diff --git a/lib/api.ts b/lib/api.ts
index 3f01bc3..ff429bd 100644
--- a/lib/api.ts
+++ b/lib/api.ts
@@ -157,24 +157,29 @@ export type LoginResult =
 // ─── API surface ────────────────────────────────────────────────────────────
 
 export const api = {
-  // Auth (shared endpoints)
+  // Auth (shared endpoints). The BFF returns the bare User on a completed
+  // login (200), or { otp_required: true } (202) when an emailed code is
+  // needed — there's no { kind } wrapper, so we derive it here.
   async login(email: string, password: string): Promise<LoginResult> {
-    const { data } = await call<LoginResult>("/auth/login", {
+    const { data } = await call<Me | { otp_required?: boolean }>("/auth/login", {
       method: "POST",
       body: JSON.stringify({ email, password }),
     });
-    return data;
+    if (data && (data as { otp_required?: boolean }).otp_required) {
+      return { kind: "otp_required" };
+    }
+    return { kind: "session", user: data as Me };
   },
   async verifyLoginOtp(
     email: string,
     password: string,
     otp: string,
   ): Promise<Me> {
-    const { data } = await call<{ user: Me }>("/auth/verify-login-otp", {
+    const { data } = await call<Me>("/auth/verify-login-otp", {
       method: "POST",
       body: JSON.stringify({ email, password, otp }),
     });
-    return data.user;
+    return data;
   },
   async me(): Promise<Me | null> {
     try {