diff --git a/webui2/README.md b/webui2/README.md
index 1dd4e4b8c485abf852e22d7947daf6dac8068486..e5609b777ba455f7ead566ff20aa30bf874388f0 100644
--- a/webui2/README.md
+++ b/webui2/README.md
@@ -15,7 +15,7 @@ pnpm install
 pnpm dev
 ```
 
-Open http://localhost:5173. Vite proxies `/graphql`, `/gitfile`, `/gitraw`, `/upload`, and `/auth` to the Go server on port 3000.
+Open http://localhost:5173. Vite proxies `/graphql`, `/gitfile`, and `/upload` to the Go server on port 3000.
 
 Node 22 is required. If you use asdf, `.tool-versions` pins the right version automatically.
 
@@ -32,7 +32,6 @@ Node 22 is required. If you use asdf, `.tool-versions` pins the right version au
 | `/$repo/issues/new`            | New issue form                                 |
 | `/$repo/issues/$id`            | Issue detail and timeline                      |
 | `/$repo/user/$id`              | User profile with their issues                 |
-| `/auth/select-identity`        | OAuth identity adoption (first-time login)     |
 
 `_` is the URL segment for the default (unnamed) repository. Named repositories use their registered name.
 
@@ -51,7 +50,6 @@ src/
 │   │   ├── _issues.tsx # Issues layout — preloads labels + identities
 │   │   ├── _issues/    # issues/, issues/new, issues/$id, user/$id
 │   │   └── commit/     # commit/$hash
-│   └── auth/           # select-identity
 ├── components/
 │   ├── ui/             # shadcn/ui primitives (button, input, avatar, ...)
 │   ├── shared/         # Reusable app components with composition APIs
@@ -226,13 +224,7 @@ pnpm codegen     # regenerate GraphQL types
 
 ## Auth
 
-Three modes, configured at server start:
-
-- **`local`** — single user derived from git config; all writes enabled, no login UI.
-- **`external`** — multi-user via OAuth providers; unauthenticated requests get 401.
-- **`readonly`** — no identity; all write actions hidden in the UI.
-
-`AuthProvider` (`src/lib/auth.tsx`) fetches server config + user identity on load and exposes `{ user, mode, loginProviders }` to the component tree.
+Currently local-only: the server injects the git config identity for every request. `useAuth()` (`src/lib/auth.tsx`) fetches the user identity via a GraphQL `useSuspenseQuery`, preloaded in the root route loader so it's always resolved before components render.
 
 ## Build for production
 
diff --git a/webui2/vite.config.ts b/webui2/vite.config.ts
index 98c5f9f7040fa5feba1acfe7c008007694c4265d..c0995adbfe19f3a2a65884b66db2f09fe66d7aaa 100644
--- a/webui2/vite.config.ts
+++ b/webui2/vite.config.ts
@@ -27,9 +27,7 @@ export default defineConfig({
     proxy: {
       "/graphql": { target: API_URL, changeOrigin: true },
       "/gitfile": { target: API_URL, changeOrigin: true },
-      "/gitraw": { target: API_URL, changeOrigin: true },
       "/upload": { target: API_URL, changeOrigin: true },
-      "/auth": { target: API_URL, changeOrigin: true },
     },
   },
 });