diff --git a/Cargo.lock b/Cargo.lock
index c64d2f20..28d93b7c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2609,7 +2609,7 @@ checksum = "47e1ffaa40ddd1f3ed91f717a33c8c0ee23fff369e3aa8772b9605cc1d22f4c3"
 
 [[package]]
 name = "mcpmux"
-version = "0.0.12"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2646,7 +2646,7 @@ dependencies = [
 
 [[package]]
 name = "mcpmux-core"
-version = "0.0.12"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2669,7 +2669,7 @@ dependencies = [
 
 [[package]]
 name = "mcpmux-gateway"
-version = "0.0.12"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -2709,7 +2709,7 @@ dependencies = [
 
 [[package]]
 name = "mcpmux-mcp"
-version = "0.0.12"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -2728,7 +2728,7 @@ dependencies = [
 
 [[package]]
 name = "mcpmux-storage"
-version = "0.0.12"
+version = "0.1.0"
 dependencies = [
  "anyhow",
  "async-trait",
diff --git a/apps/desktop/src-tauri/src/commands/oauth.rs b/apps/desktop/src-tauri/src/commands/oauth.rs
index 258afdda..48bcb6e5 100644
--- a/apps/desktop/src-tauri/src/commands/oauth.rs
+++ b/apps/desktop/src-tauri/src/commands/oauth.rs
@@ -74,6 +74,10 @@ pub struct ConsentRequestDetails {
     pub state: Option<String>,
     /// When this request expires (Unix timestamp)
     pub expires_at: i64,
+    /// Cryptographic consent token (shared only via this IPC call, never over HTTP).
+    /// Must be returned in the approval request to prove the caller is the
+    /// legitimate desktop app UI—not an external script or bot.
+    pub consent_token: String,
 }
 
 /// Handle an incoming deep link URL
@@ -360,6 +364,16 @@ pub async fn get_pending_consent(
         return Err(ConsentError::expired(&request_id));
     }
 
+    // Extract consent_token (required for security—ensures only the desktop
+    // app that retrieved this token via IPC can approve the request)
+    let consent_token = auth.consent_token.clone().ok_or_else(|| {
+        error!("[OAuth] Pending authorization missing consent_token");
+        ConsentError {
+            code: "NOT_FOUND".to_string(),
+            message: "Authorization request is missing consent token — it may have been created before this security update. Please retry.".to_string(),
+        }
+    })?;
+
     // Build response with authoritative data from backend
     // The client_name here comes from our database lookup in handlers.rs
     let details = ConsentRequestDetails {
@@ -373,6 +387,7 @@ pub async fn get_pending_consent(
         scope: auth.scope.clone().unwrap_or_default(),
         state: auth.state.clone(),
         expires_at: auth.expires_at,
+        consent_token,
     };
 
     info!(
@@ -390,6 +405,9 @@ pub struct ConsentApprovalRequest {
     pub request_id: String,
     /// Whether the user approved the request
     pub approved: bool,
+    /// Cryptographic consent token (must match the one issued via get_pending_consent).
+    /// This proves the caller obtained the token through Tauri IPC, not HTTP scraping.
+    pub consent_token: String,
     /// Optional alias name for the client
     pub client_alias: Option<String>,
     /// Connection mode: "follow_active", "locked", or "ask_on_change"
@@ -453,6 +471,27 @@ pub async fn approve_oauth_consent(
         });
     };
 
+    // Validate consent_token: proves the caller obtained this token via Tauri
+    // IPC (get_pending_consent), not by scraping the HTTP authorization page.
+    match &pending.consent_token {
+        Some(expected_token) => {
+            if request.consent_token != *expected_token {
+                error!(
+                    "[OAuth] Consent token mismatch for request_id: {} — possible unauthorized approval attempt",
+                    request.request_id
+                );
+                return Err("Invalid consent token".to_string());
+            }
+        }
+        None => {
+            error!(
+                "[OAuth] Pending authorization missing consent_token for request_id: {}",
+                request.request_id
+            );
+            return Err("Consent token not available".to_string());
+        }
+    }
+
     // Remove the pending authorization (it's been processed)
     {
         let mut state = gw_state.write().await;
@@ -504,6 +543,7 @@ pub async fn approve_oauth_consent(
             code_challenge: pending.code_challenge.clone(),
             code_challenge_method: pending.code_challenge_method.clone(),
             expires_at: code_expires_at,
+            consent_token: None, // Auth code entries don't need consent tokens
         };
 
         state.store_pending_authorization(&code, new_pending);
@@ -656,13 +696,19 @@ pub async fn get_oauth_clients(
     Ok(client_infos)
 }
 
-/// Approve a registered OAuth client by ID (for E2E testing).
-/// In production, clients are approved via the consent flow.
+/// Approve a registered OAuth client by ID (for E2E testing only).
+///
+/// Guarded by the `MCPMUX_E2E_TEST` environment variable. In production
+/// builds this command is a no-op that returns an error.
 #[tauri::command]
 pub async fn approve_oauth_client(
     client_id: String,
     gateway_state: State<'_, Arc<RwLock<GatewayAppState>>>,
 ) -> Result<(), String> {
+    if std::env::var("MCPMUX_E2E_TEST").is_err() {
+        return Err("approve_oauth_client is only available in E2E test mode".to_string());
+    }
+
     let app_state = gateway_state.read().await;
     let Some(ref gw_state) = app_state.gateway_state else {
         return Err("Gateway not running".to_string());
@@ -674,7 +720,10 @@ pub async fn approve_oauth_client(
     repo.approve_client(&client_id)
         .await
         .map_err(|e| format!("Failed to approve client: {}", e))?;
-    info!("[OAuth] Approved client via test command: {}", client_id);
+    info!(
+        "[OAuth] Approved client via E2E test command: {}",
+        client_id
+    );
     Ok(())
 }
 
diff --git a/apps/desktop/src/components/OAuthConsentModal.tsx b/apps/desktop/src/components/OAuthConsentModal.tsx
index 9d1b7fa9..2dc26cc1 100644
--- a/apps/desktop/src/components/OAuthConsentModal.tsx
+++ b/apps/desktop/src/components/OAuthConsentModal.tsx
@@ -2,7 +2,7 @@
  * OAuth Consent Modal
  *
  * Displays when an MCP client requests authorization via deep link.
- * 
+ *
  * ## Flow
  * 1. Deep link received with request_id only
  * 2. Call get_pending_consent to validate and get full details from backend
@@ -14,14 +14,7 @@ import { useState, useEffect } from 'react';
 import { invoke } from '@tauri-apps/api/core';
 import { listen } from '@tauri-apps/api/event';
 import { Check, X, AlertCircle, Loader2, Globe, Lock } from 'lucide-react';
-import {
-  Button,
-  Card,
-  CardHeader,
-  CardTitle,
-  CardDescription,
-  CardContent,
-} from '@mcpmux/ui';
+import { Button, Card, CardHeader, CardTitle, CardDescription, CardContent } from '@mcpmux/ui';
 import { listSpaces, type Space } from '@/lib/api/spaces';
 import { resolveKnownClientKey } from '@/lib/clientIcons';
 import cursorIcon from '@/assets/client-icons/cursor.svg';
@@ -40,7 +33,7 @@ const CLIENT_ICON_ASSETS: Record<string, string> = {
 /** Look up a bundled logo for a known client by name */
 function getClientLogo(clientName: string): string | null {
   const key = resolveKnownClientKey(clientName);
-  return key ? CLIENT_ICON_ASSETS[key] ?? null : null;
+  return key ? (CLIENT_ICON_ASSETS[key] ?? null) : null;
 }
 
 /** Minimal deep link payload - only request_id */
@@ -57,6 +50,8 @@ interface ConsentRequestDetails {
   scope: string;
   state: string | null;
   expiresAt: number;
+  /** Cryptographic token shared only via Tauri IPC—must be sent back on approval */
+  consentToken: string;
 }
 
 /** Error from get_pending_consent */
@@ -73,7 +68,7 @@ interface ConsentApprovalResponse {
 }
 
 /** Current modal state */
-type ModalState = 
+type ModalState =
   | { type: 'hidden' }
   | { type: 'loading'; requestId: string }
   | { type: 'error'; requestId: string; error: ConsentError }
@@ -124,6 +119,8 @@ export function OAuthConsentModal() {
   const [spaces, setSpaces] = useState<Space[]>([]);
   const [isProcessing, setIsProcessing] = useState(false);
   const [processError, setProcessError] = useState<string | null>(null);
+  /** 2-second cooldown before the Approve button becomes active */
+  const [approveReady, setApproveReady] = useState(false);
 
   // Load spaces when modal opens
   useEffect(() => {
@@ -132,24 +129,35 @@ export function OAuthConsentModal() {
     }
   }, [modalState.type]);
 
+  // 2-second cooldown: prevents instant automated approval by requiring the
+  // consent modal to be visible for at least 2 seconds before Approve is active.
+  useEffect(() => {
+    if (modalState.type === 'consent') {
+      setApproveReady(false);
+      const timer = setTimeout(() => setApproveReady(true), 2000);
+      return () => clearTimeout(timer);
+    }
+    setApproveReady(false);
+  }, [modalState.type]);
+
   useEffect(() => {
     // Listen for OAuth consent requests from the backend (deep link)
     const unlisten = listen<OAuthDeepLinkPayload>('oauth-consent-request', async (event) => {
       console.log('[OAuth] Received deep link, validating request:', event.payload.requestId);
-      
+
       const requestId = event.payload.requestId;
       setModalState({ type: 'loading', requestId });
       setClientAlias('');
       setConnectionMode('follow_active');
       setLockedSpaceId(null);
       setProcessError(null);
-      
+
       try {
         // Validate and get full details from backend
         const details = await invoke<ConsentRequestDetails>('get_pending_consent', {
           requestId,
         });
-        
+
         console.log('[OAuth] Consent validated:', details);
         setModalState({ type: 'consent', details });
         setClientAlias(details.clientName);
@@ -162,7 +170,7 @@ export function OAuthConsentModal() {
     });
 
     return () => {
-      unlisten.then(fn => fn());
+      unlisten.then((fn) => fn());
     };
   }, []);
 
@@ -178,6 +186,7 @@ export function OAuthConsentModal() {
         request: {
           request_id: details.requestId,
           approved: true,
+          consent_token: details.consentToken,
           client_alias: clientAlias || null,
           connection_mode: connectionMode,
           locked_space_id: connectionMode === 'locked' ? lockedSpaceId : null,
@@ -211,6 +220,7 @@ export function OAuthConsentModal() {
         request: {
           request_id: details.requestId,
           approved: false,
+          consent_token: details.consentToken,
           client_alias: null,
         },
       });
@@ -241,10 +251,10 @@ export function OAuthConsentModal() {
   // Loading state - show spinner
   if (modalState.type === 'loading') {
     return (
-      <div className="fixed inset-0 bg-black/50 backdrop-blur-sm flex items-center justify-center z-50">
-        <Card className="w-full max-w-md mx-4 shadow-xl animate-in fade-in zoom-in duration-200">
-          <CardContent className="py-8 flex flex-col items-center gap-4">
-            <Loader2 className="h-8 w-8 animate-spin text-primary-500" />
+      <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 backdrop-blur-sm">
+        <Card className="animate-in fade-in zoom-in mx-4 w-full max-w-md shadow-xl duration-200">
+          <CardContent className="flex flex-col items-center gap-4 py-8">
+            <Loader2 className="text-primary-500 h-8 w-8 animate-spin" />
             <p className="text-[rgb(var(--muted))]">Validating authorization request...</p>
           </CardContent>
         </Card>
@@ -255,25 +265,21 @@ export function OAuthConsentModal() {
   // Error state - show error with dismiss button
   if (modalState.type === 'error') {
     return (
-      <div className="fixed inset-0 bg-black/50 backdrop-blur-sm flex items-center justify-center z-50">
-        <Card className="w-full max-w-md mx-4 shadow-xl animate-in fade-in zoom-in duration-200">
+      <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 backdrop-blur-sm">
+        <Card className="animate-in fade-in zoom-in mx-4 w-full max-w-md shadow-xl duration-200">
           <CardHeader>
             <div className="flex items-center gap-3">
-              <div className="p-2 rounded-full bg-red-500/10">
+              <div className="rounded-full bg-red-500/10 p-2">
                 <AlertCircle className="h-6 w-6 text-red-500" />
               </div>
               <div>
                 <CardTitle>Authorization Failed</CardTitle>
-                <CardDescription>
-                  Could not process the authorization request
-                </CardDescription>
+                <CardDescription>Could not process the authorization request</CardDescription>
               </div>
             </div>
           </CardHeader>
           <CardContent className="space-y-4">
-            <p className="text-sm text-[rgb(var(--muted))]">
-              {getErrorMessage(modalState.error)}
-            </p>
+            <p className="text-sm text-[rgb(var(--muted))]">{getErrorMessage(modalState.error)}</p>
             <Button onClick={handleDismiss} className="w-full">
               Close
             </Button>
@@ -289,36 +295,26 @@ export function OAuthConsentModal() {
   const logoUrl = getClientLogo(details.clientName);
 
   return (
-    <div className="fixed inset-0 bg-black/50 backdrop-blur-sm flex items-center justify-center z-50">
-      <Card className="w-full max-w-md mx-4 shadow-xl animate-in fade-in zoom-in duration-200">
+    <div className="fixed inset-0 z-50 flex items-center justify-center bg-black/50 backdrop-blur-sm">
+      <Card className="animate-in fade-in zoom-in mx-4 w-full max-w-md shadow-xl duration-200">
         <CardHeader>
           <div className="flex items-center gap-3">
-            <img
-              src="/mcpmux.svg"
-              alt="McpMux"
-              className="h-10 w-10 rounded-lg"
-            />
+            <img src="/mcpmux.svg" alt="McpMux" className="h-10 w-10 rounded-lg" />
             <div>
               <CardTitle>Authorization Request</CardTitle>
-              <CardDescription>
-                {details.clientName} wants to connect
-              </CardDescription>
+              <CardDescription>{details.clientName} wants to connect</CardDescription>
             </div>
           </div>
         </CardHeader>
         <CardContent className="space-y-4">
           {/* Client Info */}
-          <div className="flex items-center gap-3 p-4 rounded-lg bg-surface-hover border border-[rgb(var(--border))]">
+          <div className="bg-surface-hover flex items-center gap-3 rounded-lg border border-[rgb(var(--border))] p-4">
             {logoUrl && (
-              <img
-                src={logoUrl}
-                alt={details.clientName}
-                className="h-8 w-8 rounded-lg"
-              />
+              <img src={logoUrl} alt={details.clientName} className="h-8 w-8 rounded-lg" />
             )}
             <div>
-              <div className="font-medium text-lg">{details.clientName}</div>
-              <div className="text-sm text-[rgb(var(--muted))] mt-0.5 break-all">
+              <div className="text-lg font-medium">{details.clientName}</div>
+              <div className="mt-0.5 break-all text-sm text-[rgb(var(--muted))]">
                 {details.clientId.length > 50
                   ? `${details.clientId.substring(0, 50)}...`
                   : details.clientId}
@@ -328,12 +324,12 @@ export function OAuthConsentModal() {
 
           {/* Scopes */}
           <div>
-            <div className="text-sm font-medium mb-2">Requested permissions:</div>
+            <div className="mb-2 text-sm font-medium">Requested permissions:</div>
             <div className="flex flex-wrap gap-2">
               {scopes.map((scope, i) => (
                 <span
                   key={i}
-                  className="px-2 py-1 text-xs rounded-full bg-primary-500/10 text-primary-500 border border-primary-500/20"
+                  className="bg-primary-500/10 text-primary-500 border-primary-500/20 rounded-full border px-2 py-1 text-xs"
                 >
                   {scope}
                 </span>
@@ -343,30 +339,26 @@ export function OAuthConsentModal() {
 
           {/* Alias Input */}
           <div>
-            <label className="text-sm font-medium">
-              Display name (optional)
-            </label>
+            <label className="text-sm font-medium">Display name (optional)</label>
             <input
               type="text"
               value={clientAlias}
               onChange={(e) => setClientAlias(e.target.value)}
               placeholder="e.g., Work Cursor, Personal Claude"
-              className="mt-1 w-full px-3 py-2 rounded-lg border border-[rgb(var(--border))] bg-[rgb(var(--surface))] text-[rgb(var(--foreground))] placeholder:text-[rgb(var(--muted))] focus:outline-none focus:ring-2 focus:ring-primary-500/20"
+              className="focus:ring-primary-500/20 mt-1 w-full rounded-lg border border-[rgb(var(--border))] bg-[rgb(var(--surface))] px-3 py-2 text-[rgb(var(--foreground))] placeholder:text-[rgb(var(--muted))] focus:outline-none focus:ring-2"
             />
-            <p className="text-xs text-[rgb(var(--muted))] mt-1">
+            <p className="mt-1 text-xs text-[rgb(var(--muted))]">
               Give this client a friendly name to identify it later
             </p>
           </div>
 
           {/* Space Mode Selection */}
           <div>
-            <label className="text-sm font-medium mb-2 block">
-              Space connection mode
-            </label>
+            <label className="mb-2 block text-sm font-medium">Space connection mode</label>
             <div className="space-y-2">
               {/* Follow Active Option */}
               <label
-                className={`flex items-center gap-3 p-3 rounded-lg border cursor-pointer transition-colors ${
+                className={`flex cursor-pointer items-center gap-3 rounded-lg border p-3 transition-colors ${
                   connectionMode === 'follow_active'
                     ? 'border-primary-500 bg-primary-500/5'
                     : 'border-[rgb(var(--border))] hover:border-[rgb(var(--border-hover))]'
@@ -380,9 +372,13 @@ export function OAuthConsentModal() {
                   onChange={() => setConnectionMode('follow_active')}
                   className="sr-only"
                 />
-                <Globe className={`h-5 w-5 ${connectionMode === 'follow_active' ? 'text-primary-500' : 'text-[rgb(var(--muted))]'}`} />
+                <Globe
+                  className={`h-5 w-5 ${connectionMode === 'follow_active' ? 'text-primary-500' : 'text-[rgb(var(--muted))]'}`}
+                />
                 <div className="flex-1">
-                  <div className={`font-medium text-sm ${connectionMode === 'follow_active' ? 'text-primary-500' : ''}`}>
+                  <div
+                    className={`text-sm font-medium ${connectionMode === 'follow_active' ? 'text-primary-500' : ''}`}
+                  >
                     Follow Active Space
                   </div>
                   <div className="text-xs text-[rgb(var(--muted))]">
@@ -390,13 +386,13 @@ export function OAuthConsentModal() {
                   </div>
                 </div>
                 {connectionMode === 'follow_active' && (
-                  <Check className="h-4 w-4 text-primary-500" />
+                  <Check className="text-primary-500 h-4 w-4" />
                 )}
               </label>
 
               {/* Lock to Space Option */}
               <label
-                className={`flex items-center gap-3 p-3 rounded-lg border cursor-pointer transition-colors ${
+                className={`flex cursor-pointer items-center gap-3 rounded-lg border p-3 transition-colors ${
                   connectionMode === 'locked'
                     ? 'border-primary-500 bg-primary-500/5'
                     : 'border-[rgb(var(--border))] hover:border-[rgb(var(--border-hover))]'
@@ -410,18 +406,20 @@ export function OAuthConsentModal() {
                   onChange={() => setConnectionMode('locked')}
                   className="sr-only"
                 />
-                <Lock className={`h-5 w-5 ${connectionMode === 'locked' ? 'text-primary-500' : 'text-[rgb(var(--muted))]'}`} />
+                <Lock
+                  className={`h-5 w-5 ${connectionMode === 'locked' ? 'text-primary-500' : 'text-[rgb(var(--muted))]'}`}
+                />
                 <div className="flex-1">
-                  <div className={`font-medium text-sm ${connectionMode === 'locked' ? 'text-primary-500' : ''}`}>
+                  <div
+                    className={`text-sm font-medium ${connectionMode === 'locked' ? 'text-primary-500' : ''}`}
+                  >
                     Lock to Space
                   </div>
                   <div className="text-xs text-[rgb(var(--muted))]">
                     Client always sees servers from a specific space
                   </div>
                 </div>
-                {connectionMode === 'locked' && (
-                  <Check className="h-4 w-4 text-primary-500" />
-                )}
+                {connectionMode === 'locked' && <Check className="text-primary-500 h-4 w-4" />}
               </label>
             </div>
 
@@ -431,7 +429,7 @@ export function OAuthConsentModal() {
                 <select
                   value={lockedSpaceId || ''}
                   onChange={(e) => setLockedSpaceId(e.target.value || null)}
-                  className="w-full px-3 py-2 rounded-lg border border-[rgb(var(--border))] bg-[rgb(var(--surface))] text-[rgb(var(--foreground))] focus:outline-none focus:ring-2 focus:ring-primary-500/20"
+                  className="focus:ring-primary-500/20 w-full rounded-lg border border-[rgb(var(--border))] bg-[rgb(var(--surface))] px-3 py-2 text-[rgb(var(--foreground))] focus:outline-none focus:ring-2"
                 >
                   <option value="">Select a space to lock to...</option>
                   {spaces.map((space) => (
@@ -446,7 +444,7 @@ export function OAuthConsentModal() {
 
           {/* Error Message */}
           {processError && (
-            <div className="flex items-center gap-2 p-3 rounded-lg bg-red-500/10 text-red-500 text-sm">
+            <div className="flex items-center gap-2 rounded-lg bg-red-500/10 p-3 text-sm text-red-500">
               <AlertCircle className="h-4 w-4 flex-shrink-0" />
               <span>{processError}</span>
             </div>
@@ -460,21 +458,21 @@ export function OAuthConsentModal() {
               onClick={handleDeny}
               disabled={isProcessing}
             >
-              <X className="h-4 w-4 mr-2" />
+              <X className="mr-2 h-4 w-4" />
               Deny
             </Button>
             <Button
               variant="primary"
               className="flex-1"
               onClick={handleApprove}
-              disabled={isProcessing}
+              disabled={isProcessing || !approveReady}
             >
               {isProcessing ? (
-                <div className="h-4 w-4 mr-2 animate-spin rounded-full border-2 border-current border-t-transparent" />
+                <div className="mr-2 h-4 w-4 animate-spin rounded-full border-2 border-current border-t-transparent" />
               ) : (
-                <Check className="h-4 w-4 mr-2" />
+                <Check className="mr-2 h-4 w-4" />
               )}
-              Approve
+              {approveReady ? 'Approve' : 'Approve (wait...)'}
             </Button>
           </div>
 
@@ -482,7 +480,7 @@ export function OAuthConsentModal() {
           <div className="text-center">
             <button
               onClick={handleDismiss}
-              className="text-xs text-[rgb(var(--muted))] hover:text-[rgb(var(--foreground))] transition-colors"
+              className="text-xs text-[rgb(var(--muted))] transition-colors hover:text-[rgb(var(--foreground))]"
             >
               Dismiss (client will wait)
             </button>
diff --git a/crates/mcpmux-gateway/src/server/handlers.rs b/crates/mcpmux-gateway/src/server/handlers.rs
index 6e6a3b68..3e4129a4 100644
--- a/crates/mcpmux-gateway/src/server/handlers.rs
+++ b/crates/mcpmux-gateway/src/server/handlers.rs
@@ -136,6 +136,11 @@ pub struct PendingAuthorization {
     pub code_challenge_method: Option<String>,
     /// Unix timestamp when this request expires
     pub expires_at: i64,
+    /// Consent token: cryptographic secret shared only via Tauri IPC.
+    /// Prevents any process from approving consent via HTTP without going
+    /// through the desktop app UI. Only present on initial consent requests
+    /// (not on auth-code entries used for token exchange).
+    pub consent_token: Option<String>,
 }
 
 /// OAuth authorization endpoint
@@ -272,6 +277,18 @@ pub async fn oauth_authorize(
         .map(|d| d.as_secs() as i64 + 300) // 5 minutes
         .unwrap_or(i64::MAX);
 
+    // Generate consent_token: a cryptographic secret shared only via Tauri IPC.
+    // This prevents any external process from approving consent by calling an
+    // HTTP endpoint directly—only the desktop app UI that retrieves this token
+    // via get_pending_consent can submit a valid approval.
+    let consent_token = {
+        use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine};
+        let mut bytes = [0u8; 32];
+        use rand::RngCore;
+        rand::thread_rng().fill_bytes(&mut bytes);
+        URL_SAFE_NO_PAD.encode(bytes)
+    };
+
     {
         let mut gateway_state = state.write().await;
         gateway_state.store_pending_authorization(
@@ -285,6 +302,7 @@ pub async fn oauth_authorize(
                 code_challenge: params.code_challenge.clone(),
                 code_challenge_method: params.code_challenge_method.clone(),
                 expires_at,
+                consent_token: Some(consent_token),
             },
         );
     }
@@ -850,6 +868,7 @@ pub async fn oauth_consent_approve(
                 code_challenge: pending.code_challenge.clone(),
                 code_challenge_method: pending.code_challenge_method.clone(),
                 expires_at: code_expires_at,
+                consent_token: None, // Auth code entries don't need consent tokens
             },
         );
 
diff --git a/crates/mcpmux-gateway/src/server/mod.rs b/crates/mcpmux-gateway/src/server/mod.rs
index f9c056cc..c2cef882 100644
--- a/crates/mcpmux-gateway/src/server/mod.rs
+++ b/crates/mcpmux-gateway/src/server/mod.rs
@@ -7,6 +7,7 @@
 mod dependencies;
 mod handlers;
 pub mod logging_middleware;
+pub mod rate_limit;
 mod service_container;
 mod startup;
 mod state;
@@ -301,10 +302,10 @@ impl GatewayServer {
             // Fallback for clients that don't fetch metadata (VS Code default behavior)
             .route("/authorize", get(handlers::oauth_authorize))
             .route("/oauth/token", post(handlers::oauth_token))
-            .route(
-                "/oauth/consent/approve",
-                post(handlers::oauth_consent_approve),
-            )
+            // NOTE: /oauth/consent/approve was removed for security.
+            // Consent approval now happens exclusively via Tauri IPC command
+            // (approve_oauth_consent), which can only be invoked by the desktop
+            // app's own WebView—not by external HTTP clients, scripts, or bots.
             // Client registration (DCR - public)
             .route("/oauth/register", post(handlers::oauth_register))
             // Client management (for desktop app)
@@ -317,7 +318,22 @@ impl GatewayServer {
             .route(
                 "/oauth/clients/{client_id}",
                 delete(handlers::oauth_delete_client),
-            )
+            );
+
+        // E2E test mode: re-enable HTTP consent endpoint (guarded by env var).
+        // In production this endpoint does NOT exist—consent is Tauri-IPC-only.
+        if std::env::var("MCPMUX_E2E_TEST").is_ok() {
+            warn!("[Gateway] E2E test mode: /oauth/consent/approve HTTP endpoint enabled");
+            router = router.route(
+                "/oauth/consent/approve",
+                post(handlers::oauth_consent_approve),
+            );
+        }
+
+        // Rate limiter for OAuth endpoints (prevents abuse / consent flooding)
+        let rate_limiter = rate_limit::default_oauth_rate_limiter();
+
+        let mut router = router
             // Protected MCP routes (using rmcp's StreamableHttpService)
             .merge(mcp_routes)
             // Client features (needs services)
@@ -328,7 +344,10 @@ impl GatewayServer {
             // Request/Response logging with body (DEBUG level)
             .layer(middleware::from_fn(
                 logging_middleware::http_logging_middleware,
-            ));
+            ))
+            // Rate limiting on OAuth endpoints
+            .layer(axum::Extension(rate_limiter))
+            .layer(middleware::from_fn(rate_limit::rate_limit_middleware));
 
         // Add CORS if enabled
         if self.config.enable_cors {
diff --git a/crates/mcpmux-gateway/src/server/rate_limit.rs b/crates/mcpmux-gateway/src/server/rate_limit.rs
new file mode 100644
index 00000000..fdbe92c1
--- /dev/null
+++ b/crates/mcpmux-gateway/src/server/rate_limit.rs
@@ -0,0 +1,130 @@
+//! Simple per-path rate limiting middleware for the gateway.
+//!
+//! Uses a DashMap to track request counts per (path, window) pair.
+//! Designed for a localhost-only gateway where IP-based limiting is
+//! irrelevant (all clients share 127.0.0.1).
+
+use axum::{
+    extract::Request,
+    http::StatusCode,
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use dashmap::DashMap;
+use std::sync::Arc;
+use std::time::{Duration, Instant};
+
+/// Configuration for a rate-limited route.
+#[derive(Clone)]
+pub struct RateLimitConfig {
+    /// Maximum requests allowed within the window.
+    pub max_requests: u32,
+    /// Time window duration.
+    pub window: Duration,
+}
+
+/// Shared rate limiter state (clone-friendly via Arc).
+#[derive(Clone)]
+pub struct RateLimiter {
+    /// Map from path prefix → (window_start, request_count).
+    buckets: Arc<DashMap<String, (Instant, u32)>>,
+    /// Configuration per route prefix.
+    rules: Arc<Vec<(String, RateLimitConfig)>>,
+}
+
+impl RateLimiter {
+    pub fn new(rules: Vec<(String, RateLimitConfig)>) -> Self {
+        Self {
+            buckets: Arc::new(DashMap::new()),
+            rules: Arc::new(rules),
+        }
+    }
+
+    /// Check if the request should be rate limited.
+    /// Returns `true` if the request is within limits (allowed).
+    fn check(&self, path: &str) -> bool {
+        for (prefix, config) in self.rules.iter() {
+            if path.starts_with(prefix) {
+                let mut entry = self
+                    .buckets
+                    .entry(prefix.clone())
+                    .or_insert_with(|| (Instant::now(), 0));
+                let (window_start, count) = entry.value_mut();
+
+                if window_start.elapsed() >= config.window {
+                    // Reset window
+                    *window_start = Instant::now();
+                    *count = 1;
+                    return true;
+                }
+
+                if *count >= config.max_requests {
+                    return false; // Rate limited
+                }
+
+                *count += 1;
+                return true;
+            }
+        }
+        true // No matching rule, allow
+    }
+}
+
+/// Axum middleware function for rate limiting.
+pub async fn rate_limit_middleware(request: Request, next: Next) -> Response {
+    let limiter = request.extensions().get::<RateLimiter>().cloned();
+
+    if let Some(limiter) = limiter {
+        let path = request.uri().path().to_string();
+        if !limiter.check(&path) {
+            return (
+                StatusCode::TOO_MANY_REQUESTS,
+                "Rate limit exceeded. Please try again later.",
+            )
+                .into_response();
+        }
+    }
+
+    next.run(request).await
+}
+
+/// Create the default rate limiter for OAuth endpoints.
+pub fn default_oauth_rate_limiter() -> RateLimiter {
+    RateLimiter::new(vec![
+        (
+            "/oauth/authorize".to_string(),
+            RateLimitConfig {
+                max_requests: 30,
+                window: Duration::from_secs(60),
+            },
+        ),
+        (
+            "/authorize".to_string(),
+            RateLimitConfig {
+                max_requests: 30,
+                window: Duration::from_secs(60),
+            },
+        ),
+        (
+            "/oauth/token".to_string(),
+            RateLimitConfig {
+                max_requests: 60,
+                window: Duration::from_secs(60),
+            },
+        ),
+        (
+            "/oauth/register".to_string(),
+            RateLimitConfig {
+                max_requests: 20,
+                window: Duration::from_secs(60),
+            },
+        ),
+        (
+            "/oauth/clients".to_string(),
+            RateLimitConfig {
+                max_requests: 30,
+                window: Duration::from_secs(60),
+            },
+        ),
+    ])
+}
diff --git a/tests/e2e/helpers/mcp-client.ts b/tests/e2e/helpers/mcp-client.ts
index 30034b0a..a3204300 100644
--- a/tests/e2e/helpers/mcp-client.ts
+++ b/tests/e2e/helpers/mcp-client.ts
@@ -6,6 +6,10 @@
  *
  * This enables tests to connect an MCP client to the gateway
  * without going through the browser-based consent flow.
+ *
+ * IMPORTANT: The `/oauth/consent/approve` HTTP endpoint is only available
+ * when `MCPMUX_E2E_TEST=1` environment variable is set. In production,
+ * consent approval is restricted to Tauri IPC (desktop app UI) only.
  */
 
 import crypto from 'node:crypto';
@@ -31,7 +35,7 @@ function generatePkce(): { codeVerifier: string; codeChallenge: string } {
 export async function registerOAuthClient(
   clientName: string,
   redirectUri: string = 'http://localhost:0/callback',
-  port?: number,
+  port?: number
 ): Promise<string> {
   const res = await fetch(gatewayUrl('/oauth/register', port), {
     method: 'POST',
@@ -70,7 +74,7 @@ export async function registerOAuthClient(
 export async function obtainAccessToken(
   clientId: string,
   redirectUri: string = 'http://localhost:0/callback',
-  port?: number,
+  port?: number
 ): Promise<string> {
   const { codeVerifier, codeChallenge } = generatePkce();
   const state = crypto.randomUUID();
@@ -93,7 +97,9 @@ export async function obtainAccessToken(
   // Format: mcpmux://authorize?request_id=<id>
   const requestIdMatch = html.match(/request_id=([^"&\s]+)/);
   if (!requestIdMatch) {
-    throw new Error(`Could not extract request_id from authorize response. HTML: ${html.substring(0, 500)}`);
+    throw new Error(
+      `Could not extract request_id from authorize response. HTML: ${html.substring(0, 500)}`
+    );
   }
   const requestId = decodeURIComponent(requestIdMatch[1]);
 
diff --git a/tests/e2e/wdio.conf.ts b/tests/e2e/wdio.conf.ts
index 9ba0edcb..f1914b9a 100644
--- a/tests/e2e/wdio.conf.ts
+++ b/tests/e2e/wdio.conf.ts
@@ -80,7 +80,6 @@ function checkTauriDriver(): boolean {
   }
 }
 
-
 // Clear the app's SQLite database and related files for a clean start
 function clearAppData(): void {
   const filesToDelete = [
@@ -125,7 +124,7 @@ function clearBundleCache(): void {
 async function waitForServer(port: number, name: string, timeout = 30000): Promise<void> {
   const start = Date.now();
   const healthUrl = `http://localhost:${port}/health`;
-  
+
   while (Date.now() - start < timeout) {
     try {
       const response = await fetch(healthUrl);
@@ -138,44 +137,68 @@ async function waitForServer(port: number, name: string, timeout = 30000): Promi
     }
     await new Promise((resolve) => setTimeout(resolve, 200));
   }
-  
+
   throw new Error(`[e2e] ${name} failed to start within ${timeout}ms`);
 }
 
 // Start mock servers
 async function startMockServers(): Promise<void> {
   const mocksDir = path.resolve('./tests/e2e/mocks');
-  
+
   // Start Mock Bundle API
   console.log('[e2e] Starting Mock Bundle API...');
-  mockBundleApi = spawn('pnpm', ['exec', 'tsx', path.join(mocksDir, 'mock-bundle-api', 'server.ts')], {
-    env: { ...process.env, PORT: String(MOCK_BUNDLE_API_PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-    shell: true,
-  });
-  mockBundleApi.stdout?.on('data', (data) => console.log(`[mock-bundle-api] ${data.toString().trim()}`));
-  mockBundleApi.stderr?.on('data', (data) => console.error(`[mock-bundle-api] ${data.toString().trim()}`));
-  
+  mockBundleApi = spawn(
+    'pnpm',
+    ['exec', 'tsx', path.join(mocksDir, 'mock-bundle-api', 'server.ts')],
+    {
+      env: { ...process.env, PORT: String(MOCK_BUNDLE_API_PORT) },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: true,
+    }
+  );
+  mockBundleApi.stdout?.on('data', (data) =>
+    console.log(`[mock-bundle-api] ${data.toString().trim()}`)
+  );
+  mockBundleApi.stderr?.on('data', (data) =>
+    console.error(`[mock-bundle-api] ${data.toString().trim()}`)
+  );
+
   // Start Stub MCP HTTP Server
   console.log('[e2e] Starting Stub MCP HTTP Server...');
-  stubMcpHttp = spawn('pnpm', ['exec', 'tsx', path.join(mocksDir, 'stub-mcp-server', 'http-server.ts')], {
-    env: { ...process.env, PORT: String(STUB_MCP_HTTP_PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-    shell: true,
-  });
-  stubMcpHttp.stdout?.on('data', (data) => console.log(`[stub-mcp-http] ${data.toString().trim()}`));
-  stubMcpHttp.stderr?.on('data', (data) => console.error(`[stub-mcp-http] ${data.toString().trim()}`));
-  
+  stubMcpHttp = spawn(
+    'pnpm',
+    ['exec', 'tsx', path.join(mocksDir, 'stub-mcp-server', 'http-server.ts')],
+    {
+      env: { ...process.env, PORT: String(STUB_MCP_HTTP_PORT) },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: true,
+    }
+  );
+  stubMcpHttp.stdout?.on('data', (data) =>
+    console.log(`[stub-mcp-http] ${data.toString().trim()}`)
+  );
+  stubMcpHttp.stderr?.on('data', (data) =>
+    console.error(`[stub-mcp-http] ${data.toString().trim()}`)
+  );
+
   // Start Stub MCP OAuth Server
   console.log('[e2e] Starting Stub MCP OAuth Server...');
-  stubMcpOauth = spawn('pnpm', ['exec', 'tsx', path.join(mocksDir, 'stub-mcp-server', 'http-oauth-server.ts')], {
-    env: { ...process.env, PORT: String(STUB_MCP_OAUTH_PORT) },
-    stdio: ['ignore', 'pipe', 'pipe'],
-    shell: true,
-  });
-  stubMcpOauth.stdout?.on('data', (data) => console.log(`[stub-mcp-oauth] ${data.toString().trim()}`));
-  stubMcpOauth.stderr?.on('data', (data) => console.error(`[stub-mcp-oauth] ${data.toString().trim()}`));
-  
+  stubMcpOauth = spawn(
+    'pnpm',
+    ['exec', 'tsx', path.join(mocksDir, 'stub-mcp-server', 'http-oauth-server.ts')],
+    {
+      env: { ...process.env, PORT: String(STUB_MCP_OAUTH_PORT) },
+      stdio: ['ignore', 'pipe', 'pipe'],
+      shell: true,
+    }
+  );
+  stubMcpOauth.stdout?.on('data', (data) =>
+    console.log(`[stub-mcp-oauth] ${data.toString().trim()}`)
+  );
+  stubMcpOauth.stderr?.on('data', (data) =>
+    console.error(`[stub-mcp-oauth] ${data.toString().trim()}`)
+  );
+
   // Wait for all servers to be ready
   await Promise.all([
     waitForServer(MOCK_BUNDLE_API_PORT, 'Mock Bundle API'),
@@ -239,7 +262,14 @@ function killPortProcesses(): void {
     try {
       if (process.platform === 'win32') {
         // Find PIDs listening on this port and kill them
-        const result = spawnSync('cmd', ['/c', `for /f "tokens=5" %a in ('netstat -ano ^| findstr ":${port} " ^| findstr LISTEN') do taskkill /F /PID %a`], { stdio: 'pipe', shell: true });
+        const result = spawnSync(
+          'cmd',
+          [
+            '/c',
+            `for /f "tokens=5" %a in ('netstat -ano ^| findstr ":${port} " ^| findstr LISTEN') do taskkill /F /PID %a`,
+          ],
+          { stdio: 'pipe', shell: true }
+        );
         if (result.stdout?.toString().includes('SUCCESS')) {
           console.log(`[e2e] Killed process on port ${port}`);
         }
@@ -338,22 +368,30 @@ export const config: Options.Testrunner = {
   framework: 'mocha',
   reporters: [
     'spec',
-    ['junit', {
-      outputDir: './tests/e2e/reports/',
-      outputFileFormat: function(options) {
-        return `wdio-junit-${options.cid}.xml`;
+    [
+      'junit',
+      {
+        outputDir: './tests/e2e/reports/',
+        outputFileFormat: function (options) {
+          return `wdio-junit-${options.cid}.xml`;
+        },
       },
-    }],
+    ],
     // Only enable video reporter when explicitly requested via SAVE_ALL_VIDEOS=true.
     // The video reporter takes a screenshot after every WebDriver command, including
     // during session teardown. This races with deleteSession killing the Tauri app,
     // causing UND_ERR_SOCKET errors that mark passing specs as FAILED.
     ...(process.env.SAVE_ALL_VIDEOS === 'true'
-      ? [[video, {
-          saveAllVideos: true,
-          videoSlowdownMultiplier: 1,
-          outputDir: './tests/e2e/videos/',
-        }]]
+      ? [
+          [
+            video,
+            {
+              saveAllVideos: true,
+              videoSlowdownMultiplier: 1,
+              outputDir: './tests/e2e/videos/',
+            },
+          ],
+        ]
       : []),
   ],
 
@@ -363,7 +401,7 @@ export const config: Options.Testrunner = {
   },
 
   // Take screenshot on test failure
-  afterTest: async function(test, context, { error }) {
+  afterTest: async function (test, context, { error }) {
     if (error) {
       const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
       // Sanitize test title: replace invalid filename chars (NTFS: " : < > | * ? \r \n) and spaces
@@ -458,12 +496,16 @@ export const config: Options.Testrunner = {
       process.platform === 'win32' ? 'tauri-driver.exe' : 'tauri-driver'
     );
 
-    // Pass registry URL environment variable to tauri-driver (which passes to the app)
+    // Pass environment variables to tauri-driver (which passes to the app)
+    // MCPMUX_E2E_TEST=1 enables test-only endpoints:
+    //   - POST /oauth/consent/approve (HTTP consent for programmatic OAuth flow)
+    //   - approve_oauth_client Tauri IPC command
     tauriDriver = spawn(tauriDriverPath, [], {
       stdio: [null, process.stdout, process.stderr],
       env: {
         ...process.env,
         MCPMUX_REGISTRY_URL: `http://localhost:${MOCK_BUNDLE_API_PORT}`,
+        MCPMUX_E2E_TEST: '1',
       },
     });