diff --git a/apps/api-gateway/src/lib/fedcm-config.ts b/apps/api-gateway/src/lib/fedcm-config.ts
index 29cd8f5..225fb16 100644
--- a/apps/api-gateway/src/lib/fedcm-config.ts
+++ b/apps/api-gateway/src/lib/fedcm-config.ts
@@ -38,7 +38,9 @@ function buildFedcmEndpointUrls(issuer: string, frontendUrl: string) {
     accountsEndpoint: `${base}/fedcm/accounts`,
     clientMetadataEndpoint: `${base}/fedcm/client_metadata`,
     idAssertionEndpoint: `${base}/fedcm/id_assertion`,
-    loginUrl: `${front}/auth/login`,
+    // FedCM: login_url MUST be same-origin with config.json (W3C FedCM / Chrome).
+    // На split-domain UI проксируется через nginx: api.idpmvk.lpr/auth/login → frontend.
+    loginUrl: `${base}/auth/login`,
     signupUrl: `${front}/auth/register`,
     webIdentityUrl: `${webIdentityOrigin}/.well-known/web-identity`
   };
@@ -102,15 +104,16 @@ export async function resolveFedcmEndpoints(core: CoreGrpcService, _req?: Reques
 }
 
 export function buildFedcmProviderConfig(endpoints: FedcmEndpoints) {
+  const base = normalizePublicBaseUrl(endpoints.issuer);
   return {
-    accounts_endpoint: endpoints.accountsEndpoint,
-    client_metadata_endpoint: endpoints.clientMetadataEndpoint,
-    id_assertion_endpoint: endpoints.idAssertionEndpoint,
+    accounts_endpoint: `${base}/fedcm/accounts`,
+    client_metadata_endpoint: `${base}/fedcm/client_metadata`,
+    id_assertion_endpoint: `${base}/fedcm/id_assertion`,
     login_url: endpoints.loginUrl,
     branding: {
       background_color: '#ffffff',
       color: '#1f2430',
-      icons: [{ url: `${endpoints.frontendUrl}/favicon.ico`, size: 32 }]
+      icons: [{ url: `${base}/favicon.ico`, size: 32 }]
     }
   };
 }
diff --git a/apps/frontend/components/id/oauth-client-one-tap-section.tsx b/apps/frontend/components/id/oauth-client-one-tap-section.tsx
index c4659bd..4c93861 100644
--- a/apps/frontend/components/id/oauth-client-one-tap-section.tsx
+++ b/apps/frontend/components/id/oauth-client-one-tap-section.tsx
@@ -96,6 +96,14 @@ export function OAuthClientOneTapSection({
         <ol className="mt-2 list-decimal space-y-1 pl-4">
           <li>Войдите на IdP ({frontendBase}) в этом браузере.</li>
           <li>Откройте сайт клиента с виджетом — Chrome покажет нативный диалог или плашку One Tap.</li>
+          <li>
+            <code>login_url</code> в config.json должен быть на том же домене, что и config (
+            <code>{endpoints.issuer}/auth/login</code>), не на SSO-домене.
+          </li>
+          <li>
+            <code>configURL</code> для FedCM: <code>{endpoints.fedcmConfigUrl}</code> (не{' '}
+            <code>{frontendBase}/idp-api/fedcm/config.json</code>).
+          </li>
           <li>
             При ошибке NetworkError проверьте, что <code>PUBLIC_API_URL</code> = <code>{endpoints.issuer}</code>.
           </li>
diff --git a/install.sh b/install.sh
index 46966a9..b6863c0 100644
--- a/install.sh
+++ b/install.sh
@@ -2312,11 +2312,25 @@ EOF
 
 build_nginx_api_location_block() {
   if [[ "$NGINX_MODE" == "docker" ]]; then
-    local proxy proxy_idp proxy_ws
+    local proxy proxy_idp proxy_ws proxy_frontend
     proxy="$(render_proxy_root api)"
     proxy_idp="$(render_proxy_idp_api)"
     proxy_ws="$(render_proxy_idp_ws)"
+    proxy_frontend="$(render_proxy_root frontend)"
     cat <<EOF
+    # FedCM login_url same-origin: форма входа на API-домене проксируется на frontend.
+    location /auth/ {
+${proxy_frontend}
+        proxy_http_version 1.1;
+${nginx_proxy_headers}
+    }
+
+    location = /favicon.ico {
+${proxy_frontend}
+        proxy_http_version 1.1;
+${nginx_proxy_headers}
+    }
+
     # Алиас /idp-api на API-домене: совместимость с PUBLIC_API_URL из документации и curl.
     location ^~ /idp-api/ws {
 ${proxy_ws}
@@ -3065,6 +3079,11 @@ verify_fedcm_endpoints() {
     | jq -r '.login_url // empty' 2>/dev/null || true)"
   if [[ -n "$config_login_url" ]]; then
     echo -e "  ${GREEN}✔${NC} FedCM config.json login_url=${config_login_url}"
+    if [[ "$config_login_url" != "https://${api_domain}/auth/login" \
+          && "$config_login_url" != "http://${api_domain}/auth/login" ]]; then
+      echo -e "  ${YELLOW}!${NC} login_url должен быть same-origin с config (${scheme}://${api_domain}/auth/login)"
+      echo "      Иначе Chrome: «invalid URL for login_url». Пересоберите api-gateway и ./install.sh --fix-all"
+    fi
   elif [[ -n "$config_login_url_alias" ]]; then
     echo -e "  ${YELLOW}!${NC} FedCM config.json: используйте ${scheme}://${api_domain}/fedcm/config.json (не /idp-api/ на API-домене)"
     echo -e "  ${GREEN}✔${NC} FedCM config.json (alias /idp-api) login_url=${config_login_url_alias}"