STANDARD.encode(format!("tracedecay:{first_token}"))
+        )
+    };
+    let crossed = second.send(Method::POST, PAUSE, Some(&basic)).await;
+    assert_eq!(
+        crossed.status(),
+        StatusCode::UNAUTHORIZED,
+        "one dashboard's credential must not open another"
+    );
+}
+
+/// The credential is not replayable as a cookie either: a client that
+/// presents the old cookie shape gets nothing.
+#[tokio::test]
+async fn a_cookie_is_not_a_credential() {
+    let dashboard = Dashboard::start(43_204);
+    let token = dashboard
+        .launch_path()
+        .strip_prefix("/?token=")
+        .expect("launch token")
+        .to_owned();
+    let request = Request::builder()
+        .method(Method::POST)
+        .uri(PAUSE)
+        .header(header::HOST, "127.0.0.1:43204")
+        .header(
+            header::COOKIE,
+            format!("tracedecay_dashboard_43204={token}"),
+        )
+        .body(Body::empty())
+        .unwrap();
+    let response = dashboard.app.clone().oneshot(request).await.unwrap();
+    assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
+}
diff --git a/crates/tracedecay-dashboard-api/src/http_admission.rs b/crates/tracedecay-dashboard-api/src/http_admission.rs
index 470ad9e4f5..cc65ff387b 100644
--- a/crates/tracedecay-dashboard-api/src/http_admission.rs
+++ b/crates/tracedecay-dashboard-api/src/http_admission.rs
@@ -240,18 +240,12 @@ fn admit_dashboard_http_control(
         }
     }
 
-    match access::classify_credential(
-        &admission.access,
-        admission.port,
-        request.method(),
-        request.uri(),
-        &headers,
-    ) {
+    match access::classify_credential(&admission.access, request.method(), request.uri(), &headers)
+    {
         access::DashboardCredential::Admitted => {}
-        access::DashboardCredential::Launch {
-            location,
-            set_cookie,
-        } => return Err(Box::new(dashboard_launch_redirect(&location, set_cookie))),
+        access::DashboardCredential::Launch { location } => {
+            return Err(Box::new(dashboard_launch_redirect(&location)));
+        }
         access::DashboardCredential::Missing => {
             return Err(Box::new(dashboard_request_unauthenticated()));
         }
@@ -317,10 +311,9 @@ fn dashboard_request_unauthenticated() -> Response {
         .into_response()
 }
 
-fn dashboard_launch_redirect(location: &str, set_cookie: header::HeaderValue) -> Response {
+fn dashboard_launch_redirect(location: &str) -> Response {
     let mut response = axum::response::Redirect::to(location).into_response();
     let headers = response.headers_mut();
-    headers.insert(header::SET_COOKIE, set_cookie);
     headers.insert(
         header::CACHE_CONTROL,
         header::HeaderValue::from_static("no-store"),
diff --git a/crates/tracedecay/benches/large_repos.rs b/crates/tracedecay/benches/large_repos.rs
index eee5264b11..85f87c86d5 100644
--- a/crates/tracedecay/benches/large_repos.rs
+++ b/crates/tracedecay/benches/large_repos.rs
@@ -464,15 +464,18 @@ fn verify_dashboard_fixture(
     if launched.status().as_u16() != 303 {
         return Err("dashboard launch did not exchange the credential".into());
     }
-    let cookie = launched
-        .headers()
-        .get("set-cookie")
-        .and_then(|value| value.to_str().ok())
-        .and_then(|value| value.split(';').next())
-        .ok_or("dashboard launch omitted its session cookie")?;
+    if launched.headers().contains_key("set-cookie") {
+        return Err("dashboard launch must not set a host-wide cookie".into());
+    }
+    let token = launch_url
+        .split_once("?token=")
+        .map(|(_, token)| token)
+        .ok_or("dashboard launch URL omitted its token")?;
     let mut response = agent
-        .get(&format!("{origin}/api/projects"))
-        .header("Cookie", cookie)
+        .get(&format!(
+            "http://tracedecay:{token}@{}/api/projects",
+            origin.trim_start_matches("http://")
+        ))
         .call()
         .map_err(|error| error.to_string())?;
     if response.status().as_u16() != 200 {
diff --git a/crates/tracedecay/tests/mcp_suite/mcp_dashboard_tool_test.rs b/crates/tracedecay/tests/mcp_suite/mcp_dashboard_tool_test.rs
index 4d39e8b2aa..9637638510 100644
--- a/crates/tracedecay/tests/mcp_suite/mcp_dashboard_tool_test.rs
+++ b/crates/tracedecay/tests/mcp_suite/mcp_dashboard_tool_test.rs
@@ -135,10 +135,14 @@ async fn tracedecay_dashboard_tool_starts_and_returns_url_and_serves_capabilitie
         .get(&format!("{origin}/?token={}", "0".repeat(64)))
         .call()
         .expect("forged launch response");
-    assert_eq!(forged.status().as_u16(), 401);
+    assert!(
+        forged.headers().get("location").is_none() && forged.headers().get("set-cookie").is_none(),
+        "a forged launch URL earns no redirect and no credential"
+    );
 
     // A browser opening the launch URL is redirected to the tokenless path
-    // with a session cookie, and that cookie alone admits later requests.
+    // with the token in the URL fragment, never in a cookie that other loopback
+    // ports would receive; the page then sends it as a request header.
     let agent = tracedecay_application::http_agent::http_agent(
         ureq::Agent::config_builder()
             .http_status_as_error(false)
@@ -148,16 +152,18 @@ async fn tracedecay_dashboard_tool_starts_and_returns_url_and_serves_capabilitie
     );
     let launched = agent.get(&launch_url).call().expect("launch URL response");
     assert_eq!(launched.status().as_u16(), 303);
-    assert_eq!(launched.headers()["location"], "/");
-    let session_cookie = format!("tracedecay_dashboard_{port}={token}");
     assert_eq!(
-        launched.headers()["set-cookie"],
-        format!("{session_cookie}; Path=/; HttpOnly; SameSite=Strict").as_str()
+        launched.headers()["location"],
+        format!("/#token={token}").as_str()
+    );
+    assert!(launched.headers().get("set-cookie").is_none());
+    let cap_url = format!(
+        "{}/api/capabilities",
+        crate::common::dashboard_api_base_url(&launch_url)
     );
-    let cap_url = format!("{origin}/api/capabilities");
     // Give the background server a moment to accept (rarely needed but robust)
     for _ in 0..40 {
-        if let Ok(mut resp) = agent.get(&cap_url).header("Cookie", &session_cookie).call()
+        if let Ok(mut resp) = agent.get(&cap_url).call()
             && resp.status().as_u16() == 200
         {
             let raw = resp.body_mut().read_to_string().unwrap_or_default();
diff --git a/crates/tracedecay/tests/mcp_suite/native_root_daemon_test.rs b/crates/tracedecay/tests/mcp_suite/native_root_daemon_test.rs
index 89803b931c..04a91e29f2 100644
--- a/crates/tracedecay/tests/mcp_suite/native_root_daemon_test.rs
+++ b/crates/tracedecay/tests/mcp_suite/native_root_daemon_test.rs
@@ -83,7 +83,7 @@ async fn daemon_on_the_native_root_serves_tool_mcp_and_dashboard_then_stops_clea
         String::from_utf8_lossy(&tool.stderr)
     );
 
-    let (port, launch_url) = start_hosted_dashboard(&mut session);
+    let (_, launch_url) = start_hosted_dashboard(&mut session);
 
     let agent = tracedecay_application::http_agent::http_agent(
         ureq::Agent::config_builder()
@@ -94,13 +94,12 @@ async fn daemon_on_the_native_root_serves_tool_mcp_and_dashboard_then_stops_clea
     );
     let launched = agent.get(&launch_url).call().expect("launch URL response");
     assert_eq!(launched.status().as_u16(), 303);
-    let token = launch_url
-        .split_once("?token=")
-        .map(|(_, token)| token)
-        .expect("launch token");
+    assert!(launched.headers().get("set-cookie").is_none());
     let mut capabilities = agent
-        .get(&format!("http://127.0.0.1:{port}/api/capabilities"))
-        .header("Cookie", &format!("tracedecay_dashboard_{port}={token}"))
+        .get(&format!(
+            "{}/api/capabilities",
+            common::dashboard_api_base_url(&launch_url)
+        ))
         .call()
         .expect("dashboard capabilities response");
     assert_eq!(capabilities.status().as_u16(), 200);
diff --git a/dashboard/src/app/main.tsx b/dashboard/src/app/main.tsx
index 52bccdbc87..3c54b935de 100644
--- a/dashboard/src/app/main.tsx
+++ b/dashboard/src/app/main.tsx
@@ -3,6 +3,7 @@ import { createRoot } from 'react-dom/client';
 import { QueryClient, QueryClientProvider } from '@tanstack/react-query';
 import { RouterProvider } from 'react-router';
 import '../theme/tailwind.css';
+import { installDashboardAuthentication } from '../data/auth/install.ts';
 import { applyEmbeddedPublicPath, dashboardRouterBasename } from './embedBasename.ts';
 import { dashboardRouterForPath, ScopedEventsProvider } from './runtime.tsx';
 
@@ -16,6 +17,8 @@ const queryClient = new QueryClient({
   },
 });
 
+installDashboardAuthentication();
+
 const rootEl = document.getElementById('root');
 if (!rootEl) throw new Error('missing #root');
 
diff --git a/dashboard/src/data/auth/authenticatedEventSource.dom.test.ts b/dashboard/src/data/auth/authenticatedEventSource.dom.test.ts
new file mode 100644
index 0000000000..9ce6659a5c
--- /dev/null
+++ b/dashboard/src/data/auth/authenticatedEventSource.dom.test.ts
@@ -0,0 +1,159 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const TOKEN = 'cd'.repeat(32);
+const BASIC = `Basic ${btoa(`tracedecay:${TOKEN}`)}`;
+
+/** A response whose body is fed chunk by chunk, so frames can split anywhere. */
+function streamResponse(chunks: string[], init: ResponseInit = {}): Response {
+  const encoder = new TextEncoder();
+  const body = new ReadableStream<Uint8Array>({
+    start(controller) {
+      for (const chunk of chunks) controller.enqueue(encoder.encode(chunk));
+      controller.close();
+    },
+  });
+  return new Response(body, {
+    status: 200,
+    headers: { 'content-type': 'text/event-stream' },
+    ...init,
+  });
+}
+
+/** Never-ending stream, so a connection stays open until closed. */
+function openResponse(): Response {
+  return new Response(new ReadableStream<Uint8Array>({ start() {} }), {
+    status: 200,
+    headers: { 'content-type': 'text/event-stream' },
+  });
+}
+
+async function eventually(check: () => void): Promise<void> {
+  await vi.waitFor(check, { timeout: 2000, interval: 5 });
+}
+
+describe('AuthenticatedEventSource', () => {
+  const fetchMock = vi.fn<(input: RequestInfo | URL, init?: RequestInit) => Promise<Response>>();
+
+  beforeEach(() => {
+    sessionStorage.setItem('tracedecay.dashboard.access', TOKEN);
+    vi.resetModules();
+    fetchMock.mockReset();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    sessionStorage.clear();
+  });
+
+  /** Loads the class, then constructs synchronously so handlers attach before
+   * the first awaited step, as `connectEvents` does. */
+  async function opener(url = '/api/events') {
+    const { AuthenticatedEventSource } = await import('./authenticatedEventSource.ts');
+    return () => new AuthenticatedEventSource(url);
+  }
+
+  it('authenticates the stream with a request header and no cookie', async () => {
+    fetchMock.mockResolvedValue(openResponse());
+    const open = await opener();
+    const source = open();
+    const opened = vi.fn();
+    source.onopen = opened;
+
+    await eventually(() => expect(fetchMock).toHaveBeenCalledTimes(1));
+    const headers = new Headers(fetchMock.mock.calls[0]![1]!.headers);
+    expect(headers.get('authorization')).toBe(BASIC);
+    expect(headers.get('accept')).toBe('text/event-stream');
+    expect(fetchMock.mock.calls[0]![1]!.credentials).toBeUndefined();
+    await eventually(() => expect(opened).toHaveBeenCalled());
+    expect(source.readyState).toBe(1);
+    source.close();
+  });
+
+  it('delivers named and default events across arbitrary chunk boundaries', async () => {
+    fetchMock.mockResolvedValueOnce(
+      streamResponse([
+        ': keepalive\n\nevent: heart',
+        'beat\ndata: {"a"',
+        ':1}\r\n\r\ndata: one\r',
+        '\ndata: two\n\n',
+      ]),
+    );
+    fetchMock.mockResolvedValue(openResponse());
+    const open = await opener();
+    const source = open();
+    const named = vi.fn();
+    const plain = vi.fn();
+    source.addEventListener('heartbeat', named);
+    source.onmessage = plain;
+
+    await eventually(() => expect(plain).toHaveBeenCalledTimes(1));
+    expect(named.mock.calls[0]![0].data).toBe('{"a":1}');
+    expect(plain.mock.calls[0]![0].data).toBe('one\ntwo');
+    source.close();
+  });
+
+  it('reconnects with Last-Event-ID and the server retry hint after the stream drops', async () => {
+    fetchMock.mockResolvedValueOnce(streamResponse(['retry: 1\nid: 7\ndata: x\n\n']));
+    fetchMock.mockResolvedValue(openResponse());
+    const open = await opener();
+    const source = open();
+    const errors = vi.fn();
+    source.onerror = errors;
+
+    await eventually(() => expect(fetchMock).toHaveBeenCalledTimes(2));
+    expect(new Headers(fetchMock.mock.calls[1]![1]!.headers).get('last-event-id')).toBe('7');
+    expect(errors).toHaveBeenCalled();
+    source.close();
+  });
+
+  it('closes for good on a refusal instead of retrying with the same credential', async () => {
+    fetchMock.mockResolvedValue(new Response('{}', { status: 401 }));
+    const open = await opener();
+    const source = open();
+    const errors = vi.fn();
+    source.onerror = errors;
+
+    await eventually(() => expect(source.readyState).toBe(2));
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    expect(errors).toHaveBeenCalledTimes(1);
+  });
+
+  it('close() aborts the in-flight request', async () => {
+    fetchMock.mockResolvedValue(openResponse());
+    const open = await opener();
+    const source = open();
+    await eventually(() => expect(fetchMock).toHaveBeenCalled());
+
+    source.close();
+
+    expect(fetchMock.mock.calls[0]![1]!.signal!.aborted).toBe(true);
+    expect(source.readyState).toBe(2);
+  });
+});
+
+describe('installDashboardAuthentication', () => {
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    sessionStorage.clear();
+    window.history.replaceState(null, '', '/');
+  });
+
+  it('routes the app event stream through an authenticated fetch', async () => {
+    vi.resetModules();
+    const fetchMock = vi.fn(async () => openResponse());
+    vi.stubGlobal('fetch', fetchMock);
+    window.history.replaceState(null, '', `/#token=${TOKEN}`);
+    const { installDashboardAuthentication } = await import('./install.ts');
+    const { connectEvents } = await import('../sse/connect.ts');
+
+    installDashboardAuthentication();
+    const connection = connectEvents('/api/events');
+
+    await eventually(() => expect(connection.state()).toBe('live'));
+    const calls = fetchMock.mock.calls as unknown as Array<[string, RequestInit]>;
+    expect(new Headers(calls[0]![1].headers).get('authorization')).toBe(BASIC);
+    expect(window.location.hash).toBe('');
+    connection.close();
+  });
+});
diff --git a/dashboard/src/data/auth/authenticatedEventSource.ts b/dashboard/src/data/auth/authenticatedEventSource.ts
new file mode 100644
index 0000000000..25bf71da1c
--- /dev/null
+++ b/dashboard/src/data/auth/authenticatedEventSource.ts
@@ -0,0 +1,126 @@
+import { dashboardFetch } from './credential.ts';
+
+type Listener = (event: MessageEvent<string>) => void;
+
+const DEFAULT_RETRY_MS = 3000;
+
+/**
+ * The slice of the browser `EventSource` the dashboard uses, built on `fetch`
+ * so each connection can carry the `Authorization` header that native
+ * `EventSource` cannot send. Like the native class, a response that is not a
+ * `200 text/event-stream` closes the source for good, while a dropped stream
+ * reconnects (after the server's `retry:` hint) and resumes with
+ * `Last-Event-ID`.
+ */
+export class AuthenticatedEventSource {
+  static readonly CONNECTING = 0;
+  static readonly OPEN = 1;
+  static readonly CLOSED = 2;
+
+  readonly url: string;
+  readyState: number = AuthenticatedEventSource.CONNECTING;
+  onopen: ((event: Event) => void) | null = null;
+  onerror: ((event: Event) => void) | null = null;
+  onmessage: Listener | null = null;
+
+  private readonly listeners = new Map<string, Set<Listener>>();
+  private readonly abort = new AbortController();
+  private lastEventId = '';
+  private retryMs = DEFAULT_RETRY_MS;
+
+  constructor(url: string) {
+    this.url = url;
+    void this.run();
+  }
+
+  addEventListener(type: string, listener: Listener): void {
+    const set = this.listeners.get(type) ?? new Set<Listener>();
+    set.add(listener);
+    this.listeners.set(type, set);
+  }
+
+  close(): void {
+    this.readyState = AuthenticatedEventSource.CLOSED;
+    this.abort.abort();
+  }
+
+  private get closed(): boolean {
+    return this.readyState === AuthenticatedEventSource.CLOSED;
+  }
+
+  private async run(): Promise<void> {
+    while (!this.closed) {
+      let response: Response | null = null;
+      try {
+        const headers = new Headers({ accept: 'text/event-stream', 'cache-control': 'no-cache' });
+        if (this.lastEventId !== '') headers.set('last-event-id', this.lastEventId);
+        response = await dashboardFetch(this.url, { headers, signal: this.abort.signal });
+      } catch {
+        // Transport failure: fall through to the reconnect path below.
+      }
+      if (this.closed) return;
+      if (response !== null) {
+        const contentType = response.headers.get('content-type') ?? '';
+        if (response.status !== 200 || response.body === null || !contentType.startsWith('text/event-stream')) {
+          this.fail();
+          return;
+        }
+        this.readyState = AuthenticatedEventSource.OPEN;
+        this.onopen?.(new Event('open'));
+        await this.consume(response.body);
+        if (this.closed) return;
+      }
+      this.readyState = AuthenticatedEventSource.CONNECTING;
+      this.onerror?.(new Event('error'));
+      await new Promise((resolve) => setTimeout(resolve, this.retryMs));
+    }
+  }
+
+  private fail(): void {
+    this.readyState = AuthenticatedEventSource.CLOSED;
+    this.onerror?.(new Event('error'));
+  }
+
+  private async consume(body: ReadableStream<Uint8Array>): Promise<void> {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let pending = '';
+    let event = { type: '', data: [] as string[] };
+    const line = (text: string) => {
+      if (text === '') {
+        if (event.data.length > 0) this.dispatch(event.type || 'message', event.data.join('\n'));
+        event = { type: '', data: [] };
+        return;
+      }
+      if (text.startsWith(':')) return;
+      const colon = text.indexOf(':');
+      const field = colon === -1 ? text : text.slice(0, colon);
+      let value = colon === -1 ? '' : text.slice(colon + 1);
+      if (value.startsWith(' ')) value = value.slice(1);
+      if (field === 'data') event.data.push(value);
+      else if (field === 'event') event.type = value;
+      else if (field === 'id' && !value.includes('\0')) this.lastEventId = value;
+      else if (field === 'retry' && /^\d+$/.test(value)) this.retryMs = Number(value);
+    };
+    try {
+      for (;;) {
+        const { done, value } = await reader.read();
+        if (done) return;
+        pending += decoder.decode(value, { stream: true });
+        // A trailing CR may be the first half of a CRLF; hold it back.
+        const complete = pending.endsWith('\r') ? pending.slice(0, -1) : pending;
+        const lines = complete.split(/\r\n|\n|\r/);
+        pending = lines.pop()! + pending.slice(complete.length);
+        for (const text of lines) line(text.replace(/^/, ''));
+      }
+    } catch {
+      // A dropped or aborted stream ends this connection; run() decides what next.
+    }
+  }
+
+  private dispatch(type: string, data: string): void {
+    const event = new MessageEvent<string>(type, { data, lastEventId: this.lastEventId });
+    if (type === 'message') this.onmessage?.(event);
+    for (const listener of this.listeners.get(type) ?? []) listener(event);
+  }
+}
diff --git a/dashboard/src/data/auth/credential.dom.test.ts b/dashboard/src/data/auth/credential.dom.test.ts
new file mode 100644
index 0000000000..6a2bbfdb8e
--- /dev/null
+++ b/dashboard/src/data/auth/credential.dom.test.ts
@@ -0,0 +1,95 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const TOKEN = 'ab'.repeat(32);
+const BASIC = `Basic ${btoa(`tracedecay:${TOKEN}`)}`;
+
+async function freshCredential() {
+  vi.resetModules();
+  return import('./credential.ts');
+}
+
+function sentHeaders(fetchMock: ReturnType<typeof vi.fn>): Headers {
+  const init = fetchMock.mock.calls.at(-1)?.[1] as RequestInit | undefined;
+  return new Headers(init?.headers);
+}
+
+describe('dashboard credential', () => {
+  const fetchMock = vi.fn(async () => new Response('{}'));
+
+  beforeEach(() => {
+    sessionStorage.clear();
+    window.history.replaceState(null, '', '/');
+    fetchMock.mockClear();
+    vi.stubGlobal('fetch', fetchMock);
+  });
+  afterEach(() => {
+    vi.unstubAllGlobals();
+  });
+
+  it('moves the launch token from the fragment into page storage and out of the address bar', async () => {
+    window.history.replaceState(null, '', `/brain?scope=x#token=${TOKEN}`);
+    const { adoptLaunchCredential } = await freshCredential();
+
+    adoptLaunchCredential();
+
+    expect(window.location.href).toBe('http://localhost:3000/brain?scope=x');
+    expect(sessionStorage.getItem('tracedecay.dashboard.access')).toBe(TOKEN);
+    expect(document.cookie).toBe('');
+  });
+
+  it('sends the credential as a Basic header on same-origin requests only', async () => {
+    window.history.replaceState(null, '', `/#token=${TOKEN}`);
+    const { adoptLaunchCredential, dashboardFetch } = await freshCredential();
+    adoptLaunchCredential();
+
+    await dashboardFetch('/api/capabilities', { headers: { accept: 'application/json' } });
+    expect(sentHeaders(fetchMock).get('authorization')).toBe(BASIC);
+    expect(sentHeaders(fetchMock).get('accept')).toBe('application/json');
+
+    await dashboardFetch('http://127.0.0.1:9/api/capabilities');
+    expect(fetchMock).toHaveBeenLastCalledWith('http://127.0.0.1:9/api/capabilities', undefined);
+
+    await dashboardFetch('/api/capabilities', { headers: { authorization: 'Bearer other' } });
+    expect(sentHeaders(fetchMock).get('authorization')).toBe('Bearer other');
+  });
+
+  it('authenticates requests through the shared JSON transport', async () => {
+    window.history.replaceState(null, '', `/#token=${TOKEN}`);
+    const { adoptLaunchCredential } = await freshCredential();
+    const { fetchJsonResponse } = await import('../query/responseBody.ts');
+    adoptLaunchCredential();
+
+    expect((await fetchJsonResponse('/api/settings')).outcome).toBe('response');
+    expect(sentHeaders(fetchMock).get('authorization')).toBe(BASIC);
+    expect(sentHeaders(fetchMock).get('accept')).toBe('application/json');
+  });
+
+  it('survives a reload through sessionStorage', async () => {
+    sessionStorage.setItem('tracedecay.dashboard.access', TOKEN);
+    const { dashboardFetch } = await freshCredential();
+
+    await dashboardFetch('/api/capabilities');
+
+    expect(sentHeaders(fetchMock).get('authorization')).toBe(BASIC);
+  });
+
+  it('never stores a malformed fragment token and still clears it from the address bar', async () => {
+    window.history.replaceState(null, '', '/#token=not-a-token&view=a');
+    const { adoptLaunchCredential, dashboardFetch } = await freshCredential();
+
+    adoptLaunchCredential();
+    await dashboardFetch('/api/capabilities');
+
+    expect(window.location.hash).toBe('#view=a');
+    expect(sessionStorage.getItem('tracedecay.dashboard.access')).toBeNull();
+    expect(fetchMock).toHaveBeenLastCalledWith('/api/capabilities', undefined);
+  });
+
+  it('sends nothing when the page holds no credential (Hermes embed proxy supplies it)', async () => {
+    const { dashboardFetch } = await freshCredential();
+
+    await dashboardFetch('/api/capabilities', { method: 'POST' });
+
+    expect(fetchMock).toHaveBeenLastCalledWith('/api/capabilities', { method: 'POST' });
+  });
+});
diff --git a/dashboard/src/data/auth/credential.ts b/dashboard/src/data/auth/credential.ts
new file mode 100644
index 0000000000..04f9f42756
--- /dev/null
+++ b/dashboard/src/data/auth/credential.ts
@@ -0,0 +1,91 @@
+/**
+ * The dashboard's access credential.
+ *
+ * Data shape: one 64-hex launch token per listener, delivered once in the URL
+ * fragment of the launch redirect (`/#token=…`). A fragment is never sent over
+ * the wire or in a `Referer`. The token then lives in this origin's
+ * `sessionStorage` (an origin includes its port, so concurrent dashboards
+ * never share it) and rides every same-origin request as
+ * `Authorization: Basic base64("tracedecay:<token>")`.
+ *
+ * It is deliberately never a cookie: browsers scope cookies by host, not port,
+ * so a cookie would be replayed to every other service on the same loopback
+ * host.
+ */
+
+const STORAGE_KEY = 'tracedecay.dashboard.access';
+const FRAGMENT_KEY = 'token';
+const BASIC_USER = 'tracedecay';
+const TOKEN_SHAPE = /^[0-9a-f]{64}$/;
+
+/** Fallback when the browser refuses `sessionStorage` (the token then lasts
+ * until the page reloads, and the person re-opens the launch URL). */
+let memoryToken: string | null = null;
+
+function pageStorage(): Storage | null {
+  try {
+    return globalThis.sessionStorage ?? null;
+  } catch {
+    return null;
+  }
+}
+
+/** Moves a launch token from the URL fragment into page storage and removes it
+ * from the address bar and history entry. Idempotent: a page with no token in
+ * its fragment is left alone. */
+export function adoptLaunchCredential(): void {
+  const location = globalThis.location;
+  if (location === undefined) return;
+  const fragment = new URLSearchParams(location.hash.replace(/^#/, ''));
+  const token = fragment.get(FRAGMENT_KEY);
+  if (token === null) return;
+  fragment.delete(FRAGMENT_KEY);
+  const rest = fragment.toString();
+  globalThis.history.replaceState(
+    globalThis.history.state,
+    '',
+    `${location.pathname}${location.search}${rest === '' ? '' : `#${rest}`}`,
+  );
+  if (!TOKEN_SHAPE.test(token)) return;
+  memoryToken = token;
+  try {
+    pageStorage()?.setItem(STORAGE_KEY, token);
+  } catch {
+    // Quota or policy refusal: the in-memory copy still serves this page.
+  }
+}
+
+function currentToken(): string | null {
+  if (memoryToken !== null) return memoryToken;
+  try {
+    const stored = pageStorage()?.getItem(STORAGE_KEY) ?? null;
+    return stored !== null && TOKEN_SHAPE.test(stored) ? stored : null;
+  } catch {
+    return null;
+  }
+}
+
+function isSameOrigin(url: string): boolean {
+  const location = globalThis.location;
+  if (location === undefined) return false;
+  try {
+    return new URL(url, location.href).origin === location.origin;
+  } catch {
+    return false;
+  }
+}
+
+/** `fetch` that authenticates same-origin requests with the dashboard
+ * credential. Cross-origin requests and pages without a credential (the
+ * Hermes embed, whose proxy supplies it) go out untouched. */
+export function dashboardFetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
+  const token = currentToken();
+  const url = input instanceof Request ? input.url : String(input);
+  if (token === null || !isSameOrigin(url)) return fetch(input, init);
+  const headers = new Headers(input instanceof Request ? input.headers : undefined);
+  new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+  if (!headers.has('authorization')) {
+    headers.set('authorization', `Basic ${btoa(`${BASIC_USER}:${token}`)}`);
+  }
+  return fetch(input, { ...init, headers });
+}
diff --git a/dashboard/src/data/auth/install.ts b/dashboard/src/data/auth/install.ts
new file mode 100644
index 0000000000..c0ff0d082d
--- /dev/null
+++ b/dashboard/src/data/auth/install.ts
@@ -0,0 +1,11 @@
+import { AuthenticatedEventSource } from './authenticatedEventSource.ts';
+import { adoptLaunchCredential } from './credential.ts';
+
+/** Page-start wiring: adopt the launch credential, then make every
+ * `new EventSource(url)` in the app an authenticated, fetch-based stream.
+ * Installing it on the global keeps the stream's consumers on the standard
+ * `EventSource` surface instead of threading a constructor through them. */
+export function installDashboardAuthentication(): void {
+  adoptLaunchCredential();
+  globalThis.EventSource = AuthenticatedEventSource as unknown as typeof EventSource;
+}
diff --git a/dashboard/src/data/query/automation.ts b/dashboard/src/data/query/automation.ts
index cf6601ae59..153a3b4892 100644
--- a/dashboard/src/data/query/automation.ts
+++ b/dashboard/src/data/query/automation.ts
@@ -15,6 +15,7 @@
  * a control state asserted rather than measured. A failed control leaves the
  * last real reading on screen and reports the failure beside it.
  */
+import { dashboardFetch } from '../auth/credential.ts';
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 
 import { fetchPayloadWrite, type PayloadResult, type PayloadWriteResult } from "./payload.ts";
@@ -309,7 +310,7 @@ export async function runAutomaticCurator(
 ): Promise<AutomaticCuratorResult> {
   let response: Response;
   try {
-    response = await fetch(url, {
+    response = await dashboardFetch(url, {
       method: "POST",
       headers: { accept: "application/json", "content-type": "application/json" },
       body: JSON.stringify(AUTOMATIC_CURATOR_REQUEST),
diff --git a/dashboard/src/data/query/projectRegistry.ts b/dashboard/src/data/query/projectRegistry.ts
index 52adb5abe0..1e012d5914 100644
--- a/dashboard/src/data/query/projectRegistry.ts
+++ b/dashboard/src/data/query/projectRegistry.ts
@@ -16,6 +16,7 @@
  * enumerate them, and a key added later is covered by construction rather than
  * by remembering to add it to the event handler.
  */
+import { dashboardFetch } from '../auth/credential.ts';
 import { useQuery } from '@tanstack/react-query';
 import {
   DashboardEnvelopeV1Schema,
@@ -75,7 +76,7 @@ export async function fetchProjectRegistry<T>(
 ): Promise<ProjectRegistryResult<T>> {
   let response: Response;
   try {
-    response = await fetch(url, { headers: { accept: 'application/json' }, ...init });
+    response = await dashboardFetch(url, { headers: { accept: 'application/json' }, ...init });
   } catch (err) {
     if (init?.signal?.aborted === true) throw err;
     return { outcome: 'transport', state: 'offline' };
diff --git a/dashboard/src/data/query/responseBody.ts b/dashboard/src/data/query/responseBody.ts
index c1ba7f5d1b..9149453c5f 100644
--- a/dashboard/src/data/query/responseBody.ts
+++ b/dashboard/src/data/query/responseBody.ts
@@ -1,3 +1,5 @@
+import { dashboardFetch } from '../auth/credential.ts';
+
 /** Distinguish invalid JSON from the valid JSON value `null`. */
 export const UNDECODABLE: unique symbol = Symbol('undecodable');
 
@@ -17,7 +19,7 @@ export async function fetchJsonResponse(
   if (!headers.has('accept')) headers.set('accept', 'application/json');
   let response: Response;
   try {
-    response = await fetch(url, { ...init, headers });
+    response = await dashboardFetch(url, { ...init, headers });
   } catch (err) {
     // Cancellation is not evidence that the daemon is offline.
     if (init?.signal?.aborted === true || isAbortError(err)) throw err;
diff --git a/dashboard/src/data/sse/connect.ts b/dashboard/src/data/sse/connect.ts
index 46d93fb24b..d2905c6abb 100644
--- a/dashboard/src/data/sse/connect.ts
+++ b/dashboard/src/data/sse/connect.ts
@@ -1,3 +1,4 @@
+import { dashboardFetch } from '../auth/credential.ts';
 import type { SseEventEnvelope } from './types.ts';
 import { createSseReducer, type SseReducer } from './reducer.ts';
 import { isRecord } from '../query/responseBody.ts';
@@ -151,7 +152,7 @@ export function connectEvents(url = '/api/events'): SseConnection {
 async function acknowledgeDelivery(url: string, receipt: string): Promise<void> {
   for (let attempt = 0; attempt < 3; attempt += 1) {
     try {
-      const response = await fetch(url, {
+      const response = await dashboardFetch(url, {
         method: 'POST',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify({ receipt }),
diff --git a/dashboard/src/workspaces/settings/settingsMutation.ts b/dashboard/src/workspaces/settings/settingsMutation.ts
index f546d53dac..e6b90c6a38 100644
--- a/dashboard/src/workspaces/settings/settingsMutation.ts
+++ b/dashboard/src/workspaces/settings/settingsMutation.ts
@@ -1,3 +1,4 @@
+import { dashboardFetch } from '../../data/auth/credential.ts';
 import { z } from 'zod';
 import type { SettingsPayloadV1 } from '../../contracts/generated.ts';
 import { readOnlyScopeRefusal, type ScopeWritability } from '../../data/scope/store.ts';
@@ -331,7 +332,7 @@ async function fetchJson(url: string, init?: RequestInit): Promise<JsonFetchResu
   const authority = `${init?.method ?? 'GET'} ${url}`;
   let response: Response;
   try {
-    response = await fetch(url, {
+    response = await dashboardFetch(url, {
       headers: { accept: 'application/json' },
       ...init,
     });
diff --git a/dashboard/src/workspaces/work/workApi.ts b/dashboard/src/workspaces/work/workApi.ts
index 9a631f822b..fcafde8573 100644
--- a/dashboard/src/workspaces/work/workApi.ts
+++ b/dashboard/src/workspaces/work/workApi.ts
@@ -1,3 +1,4 @@
+import { dashboardFetch } from '../../data/auth/credential.ts';
 import type { WireSchema } from '../../data/query/wireSchema.ts';
 import {
   ApplicationProblemEnvelopeSchema,
@@ -162,7 +163,7 @@ export async function callWork<Request, Response>(
 
   let response: Response_;
   try {
-    response = await fetch(url, {
+    response = await dashboardFetch(url, {
       method: 'POST',
       headers: { accept: 'application/json', 'content-type': 'application/json' },
       body: JSON.stringify(encoded.data),
diff --git a/docs/dashboard.md b/docs/dashboard.md
index 0de0dd1117..e32b1fd2f5 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -38,10 +38,16 @@ motion, bounded graph rendering, and a non-graph form for selected evidence.
 Loopback is reachable by every account on the machine, so each dashboard
 listener mints a random access token and prints a launch URL of the form
 `http://127.0.0.1:PORT/?token=…`. Opening it redirects to the tokenless path
-and sets an `HttpOnly`, `SameSite=Strict` session cookie. Scripts send the
-token as the Basic-auth password for user `tracedecay`. A request without the
-token gets `401 dashboard_request_unauthenticated`; a request whose `Host` or
-`Origin` does not name the bound listener gets `403`.
+with the token in the URL fragment, which browsers never send over the wire or
+in a `Referer`. The page keeps the token in origin-scoped `sessionStorage` and
+sends it as the Basic-auth password for user `tracedecay` on every API request
+and on the fetch-based event stream. Scripts send the same header. The
+dashboard never sets a cookie: browsers share cookies across every port of a
+host, so a cookie would reach any other service on loopback. The embedded page
+shell (`/`, `/static/**`, client routes) carries no secret and is served
+without the token. A request to `/api/**` without the token gets
+`401 dashboard_request_unauthenticated`; a request whose `Host` or `Origin`
+does not name the bound listener gets `403`.
 
 ## Code graph plugin API