diff --git a/.gitignore b/.gitignore
index 8bd49bd..cfa7dbd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,7 +1,7 @@
 node_modules/
 .nuxt/
 .output/
-dist/
+dist
 .env
 .env.local
 *.log
diff --git a/apps/web/nuxt.config.ts b/apps/web/nuxt.config.ts
index b43854e..eeed5ee 100644
--- a/apps/web/nuxt.config.ts
+++ b/apps/web/nuxt.config.ts
@@ -29,6 +29,12 @@ export default defineNuxtConfig({
       // wrong address. Keep these in step with that default.
       apiBase: process.env.NUXT_PUBLIC_API_BASE || "http://localhost:3000",
       wsBase: process.env.NUXT_PUBLIC_WS_BASE || "ws://localhost:3000",
+      // Shows a password form on the login page. Off unless asked for: the
+      // real sign-in is a magic link, but that needs the Supabase project to
+      // send email, and the devstack's does not (`POST /auth/v1/otp` answers
+      // 500 "Error sending magic link email"), which left no way to sign in
+      // at all. A build meant for real users must not set this.
+      passwordLogin: process.env.NUXT_PUBLIC_PASSWORD_LOGIN === "true",
       // There is deliberately no go2rtcStreamBase here any more. A camera
       // stream lives on a gateway inside a particular farm's network, each
       // farm has its own, and the gateway tells the backend its address when
diff --git a/apps/web/pages/login.vue b/apps/web/pages/login.vue
index c91a76f..7e19fe1 100644
--- a/apps/web/pages/login.vue
+++ b/apps/web/pages/login.vue
@@ -3,6 +3,22 @@ const email = ref("");
 const sent = ref(false);
 const error = ref<string | null>(null);
 const client = useSupabaseClient();
+const passwordLogin = useRuntimeConfig().public.passwordLogin;
+const password = ref("");
+
+async function signInWithPassword() {
+  error.value = null;
+  const { error: authError } = await client.auth.signInWithPassword({
+    email: email.value,
+    password: password.value,
+  });
+  if (authError) {
+    error.value = authError.message;
+    return;
+  }
+  // The Supabase module redirects away from /login once a session exists.
+  await navigateTo("/");
+}
 
 async function sendMagicLink() {
   error.value = null;
@@ -23,6 +39,12 @@ async function sendMagicLink() {
       <button type="submit">Send magic link</button>
     </form>
     <p v-else>Check your inbox for a sign-in link.</p>
+    <form v-if="passwordLogin" class="login__password" @submit.prevent="signInWithPassword">
+      <p class="login__hint">Password sign-in is enabled for this build (testing only).</p>
+      <input v-model="email" type="email" placeholder="you@farm.com" required />
+      <input v-model="password" type="password" placeholder="password" required autocomplete="current-password" />
+      <button type="submit">Sign in</button>
+    </form>
     <p v-if="error" class="login__error">{{ error }}</p>
   </div>
 </template>
@@ -36,6 +58,17 @@ async function sendMagicLink() {
   gap: 0.75rem;
 }
 
+.login__password {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+}
+
+.login__hint {
+  font-size: 0.75rem;
+  opacity: 0.7;
+}
+
 .login__error {
   color: #f2604c;
 }