@@ -1,4 +1,6 @@
 import { AxiosInstance } from "axios";
+
+import { removeAccessToken } from "../utils/auth-utils.js";
 import {
   AuthModuleOptions,
   InternalAuthModule,
@@ -77,6 +79,12 @@ function loginViaPopup(
   window.addEventListener("message", onMessage);
 }
 
+// "token" is the key the platform-v2 built-in SDK wrote.
+function removeStoredAccessTokens() {
+  removeAccessToken({});
+  removeAccessToken({ storageKey: "token" });
+}
+
 /**
  * Creates the auth module for the Base44 SDK.
  *
@@ -155,7 +163,9 @@ export function createAuthModule(
       // Build the login URL
       const loginUrl = `${options.appBaseUrl}/login?from_url=${encodeURIComponent(redirectUrl)}`;
 
-      // Redirect to the login page
+      // The login page must not boot with the token that just got us here,
+      // or a rejected token redirects to /login forever.
+      removeStoredAccessTokens();
       window.location.href = loginUrl;
     },
 
@@ -202,16 +212,7 @@ export function createAuthModule(
 
       // Only do the rest if in a browser environment
       if (typeof window !== "undefined") {
-        // Remove token from localStorage
-        if (window.localStorage) {
-          try {
-            window.localStorage.removeItem("base44_access_token");
-            // Remove "token" that is set by the built-in SDK of platform version 2
-            window.localStorage.removeItem("token");
-          } catch (e) {
-            console.error("Failed to remove token from localStorage:", e);
-          }
-        }
+        removeStoredAccessTokens();
 
         // Determine the from_url parameter
         const fromUrl = redirectUrl || window.location.href;
 
@@ -287,6 +287,21 @@ describe('Auth Module', () => {
       global.window = originalWindow;
     });
 
+    test('should drop the stored token before redirecting to login', () => {
+      const mockLocalStorage = { removeItem: vi.fn(), getItem: vi.fn(), setItem: vi.fn(), clear: vi.fn() };
+      const mockLocation = { href: 'https://example.com/current-page' };
+      const originalWindow = global.window;
+      global.window = { localStorage: mockLocalStorage, location: mockLocation };
+
+      base44.auth.redirectToLogin();
+
+      expect(mockLocalStorage.removeItem).toHaveBeenCalledWith('base44_access_token');
+      expect(mockLocalStorage.removeItem).toHaveBeenCalledWith('token');
+      expect(mockLocation.href).toContain('/login?from_url=');
+
+      global.window = originalWindow;
+    });
+
     test('should use appBaseUrl for login redirect when provided', () => {
       const customAppBaseUrl = 'https://custom-app.example.com';
       const clientWithCustomUrl = createClient({
@@ -419,7 +434,7 @@ describe('Auth Module', () => {
       base44.auth.logout();
 
       // Verify error was logged
-      expect(consoleSpy).toHaveBeenCalledWith('Failed to remove token from localStorage:', expect.any(Error));
+      expect(consoleSpy).toHaveBeenCalledWith('Error removing token from local storage:', expect.any(Error));
 
       // Restore
       consoleSpy.mockRestore();