diff --git a/public/service-worker.js b/public/service-worker.js
index eb9bd33..f3a34bf 100644
--- a/public/service-worker.js
+++ b/public/service-worker.js
@@ -1,5 +1,5 @@
 // public/service-worker.js
-const CACHE_NAME = 'sociowire-v5';
+const CACHE_NAME = 'sociowire-v6';
 const PRECACHE = [
   '/icons/icon-192x192.png',
   '/icons/icon-512x512.png',
@@ -27,8 +27,8 @@ self.addEventListener('activate', event => {
 self.addEventListener('fetch', event => {
   const url = new URL(event.request.url);
 
-  // Never cache API calls - always fetch fresh data
-  const isAPI = url.pathname.startsWith('/api/') || url.pathname.startsWith('/ws');
+  // Never cache API calls or auth endpoints - always fetch fresh data
+  const isAPI = url.pathname.startsWith('/api/') || url.pathname.startsWith('/ws') || url.pathname.startsWith('/auth');
   if (isAPI) {
     event.respondWith(fetch(event.request));
     return;
diff --git a/src/auth/AuthContext.jsx b/src/auth/AuthContext.jsx
index b8a4133..41e9f52 100644
--- a/src/auth/AuthContext.jsx
+++ b/src/auth/AuthContext.jsx
@@ -2,6 +2,7 @@ import React, { createContext, useContext, useEffect, useMemo, useRef, useState
 import Keycloak from "keycloak-js";
 import {
   clearAuth,
+  clearBadTokens,
   guessUsernameFromToken,
   jwtExpSeconds,
   loadAuth,
@@ -360,6 +361,10 @@ export function AuthProvider({ children }) {
     setStatus("loading");
     setError("");
     setLastInfo("");
+
+    // Clear tokens from old/wrong issuer (e.g., auth.sociowire.com vs us2.sociowire.com)
+    clearBadTokens("us2.sociowire.com");
+
     const saved = loadAuth();
     if (!saved?.access_token) {
       try {
diff --git a/src/auth/authStorage.js b/src/auth/authStorage.js
index 6f0af7e..0c92d90 100644
--- a/src/auth/authStorage.js
+++ b/src/auth/authStorage.js
@@ -55,3 +55,22 @@ export function guessUsernameFromToken(token) {
     ""
   );
 }
+
+// Clear tokens if they have wrong issuer (e.g., from old auth config)
+export function clearBadTokens(expectedIssuerSubstring) {
+  try {
+    const saved = loadAuth();
+    if (!saved?.access_token) return false;
+    const p = decodeJwtPayload(saved.access_token);
+    if (!p?.iss) return false;
+    // If issuer doesn't contain expected substring, clear it
+    if (!p.iss.includes(expectedIssuerSubstring)) {
+      console.warn("[Auth] Clearing tokens with wrong issuer:", p.iss);
+      clearAuth();
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}