diff --git a/dashboard.html b/dashboard.html
index 5358f7c..45ef72c 100644
--- a/dashboard.html
+++ b/dashboard.html
@@ -85,7 +85,9 @@
 <script>
 const BASE = window.location.origin;
 const headers = {};
-const storedToken = localStorage.getItem("ocp_token");
+const urlToken = new URLSearchParams(window.location.search).get("token");
+const storedToken = urlToken || localStorage.getItem("ocp_token");
+if (urlToken) { localStorage.setItem("ocp_token", urlToken); history.replaceState(null, "", "/dashboard"); }
 if (storedToken) headers["Authorization"] = `Bearer ${storedToken}`;
 
 async function api(path) {
diff --git a/docs/images/dashboard.png b/docs/images/dashboard.png
index 772198e..a328fe8 100644
Binary files a/docs/images/dashboard.png and b/docs/images/dashboard.png differ
diff --git a/server.mjs b/server.mjs
index 795d426..458f791 100644
--- a/server.mjs
+++ b/server.mjs
@@ -1039,7 +1039,8 @@ const server = createServer(async (req, res) => {
   if (req.method === "OPTIONS") { res.writeHead(204); res.end(); return; }
 
   // 3-mode auth: none | shared | multi
-  const isPublicEndpoint = req.url === "/health" || req.url === "/dashboard";
+  const pathname = req.url.split("?")[0];
+  const isPublicEndpoint = pathname === "/health" || pathname === "/dashboard";
   let authKeyName = "local";
   let authKeyId = null;
 
@@ -1217,7 +1218,7 @@ const server = createServer(async (req, res) => {
   }
 
   // GET /dashboard — web dashboard
-  if (req.url === "/dashboard" && req.method === "GET") {
+  if (pathname === "/dashboard" && req.method === "GET") {
     try {
       const html = readFileSync(join(__dirname, "dashboard.html"), "utf8");
       res.writeHead(200, { "Content-Type": "text/html; charset=utf-8" });