diff --git a/frontend/src/components/auth/LoginForm.tsx b/frontend/src/components/auth/LoginForm.tsx
index ddadf989..a3b238bc 100644
--- a/frontend/src/components/auth/LoginForm.tsx
+++ b/frontend/src/components/auth/LoginForm.tsx
@@ -23,9 +23,12 @@ const LoginForm = () => {
 
   const onSubmit: SubmitHandler<LoginType> = async (data: LoginType) => {
     try {
-      const { data: response, error } = await auth.client.POST("/auth/login", {
-        body: data,
-      });
+      const { data: response, error } = await auth.client.POST(
+        "/auth/email/login",
+        {
+          body: data,
+        },
+      );
 
       if (error) {
         addErrorAlert(error);
diff --git a/frontend/src/components/auth/SignupForm.tsx b/frontend/src/components/auth/SignupForm.tsx
index 9d20e115..f0654457 100644
--- a/frontend/src/components/auth/SignupForm.tsx
+++ b/frontend/src/components/auth/SignupForm.tsx
@@ -44,7 +44,7 @@ const SignupForm: React.FC<SignupFormProps> = ({ signupTokenId }) => {
     }
 
     try {
-      const { error } = await auth.client.POST("/auth/signup", {
+      const { error } = await auth.client.POST("/auth/email/signup", {
         body: {
           signup_token_id: signupTokenId,
           email: data.email,
diff --git a/frontend/src/components/auth/SignupWithEmail.tsx b/frontend/src/components/auth/SignupWithEmail.tsx
index 6b9e4d28..d1c594cc 100644
--- a/frontend/src/components/auth/SignupWithEmail.tsx
+++ b/frontend/src/components/auth/SignupWithEmail.tsx
@@ -25,11 +25,14 @@ const SignupWithEmail = () => {
   });
 
   const onSubmit = async ({ email }: EmailSignupType) => {
-    const { data, error } = await auth.client.POST("/email/signup/create", {
-      body: {
-        email,
+    const { data, error } = await auth.client.POST(
+      "/auth/email/signup/create",
+      {
+        body: {
+          email,
+        },
       },
-    });
+    );
 
     if (error) {
       addErrorAlert(error);
diff --git a/frontend/src/components/files/URDFRenderer.tsx b/frontend/src/components/files/URDFRenderer.tsx
index 58bbe323..f2d2bf0f 100644
--- a/frontend/src/components/files/URDFRenderer.tsx
+++ b/frontend/src/components/files/URDFRenderer.tsx
@@ -6,6 +6,7 @@ import {
   FaCompress,
   FaExpand,
   FaPlay,
+  FaSync,
   FaUndo,
 } from "react-icons/fa";
 
@@ -29,14 +30,6 @@ interface URDFInfo {
 
 type Theme = "light" | "dark";
 
-interface Props {
-  urdfContent: string;
-  files: UntarredFile[];
-  useControls?: boolean;
-  showWireframe?: boolean;
-  supportedThemes?: Theme[];
-}
-
 interface ThemeColors {
   background: string;
   text: string;
@@ -60,12 +53,22 @@ const getThemeColors = (theme: Theme): ThemeColors => {
   }
 };
 
+interface Props {
+  urdfContent: string;
+  files: UntarredFile[];
+  useControls?: boolean;
+  showWireframe?: boolean;
+  supportedThemes?: Theme[];
+  overrideColor?: string | null;
+}
+
 const URDFRenderer = ({
   urdfContent,
   files,
   useControls = true,
   showWireframe = false,
   supportedThemes = ["light", "dark"],
+  overrideColor = null,
 }: Props) => {
   const containerRef = useRef<HTMLDivElement>(null);
   const sceneRef = useRef<THREE.Scene | null>(null);
@@ -91,6 +94,9 @@ const URDFRenderer = ({
   const cameraRef = useRef<THREE.PerspectiveCamera | null>(null);
   const controlsRef = useRef<OrbitControls | null>(null);
 
+  // Add new state/refs for auto-rotation
+  const [isAutoRotating, setIsAutoRotating] = useState(false);
+
   useEffect(() => {
     const handleFullScreenChange = () => {
       const isNowFullScreen = !!document.fullscreenElement;
@@ -115,7 +121,7 @@ const URDFRenderer = ({
           metalness: 0.4,
           roughness: 0.5,
           wireframe: isWireframe,
-          color: originalColor,
+          color: overrideColor ? new THREE.Color(overrideColor) : originalColor,
         });
       }
     });
@@ -184,6 +190,7 @@ const URDFRenderer = ({
     controlsRef.current = controls;
     controls.enableDamping = true;
     controls.dampingFactor = 0.25;
+    controls.autoRotateSpeed = 1.0;
 
     scene.children.forEach((child) => {
       if (child instanceof THREE.Light) {
@@ -287,11 +294,14 @@ const URDFRenderer = ({
 
     // Setup the animation loop.
     const animate = () => {
-      requestAnimationFrame(animate);
+      const animationId = requestAnimationFrame(animate);
       controls.update();
+
       renderer.render(scene, camera);
+      return animationId;
     };
-    animate();
+
+    const animationId = animate();
 
     // Handle window resizing.
     const handleResize = () => {
@@ -326,11 +336,37 @@ const URDFRenderer = ({
     updateMaterials();
 
     return () => {
+      if (animationId) {
+        cancelAnimationFrame(animationId);
+      }
+
+      scene.traverse((object) => {
+        if (object instanceof THREE.Mesh) {
+          if (object.geometry) {
+            object.geometry.dispose();
+          }
+          if (object.material) {
+            if (Array.isArray(object.material)) {
+              object.material.forEach((material) => material.dispose());
+            } else {
+              object.material.dispose();
+            }
+          }
+        }
+      });
+
+      if (renderer) {
+        renderer.dispose();
+      }
+
       if (containerRef.current) {
         containerRef.current.removeChild(renderer.domElement);
       }
+      if (controlsRef.current) {
+        controlsRef.current.autoRotate = false;
+        controlsRef.current.dispose();
+      }
       window.removeEventListener("resize", handleResize);
-      rendererRef.current = null;
       document.removeEventListener("fullscreenchange", handleFullScreenChange);
     };
   }, [urdfContent, files]);
@@ -360,7 +396,7 @@ const URDFRenderer = ({
 
     const startPositions = jointControls.map((joint) => joint.value);
     const startTime = Date.now();
-    const duration = 3000; // Changed from 10000 to 3000 (3 seconds)
+    const duration = 3000;
 
     const animate = () => {
       const elapsedTime = Date.now() - startTime;
@@ -378,15 +414,25 @@ const URDFRenderer = ({
       if (progress < 1) {
         animationRef.current = requestAnimationFrame(animate);
       } else {
-        // Reset to original positions
         jointControls.forEach((_joint, index) => {
           handleJointChange(index, startPositions[index]);
         });
         setIsCycling(false);
+        if (animationRef.current) {
+          cancelAnimationFrame(animationRef.current);
+          animationRef.current = null;
+        }
       }
     };
 
     animationRef.current = requestAnimationFrame(animate);
+
+    return () => {
+      if (animationRef.current) {
+        cancelAnimationFrame(animationRef.current);
+        animationRef.current = null;
+      }
+    };
   }, [jointControls, handleJointChange]);
 
   const resetJoints = useCallback(() => {
@@ -408,6 +454,14 @@ const URDFRenderer = ({
     }
   }, []);
 
+  const toggleAutoRotate = useCallback(() => {
+    const newIsAutoRotating = !isAutoRotating;
+    if (controlsRef.current) {
+      controlsRef.current.autoRotate = newIsAutoRotating;
+    }
+    setIsAutoRotating(newIsAutoRotating);
+  }, [isAutoRotating]);
+
   return (
     <div
       ref={parentRef}
@@ -426,6 +480,12 @@ const URDFRenderer = ({
           >
             <FaChevronUp />
           </button>
+          <button
+            onClick={toggleAutoRotate}
+            className="bg-purple-500 hover:bg-purple-600 text-white font-bold w-8 h-8 rounded-full shadow-md flex items-center justify-center"
+          >
+            <FaSync className={isAutoRotating ? "animate-pulse" : ""} />
+          </button>
           <button
             onClick={toggleFullScreen}
             className={
diff --git a/frontend/src/components/pages/EmailSignup.tsx b/frontend/src/components/pages/EmailSignup.tsx
index b061d765..401e6029 100644
--- a/frontend/src/components/pages/EmailSignup.tsx
+++ b/frontend/src/components/pages/EmailSignup.tsx
@@ -10,7 +10,7 @@ import { useAlertQueue } from "@/hooks/useAlertQueue";
 import { useAuthentication } from "@/hooks/useAuth";
 
 type GetEmailSignUpTokenResponse =
-  paths["/email/signup/get/{id}"]["get"]["responses"][200]["content"]["application/json"];
+  paths["/auth/email/signup/get/{id}"]["get"]["responses"][200]["content"]["application/json"];
 
 const EmailSignup = () => {
   const navigate = useNavigate();
@@ -28,7 +28,7 @@ const EmailSignup = () => {
 
       try {
         const { data, error } = await auth.client.GET(
-          "/email/signup/get/{id}",
+          "/auth/email/signup/get/{id}",
           {
             params: {
               path: { id },
diff --git a/frontend/src/components/pages/Logout.tsx b/frontend/src/components/pages/Logout.tsx
index d521320c..0f4b2b02 100644
--- a/frontend/src/components/pages/Logout.tsx
+++ b/frontend/src/components/pages/Logout.tsx
@@ -12,7 +12,7 @@ const Logout = () => {
 
   useEffect(() => {
     (async () => {
-      const { error } = await auth.client.DELETE("/auth/logout");
+      const { error } = await auth.client.DELETE("/auth/api/logout");
       if (error) {
         addErrorAlert(error);
       } else {
diff --git a/frontend/src/components/terminal/TerminalRobotModel.tsx b/frontend/src/components/terminal/TerminalRobotModel.tsx
index 63921513..f39e4f4d 100644
--- a/frontend/src/components/terminal/TerminalRobotModel.tsx
+++ b/frontend/src/components/terminal/TerminalRobotModel.tsx
@@ -98,6 +98,7 @@ const TerminalRobotModel = ({ listingId }: Props) => {
       supportedThemes={["dark"]}
       showWireframe={true}
       useControls={false}
+      overrideColor={"#00ff00"}
     />
   );
 };
diff --git a/frontend/src/gen/api.ts b/frontend/src/gen/api.ts
index ed714120..2c154514 100644
--- a/frontend/src/gen/api.ts
+++ b/frontend/src/gen/api.ts
@@ -21,7 +21,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/auth/signup": {
+    "/auth/api/logout": {
         parameters: {
             query?: never;
             header?: never;
@@ -30,26 +30,9 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Register User */
-        post: operations["register_user_auth_signup_post"];
-        delete?: never;
-        options?: never;
-        head?: never;
-        patch?: never;
-        trace?: never;
-    };
-    "/auth/login": {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        get?: never;
-        put?: never;
-        /** Login User */
-        post: operations["login_user_auth_login_post"];
-        delete?: never;
+        post?: never;
+        /** Logout User Endpoint */
+        delete: operations["logout_user_endpoint_auth_api_logout_delete"];
         options?: never;
         head?: never;
         patch?: never;
@@ -134,7 +117,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/auth/logout": {
+    "/auth/email/signup/create": {
         parameters: {
             query?: never;
             header?: never;
@@ -143,23 +126,26 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        post?: never;
-        /** Logout User Endpoint */
-        delete: operations["logout_user_endpoint_auth_logout_delete"];
+        /**
+         * Create Signup Token
+         * @description Creates a signup token and emails it to the user.
+         */
+        post: operations["create_signup_token_auth_email_signup_create_post"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/artifacts/url/{artifact_type}/{listing_id}/{name}": {
+    "/auth/email/signup/get/{id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Artifact Url */
-        get: operations["artifact_url_artifacts_url__artifact_type___listing_id___name__get"];
+        /** Get Signup Token */
+        get: operations["get_signup_token_auth_email_signup_get__id__get"];
         put?: never;
         post?: never;
         delete?: never;
@@ -168,41 +154,41 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/artifacts/info/{artifact_id}": {
+    "/auth/email/signup/delete/{id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get Artifact Info */
-        get: operations["get_artifact_info_artifacts_info__artifact_id__get"];
+        get?: never;
         put?: never;
         post?: never;
-        delete?: never;
+        /** Delete Signup Token */
+        delete: operations["delete_signup_token_auth_email_signup_delete__id__delete"];
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/artifacts/list/{listing_id}": {
+    "/auth/email/signup": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** List Artifacts */
-        get: operations["list_artifacts_artifacts_list__listing_id__get"];
+        get?: never;
         put?: never;
-        post?: never;
+        /** Register User */
+        post: operations["register_user_auth_email_signup_post"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/artifacts/upload/{listing_id}": {
+    "/auth/email/login": {
         parameters: {
             query?: never;
             header?: never;
@@ -211,24 +197,24 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /** Upload */
-        post: operations["upload_artifacts_upload__listing_id__post"];
+        /** Login User */
+        post: operations["login_user_auth_email_login_post"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/artifacts/edit/{artifact_id}": {
+    "/artifacts/url/{artifact_type}/{listing_id}/{name}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        /** Edit Artifact */
-        put: operations["edit_artifact_artifacts_edit__artifact_id__put"];
+        /** Artifact Url */
+        get: operations["artifact_url_artifacts_url__artifact_type___listing_id___name__get"];
+        put?: never;
         post?: never;
         delete?: never;
         options?: never;
@@ -236,33 +222,33 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/artifacts/delete/{artifact_id}": {
+    "/artifacts/info/{artifact_id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
+        /** Get Artifact Info */
+        get: operations["get_artifact_info_artifacts_info__artifact_id__get"];
         put?: never;
         post?: never;
-        /** Delete Artifact */
-        delete: operations["delete_artifact_artifacts_delete__artifact_id__delete"];
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/artifacts/list/{listing_id}/main": {
+    "/artifacts/list/{listing_id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        get?: never;
-        /** Set Main Image */
-        put: operations["set_main_image_artifacts_list__listing_id__main_put"];
+        /** List Artifacts */
+        get: operations["list_artifacts_artifacts_list__listing_id__get"];
+        put?: never;
         post?: never;
         delete?: never;
         options?: never;
@@ -270,7 +256,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/email/signup/create": {
+    "/artifacts/upload/{listing_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -279,27 +265,24 @@ export interface paths {
         };
         get?: never;
         put?: never;
-        /**
-         * Create Signup Token
-         * @description Creates a signup token and emails it to the user.
-         */
-        post: operations["create_signup_token_email_signup_create_post"];
+        /** Upload */
+        post: operations["upload_artifacts_upload__listing_id__post"];
         delete?: never;
         options?: never;
         head?: never;
         patch?: never;
         trace?: never;
     };
-    "/email/signup/get/{id}": {
+    "/artifacts/edit/{artifact_id}": {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        /** Get Signup Token */
-        get: operations["get_signup_token_email_signup_get__id__get"];
-        put?: never;
+        get?: never;
+        /** Edit Artifact */
+        put: operations["edit_artifact_artifacts_edit__artifact_id__put"];
         post?: never;
         delete?: never;
         options?: never;
@@ -307,7 +290,7 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
-    "/email/signup/delete/{id}": {
+    "/artifacts/delete/{artifact_id}": {
         parameters: {
             query?: never;
             header?: never;
@@ -317,8 +300,25 @@ export interface paths {
         get?: never;
         put?: never;
         post?: never;
-        /** Delete Signup Token */
-        delete: operations["delete_signup_token_email_signup_delete__id__delete"];
+        /** Delete Artifact */
+        delete: operations["delete_artifact_artifacts_delete__artifact_id__delete"];
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/artifacts/list/{listing_id}/main": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        /** Set Main Image */
+        put: operations["set_main_image_artifacts_list__listing_id__main_put"];
+        post?: never;
+        delete?: never;
         options?: never;
         head?: never;
         patch?: never;
@@ -1304,6 +1304,43 @@ export interface paths {
         patch?: never;
         trace?: never;
     };
+    "/teleop/rtc/store": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /** Store Ice Candidate */
+        post: operations["store_ice_candidate_teleop_rtc_store_post"];
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
+    "/teleop/rtc/poll/ice-candidates": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        /**
+         * Poll Ice Candidates
+         * @description Defines the polling endpoint for ICE candidates.
+         */
+        get: operations["poll_ice_candidates_teleop_rtc_poll_ice_candidates_get"];
+        put?: never;
+        post?: never;
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
 }
 export type webhooks = Record<string, never>;
 export interface components {
@@ -2077,51 +2114,14 @@ export interface operations {
             };
         };
     };
-    register_user_auth_signup_post: {
-        parameters: {
-            query?: never;
-            header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UserSignup"];
-            };
-        };
-        responses: {
-            /** @description Successful Response */
-            200: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["UserInfoResponseItem"];
-                };
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["HTTPValidationError"];
-                };
-            };
-        };
-    };
-    login_user_auth_login_post: {
+    logout_user_endpoint_auth_api_logout_delete: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["LoginRequest"];
-            };
-        };
+        requestBody?: never;
         responses: {
             /** @description Successful Response */
             200: {
@@ -2129,16 +2129,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["LoginResponse"];
-                };
-            };
-            /** @description Validation Error */
-            422: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content: {
-                    "application/json": components["schemas"]["HTTPValidationError"];
+                    "application/json": boolean;
                 };
             };
         };
@@ -2249,14 +2240,18 @@ export interface operations {
             };
         };
     };
-    logout_user_endpoint_auth_logout_delete: {
+    create_signup_token_auth_email_signup_create_post: {
         parameters: {
             query?: never;
             header?: never;
             path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["EmailSignUpRequest"];
+            };
+        };
         responses: {
             /** @description Successful Response */
             200: {
@@ -2264,21 +2259,26 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": boolean;
+                    "application/json": components["schemas"]["EmailSignUpResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
                 };
             };
         };
     };
-    artifact_url_artifacts_url__artifact_type___listing_id___name__get: {
+    get_signup_token_auth_email_signup_get__id__get: {
         parameters: {
-            query?: {
-                size?: "small" | "large";
-            };
+            query?: never;
             header?: never;
             path: {
-                artifact_type: "image" | ("urdf" | "mjcf") | ("stl" | "obj" | "dae" | "ply") | ("tgz" | "zip");
-                listing_id: string;
-                name: string;
+                id: string;
             };
             cookie?: never;
         };
@@ -2290,7 +2290,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": unknown;
+                    "application/json": components["schemas"]["GetTokenResponse"];
                 };
             };
             /** @description Validation Error */
@@ -2304,12 +2304,12 @@ export interface operations {
             };
         };
     };
-    get_artifact_info_artifacts_info__artifact_id__get: {
+    delete_signup_token_auth_email_signup_delete__id__delete: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                artifact_id: string;
+                id: string;
             };
             cookie?: never;
         };
@@ -2321,7 +2321,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["SingleArtifactResponse"];
+                    "application/json": components["schemas"]["DeleteTokenResponse"];
                 };
             };
             /** @description Validation Error */
@@ -2335,16 +2335,18 @@ export interface operations {
             };
         };
     };
-    list_artifacts_artifacts_list__listing_id__get: {
+    register_user_auth_email_signup_post: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                listing_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
-        requestBody?: never;
+        requestBody: {
+            content: {
+                "application/json": components["schemas"]["UserSignup"];
+            };
+        };
         responses: {
             /** @description Successful Response */
             200: {
@@ -2352,7 +2354,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["ListArtifactsResponse"];
+                    "application/json": components["schemas"]["UserInfoResponseItem"];
                 };
             };
             /** @description Validation Error */
@@ -2366,18 +2368,16 @@ export interface operations {
             };
         };
     };
-    upload_artifacts_upload__listing_id__post: {
+    login_user_auth_email_login_post: {
         parameters: {
             query?: never;
             header?: never;
-            path: {
-                listing_id: string;
-            };
+            path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                "multipart/form-data": components["schemas"]["Body_upload_artifacts_upload__listing_id__post"];
+                "application/json": components["schemas"]["LoginRequest"];
             };
         };
         responses: {
@@ -2387,7 +2387,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["UploadArtifactResponse"];
+                    "application/json": components["schemas"]["LoginResponse"];
                 };
             };
             /** @description Validation Error */
@@ -2401,20 +2401,20 @@ export interface operations {
             };
         };
     };
-    edit_artifact_artifacts_edit__artifact_id__put: {
+    artifact_url_artifacts_url__artifact_type___listing_id___name__get: {
         parameters: {
-            query: {
-                id: string;
+            query?: {
+                size?: "small" | "large";
             };
             header?: never;
-            path?: never;
-            cookie?: never;
-        };
-        requestBody: {
-            content: {
-                "application/json": components["schemas"]["UpdateArtifactRequest"];
+            path: {
+                artifact_type: "image" | ("urdf" | "mjcf") | ("stl" | "obj" | "dae" | "ply") | ("tgz" | "zip");
+                listing_id: string;
+                name: string;
             };
+            cookie?: never;
         };
+        requestBody?: never;
         responses: {
             /** @description Successful Response */
             200: {
@@ -2422,7 +2422,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": boolean;
+                    "application/json": unknown;
                 };
             };
             /** @description Validation Error */
@@ -2436,7 +2436,7 @@ export interface operations {
             };
         };
     };
-    delete_artifact_artifacts_delete__artifact_id__delete: {
+    get_artifact_info_artifacts_info__artifact_id__get: {
         parameters: {
             query?: never;
             header?: never;
@@ -2453,7 +2453,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": boolean;
+                    "application/json": components["schemas"]["SingleArtifactResponse"];
                 };
             };
             /** @description Validation Error */
@@ -2467,11 +2467,9 @@ export interface operations {
             };
         };
     };
-    set_main_image_artifacts_list__listing_id__main_put: {
+    list_artifacts_artifacts_list__listing_id__get: {
         parameters: {
-            query: {
-                artifact_id: string;
-            };
+            query?: never;
             header?: never;
             path: {
                 listing_id: string;
@@ -2486,7 +2484,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": boolean;
+                    "application/json": components["schemas"]["ListArtifactsResponse"];
                 };
             };
             /** @description Validation Error */
@@ -2500,16 +2498,53 @@ export interface operations {
             };
         };
     };
-    create_signup_token_email_signup_create_post: {
+    upload_artifacts_upload__listing_id__post: {
         parameters: {
             query?: never;
             header?: never;
+            path: {
+                listing_id: string;
+            };
+            cookie?: never;
+        };
+        requestBody: {
+            content: {
+                "multipart/form-data": components["schemas"]["Body_upload_artifacts_upload__listing_id__post"];
+            };
+        };
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["UploadArtifactResponse"];
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    edit_artifact_artifacts_edit__artifact_id__put: {
+        parameters: {
+            query: {
+                id: string;
+            };
+            header?: never;
             path?: never;
             cookie?: never;
         };
         requestBody: {
             content: {
-                "application/json": components["schemas"]["EmailSignUpRequest"];
+                "application/json": components["schemas"]["UpdateArtifactRequest"];
             };
         };
         responses: {
@@ -2519,7 +2554,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["EmailSignUpResponse"];
+                    "application/json": boolean;
                 };
             };
             /** @description Validation Error */
@@ -2533,12 +2568,12 @@ export interface operations {
             };
         };
     };
-    get_signup_token_email_signup_get__id__get: {
+    delete_artifact_artifacts_delete__artifact_id__delete: {
         parameters: {
             query?: never;
             header?: never;
             path: {
-                id: string;
+                artifact_id: string;
             };
             cookie?: never;
         };
@@ -2550,7 +2585,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["GetTokenResponse"];
+                    "application/json": boolean;
                 };
             };
             /** @description Validation Error */
@@ -2564,12 +2599,14 @@ export interface operations {
             };
         };
     };
-    delete_signup_token_email_signup_delete__id__delete: {
+    set_main_image_artifacts_list__listing_id__main_put: {
         parameters: {
-            query?: never;
+            query: {
+                artifact_id: string;
+            };
             header?: never;
             path: {
-                id: string;
+                listing_id: string;
             };
             cookie?: never;
         };
@@ -2581,7 +2618,7 @@ export interface operations {
                     [name: string]: unknown;
                 };
                 content: {
-                    "application/json": components["schemas"]["DeleteTokenResponse"];
+                    "application/json": boolean;
                 };
             };
             /** @description Validation Error */
@@ -4366,4 +4403,67 @@ export interface operations {
             };
         };
     };
+    store_ice_candidate_teleop_rtc_store_post: {
+        parameters: {
+            query: {
+                candidate: string;
+                robot_id: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": unknown;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
+    poll_ice_candidates_teleop_rtc_poll_ice_candidates_get: {
+        parameters: {
+            query: {
+                robot_id: string;
+            };
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        requestBody?: never;
+        responses: {
+            /** @description Successful Response */
+            200: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": unknown;
+                };
+            };
+            /** @description Validation Error */
+            422: {
+                headers: {
+                    [name: string]: unknown;
+                };
+                content: {
+                    "application/json": components["schemas"]["HTTPValidationError"];
+                };
+            };
+        };
+    };
 }
diff --git a/store/app/crud/base.py b/store/app/crud/base.py
index d07a87a0..c5e1f80d 100644
--- a/store/app/crud/base.py
+++ b/store/app/crud/base.py
@@ -277,6 +277,7 @@ async def _get_items_from_secondary_index(
         secondary_index_value: str,
         item_class: type[T],
         additional_filter_expression: ComparisonCondition | None = None,
+        limit: int = DEFAULT_SCAN_LIMIT,
     ) -> list[T]:
         filter_expression: ComparisonCondition = Key("type").eq(item_class.__name__)
         if additional_filter_expression is not None:
@@ -286,10 +287,20 @@ async def _get_items_from_secondary_index(
             IndexName=self.get_gsi_index_name(secondary_index_name),
             KeyConditionExpression=Key(secondary_index_name).eq(secondary_index_value),
             FilterExpression=filter_expression,
+            Limit=limit,
         )
         items = item_dict["Items"]
         return [self._validate_item(item, item_class) for item in items]
 
+    async def _item_exists_in_secondary_index(
+        self,
+        secondary_index_name: str,
+        secondary_index_value: str,
+        item_class: type[T],
+    ) -> bool:
+        items = await self._get_items_from_secondary_index(secondary_index_name, secondary_index_value, item_class)
+        return len(items) > 0
+
     async def _get_items_from_secondary_index_batch(
         self,
         secondary_index_name: str,
@@ -353,6 +364,7 @@ async def _get_unique_item_from_secondary_index(
             secondary_index_name,
             secondary_index_value,
             item_class,
+            limit=2,
         )
         if len(items) == 0:
             if throw_if_missing:
@@ -362,24 +374,23 @@ async def _get_unique_item_from_secondary_index(
             raise InternalError(f"Multiple items found with {secondary_index_name} {secondary_index_value}")
         return items[0]
 
-    async def _update_item(
-        self,
-        id: str,
-        model_type: type[T],
-        updates: dict[str, Any],
-    ) -> None:
+    async def _update_item(self, id: str, model_type: type[T], updates: dict[str, Any]) -> None:
         table_name = TABLE_NAME
         key = {"id": id}
 
+        # Add condition to ensure we're updating the correct type
+        condition_expression = "#type = :type"
         update_expression = "SET " + ", ".join(f"#{k} = :{k}" for k in updates.keys())
-        expression_attribute_values = {f":{k}": v for k, v in updates.items()}
-        expression_attribute_names = {f"#{k}": k for k in updates.keys()}
+
+        expression_attribute_values = {":type": model_type.__name__, **{f":{k}": v for k, v in updates.items()}}
+        expression_attribute_names = {"#type": "type", **{f"#{k}": k for k in updates.keys()}}
 
         try:
             await self.db.meta.client.update_item(
                 TableName=table_name,
                 Key=key,
                 UpdateExpression=update_expression,
+                ConditionExpression=condition_expression,
                 ExpressionAttributeValues=expression_attribute_values,
                 ExpressionAttributeNames=expression_attribute_names,
                 ReturnValues="NONE",
@@ -387,6 +398,8 @@ async def _update_item(
         except ClientError as e:
             if e.response["Error"]["Code"] == "ValidationException":
                 raise ValueError(f"Invalid update: {str(e)}")
+            elif e.response["Error"]["Code"] == "ConditionalCheckFailedException":
+                raise ItemNotFoundError(f"Item not found or is not of type {model_type.__name__}")
             raise
 
     async def _upload_to_s3(self, data: IO[bytes], name: str, filename: str, content_type: str) -> None:
diff --git a/store/app/crud/teleop.py b/store/app/crud/teleop.py
new file mode 100644
index 00000000..1770bbe1
--- /dev/null
+++ b/store/app/crud/teleop.py
@@ -0,0 +1,29 @@
+"""This module provides CRUD operations for teleoperation."""
+
+from boto3.dynamodb.conditions import Key
+
+from store.app.crud.base import BaseCrud
+from store.app.model import TeleopICECandidate
+
+
+class TeleopCrud(BaseCrud):
+    """CRUD operations for teleoperation."""
+
+    @classmethod
+    def get_gsis(cls) -> set[str]:
+        return super().get_gsis().union({"robot_id"})
+
+    async def store_ice_candidate(self, candidate: TeleopICECandidate) -> None:
+        await self._add_item(candidate, unique_fields=["user_id", "robot_id"])
+
+    async def get_ice_candidates(self, user_id: str, robot_id: str, limit: int = 1) -> list[TeleopICECandidate]:
+        return await self._get_items_from_secondary_index(
+            "user_id",
+            user_id,
+            TeleopICECandidate,
+            additional_filter_expression=Key("robot_id").eq(robot_id),
+            limit=limit,
+        )
+
+    async def delete_ice_candidate(self, candidate: TeleopICECandidate) -> None:
+        await self._delete_item(candidate)
diff --git a/store/app/db.py b/store/app/db.py
index 325c8cd5..66079198 100644
--- a/store/app/db.py
+++ b/store/app/db.py
@@ -13,6 +13,7 @@
 from store.app.crud.onshape import OnshapeCrud
 from store.app.crud.orders import OrdersCrud
 from store.app.crud.robots import RobotsCrud
+from store.app.crud.teleop import TeleopCrud
 from store.app.crud.users import UserCrud
 
 
@@ -25,6 +26,7 @@ class Crud(
     KernelImagesCrud,
     OrdersCrud,
     RobotsCrud,
+    TeleopCrud,
     BaseCrud,
 ):
     """Composes the various CRUD classes into a single class."""
diff --git a/store/app/main.py b/store/app/main.py
index 23105945..0a9c0d11 100644
--- a/store/app/main.py
+++ b/store/app/main.py
@@ -2,6 +2,7 @@
 
 import logging
 from contextlib import asynccontextmanager
+from pathlib import Path
 from typing import AsyncGenerator
 
 import uvicorn
@@ -21,8 +22,7 @@
     NotAuthorizedError,
 )
 from store.app.routers.artifacts import artifacts_router
-from store.app.routers.authenticate import auth_router
-from store.app.routers.email import email_router
+from store.app.routers.auth import router
 from store.app.routers.kernel_images import kernel_images_router
 from store.app.routers.keys import keys_router
 from store.app.routers.listings import listings_router
@@ -30,6 +30,7 @@
 from store.app.routers.orders import orders_router
 from store.app.routers.robots import robots_router
 from store.app.routers.stripe import stripe_router
+from store.app.routers.teleop import teleop_router
 from store.app.routers.users import users_router
 from store.utils import get_cors_origins
 
@@ -133,20 +134,20 @@ async def get_open_api_endpoint() -> JSONResponse:
     # Define paths that don't require authorization
     unsecured_paths = {
         "/",
-        "/auth/login",
-        "/auth/logout",
-        "/auth/google/client-id",
+        "/auth/api/logout",
+        "/auth/email/login",
+        "/auth/email/signup",
+        "/auth/email/signup/create",
+        "/auth/email/signup/delete/{id}",
+        "/auth/email/signup/get/{id}",
         "/auth/github/client-id",
-        "/auth/google/login",
         "/auth/github/code",
-        "/auth/signup",
-        "/listings/search",
-        "/listings/dump",
-        "/listings/{id}",
+        "/auth/google/client-id",
+        "/auth/google/login",
         "/kernel-images/public",
-        "/email/signup/create",
-        "/email/signup/get/{id}",
-        "/email/signup/delete/{id}",
+        "/listings/{id}",
+        "/listings/dump",
+        "/listings/search",
     }
 
     # Set default security for all paths
@@ -170,79 +171,8 @@ async def get_documentation() -> HTMLResponse:
 
 @app.get("/docs/oauth2-redirect", include_in_schema=False)
 async def get_oauth2_redirect() -> str:
-    return """
-    <!DOCTYPE html>
-    <html lang="en-US">
-    <body onload="run()">
-    <script>
-        'use strict';
-        function run () {
-            var oauth2 = window.opener.swaggerUIRedirectOauth2;
-            var sentState = oauth2.state;
-            var redirectUrl = oauth2.redirectUrl;
-            var isValid, qp, arr;
-
-            if (/code|token|error/.test(window.location.hash)) {
-                qp = window.location.hash.substring(1);
-            } else {
-                qp = location.search.substring(1);
-            }
-
-            arr = qp.split("&");
-            arr.forEach(function (v,i,_arr) { _arr[i] = '"' + v.replace('=', '":"') + '"';});
-            qp = qp ? JSON.parse('{' + arr.join() + '}',
-                    function (key, value) {
-                        return key === "" ? value : decodeURIComponent(value);
-                    }
-            ) : {};
-
-            isValid = qp.state === sentState;
-
-            if ((
-              oauth2.auth.schema.get("flow") === "accessCode" ||
-              oauth2.auth.schema.get("flow") === "authorizationCode" ||
-              oauth2.auth.schema.get("type") === "oauth2") && !oauth2.auth.code) {
-                if (!isValid) {
-                    oauth2.errCb({
-                        authId: oauth2.auth.name,
-                        source: "auth",
-                        level: "warning",
-                        message: "Authorization may be unsafe, passed state was changed in server. " +
-                                "The passed state wasn't returned from auth server."
-                    });
-                }
-
-                if (qp.code) {
-                    delete oauth2.state;
-                    oauth2.auth.code = qp.code;
-                    oauth2.callback({auth: oauth2.auth, redirectUrl: redirectUrl});
-                } else {
-                    let oauthErrorMsg;
-                    if (qp.error) {
-                        oauthErrorMsg = "["+qp.error+"]: " +
-                            (qp.error_description
-                                ? qp.error_description + ". "
-                                : "no accessCode received from the server. "
-                            ) +
-                            (qp.error_uri ? "More info: "+qp.error_uri : "");
-                    }
-
-                    oauth2.errCb({
-                        authId: oauth2.auth.name,
-                        source: "auth",
-                        level: "error",
-                        message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server."
-                    });
-                }
-            } else {
-                oauth2.callback({auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl});
-            }
-            window.close();
-        }
-    </script>
-    </body>
-    </html>
-    """
+    template_path = Path(__file__).parent / "templates" / "oauth2_redirect.html"
+    return template_path.read_text()
 
 
 async def validate_auth_token(auth_token: str = Depends(api_key_header)) -> str:
@@ -251,9 +181,8 @@ async def validate_auth_token(auth_token: str = Depends(api_key_header)) -> str:
     return auth_token
 
 
-app.include_router(auth_router, prefix="/auth", tags=["auth"])
+app.include_router(router, prefix="/auth", tags=["auth"])
 app.include_router(artifacts_router, prefix="/artifacts", tags=["artifacts"])
-app.include_router(email_router, prefix="/email", tags=["email"])
 app.include_router(kernel_images_router, prefix="/kernel-images", tags=["kernel-images"])
 app.include_router(keys_router, prefix="/keys", tags=["keys"])
 app.include_router(listings_router, prefix="/listings", tags=["listings"])
@@ -262,6 +191,7 @@ async def validate_auth_token(auth_token: str = Depends(api_key_header)) -> str:
 app.include_router(robots_router, prefix="/robots", tags=["robots"])
 app.include_router(stripe_router, prefix="/stripe", tags=["stripe"])
 app.include_router(users_router, prefix="/users", tags=["users"])
+app.include_router(teleop_router, prefix="/teleop", tags=["teleop"])
 
 
 # For running with debugger
diff --git a/store/app/model.py b/store/app/model.py
index cff7fc38..b09bd5cf 100644
--- a/store/app/model.py
+++ b/store/app/model.py
@@ -697,8 +697,30 @@ def create(
         )
 
 
-class FeaturedListings(BaseModel):
-    id: str = "featured_listings"
-    type: str = "featured_listings"
-    listing_ids: list[str]
-    updated_at: int
+class TeleopICECandidate(StoreBaseModel):
+    """Tracks ICE candidates for teleoperation."""
+
+    user_id: str
+    robot_id: str
+    candidate: str
+    created_at: int
+    ttl: int | None = None
+
+    @classmethod
+    def create(
+        cls,
+        user_id: str,
+        robot_id: str,
+        candidate: str,
+        expire_after_n_hours: int = 24,
+    ) -> Self:
+        now = int(time.time())
+        ttl_timestamp = int((datetime.utcnow() + timedelta(hours=expire_after_n_hours)).timestamp())
+        return cls(
+            id=new_uuid(),
+            user_id=user_id,
+            robot_id=robot_id,
+            candidate=candidate,
+            created_at=now,
+            ttl=ttl_timestamp,
+        )
diff --git a/store/app/routers/artifacts.py b/store/app/routers/artifacts.py
index f5b503ae..c00164e8 100644
--- a/store/app/routers/artifacts.py
+++ b/store/app/routers/artifacts.py
@@ -24,10 +24,7 @@
     get_artifact_url,
     get_artifact_urls,
 )
-from store.app.routers.users import (
-    get_session_user_with_write_permission,
-    maybe_get_user_from_api_key,
-)
+from store.app.security.user import get_session_user_with_write_permission, maybe_get_user_from_api_key
 from store.settings import settings
 
 artifacts_router = APIRouter()
diff --git a/store/app/routers/auth/__init__.py b/store/app/routers/auth/__init__.py
index e69de29b..83a74667 100644
--- a/store/app/routers/auth/__init__.py
+++ b/store/app/routers/auth/__init__.py
@@ -0,0 +1,15 @@
+"""Defines the authentication endpoints for the API."""
+
+from fastapi import APIRouter
+
+from store.app.routers.auth.api import router as api_router
+from store.app.routers.auth.email import router as email_router
+from store.app.routers.auth.github import router as github_router
+from store.app.routers.auth.google import router as google_router
+
+router = APIRouter()
+
+router.include_router(api_router, prefix="/api")
+router.include_router(github_router, prefix="/github")
+router.include_router(google_router, prefix="/google")
+router.include_router(email_router, prefix="/email")
diff --git a/store/app/routers/auth/api.py b/store/app/routers/auth/api.py
new file mode 100644
index 00000000..4a9c08d2
--- /dev/null
+++ b/store/app/routers/auth/api.py
@@ -0,0 +1,19 @@
+"""Defines authentication endpoints for API-related activities."""
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends
+
+from store.app.db import Crud
+from store.app.security.requests import get_request_api_key_id
+
+router = APIRouter()
+
+
+@router.delete("/logout")
+async def logout_user_endpoint(
+    token: Annotated[str, Depends(get_request_api_key_id)],
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> bool:
+    await crud.delete_api_key(token)
+    return True
diff --git a/store/app/routers/authenticate.py b/store/app/routers/auth/email.py
similarity index 56%
rename from store/app/routers/authenticate.py
rename to store/app/routers/auth/email.py
index bbde3963..a723f024 100644
--- a/store/app/routers/authenticate.py
+++ b/store/app/routers/auth/email.py
@@ -1,54 +1,76 @@
-"""This module defines the FastAPI routes for authentication related API routes."""
+"""Defines the authentication endpoints for email-based authentication."""
 
-from typing import Annotated, Literal, Mapping, Self, overload
+from typing import Annotated, Self
 
-from fastapi import APIRouter, Depends, HTTPException, Request, status
-from pydantic import BaseModel, EmailStr
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from pydantic.networks import EmailStr
 
 from store.app.crud.users import UserCrud
 from store.app.db import Crud
 from store.app.model import APIKeySource, User
-from store.app.routers.auth.github import github_auth_router
-from store.app.routers.auth.google import google_auth_router
+from store.app.utils.email import send_signup_email
 from store.app.utils.password import verify_password
 
-auth_router = APIRouter()
+router = APIRouter()
 
+# Make a specific sub-router for the signup-related endpoints.
+signup_router = APIRouter()
 
-@overload
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[True]) -> str: ...
 
+class EmailSignUpRequest(BaseModel):
+    email: EmailStr
+
+
+class EmailSignUpResponse(BaseModel):
+    message: str
 
-@overload
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[False]) -> str | None: ...
 
+@signup_router.post("/create", response_model=EmailSignUpResponse)
+async def create_signup_token(
+    data: EmailSignUpRequest,
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> EmailSignUpResponse:
+    """Creates a signup token and emails it to the user."""
+    try:
+        signup_token = await crud.create_email_signup_token(data.email)
+        await send_signup_email(email=data.email, token=signup_token.id)
+
+        return EmailSignUpResponse(message="Sign up email sent! Follow the link sent to you to continue registration.")
+    except Exception as e:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
 
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: bool) -> str | None:
-    authorization = headers.get("Authorization") or headers.get("authorization")
-    if not authorization:
-        if require_header:
-            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
-        return None
 
-    # Check if the authorization header starts with "Bearer "
-    if authorization.startswith("Bearer "):
-        credentials = authorization[7:]  # Remove "Bearer " prefix
-    else:
-        # If "Bearer " is missing, assume the entire header is the token
-        credentials = authorization
+class GetTokenResponse(BaseModel):
+    id: str
+    email: str
 
-    if not credentials:
-        raise HTTPException(status_code=status.HTTP_406_NOT_ACCEPTABLE, detail="Authorization header is invalid")
 
-    return credentials
+@signup_router.get("/get/{id}", response_model=GetTokenResponse)
+async def get_signup_token(
+    id: str,
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> GetTokenResponse:
+    signup_token = await crud.get_email_signup_token(id)
+    if not signup_token:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Token not found.")
+    return GetTokenResponse(id=signup_token.id, email=signup_token.email)
 
 
-async def get_request_api_key_id(request: Request) -> str:
-    return await get_api_key_from_header(request.headers, True)
+class DeleteTokenResponse(BaseModel):
+    message: str
 
 
-async def maybe_get_request_api_key_id(request: Request) -> str | None:
-    return await get_api_key_from_header(request.headers, False)
+@signup_router.delete("/delete/{id}", response_model=DeleteTokenResponse)
+async def delete_signup_token(
+    id: str,
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> DeleteTokenResponse:
+    await crud.delete_email_signup_token(id)
+    return DeleteTokenResponse(message="Token deleted successfully.")
+
+
+router.include_router(signup_router, prefix="/signup")
 
 
 class UserSignup(BaseModel):
@@ -73,17 +95,7 @@ class UsersInfoResponse(BaseModel):
     users: list[UserInfoResponseItem]
 
 
-class LoginRequest(BaseModel):
-    email: EmailStr
-    password: str
-
-
-class LoginResponse(BaseModel):
-    user_id: str
-    token: str
-
-
-@auth_router.post("/signup", response_model=UserInfoResponseItem)
+@router.post("/signup", response_model=UserInfoResponseItem)
 async def register_user(data: UserSignup, crud: Annotated[Crud, Depends(Crud.get)]) -> UserInfoResponseItem:
     signup_token = await crud.get_email_signup_token(data.signup_token_id)
     if not signup_token:
@@ -96,7 +108,17 @@ async def register_user(data: UserSignup, crud: Annotated[Crud, Depends(Crud.get
     return UserInfoResponseItem(id=user.id, email=user.email)
 
 
-@auth_router.post("/login", response_model=LoginResponse)
+class LoginRequest(BaseModel):
+    email: EmailStr
+    password: str
+
+
+class LoginResponse(BaseModel):
+    user_id: str
+    token: str
+
+
+@router.post("/login", response_model=LoginResponse)
 async def login_user(data: LoginRequest, user_crud: UserCrud = Depends()) -> LoginResponse:
     async with user_crud:
         # Fetch user by email
@@ -124,16 +146,3 @@ async def login_user(data: LoginRequest, user_crud: UserCrud = Depends()) -> Log
         )
 
         return LoginResponse(user_id=user.id, token=api_key.id)
-
-
-auth_router.include_router(github_auth_router, prefix="/github")
-auth_router.include_router(google_auth_router, prefix="/google")
-
-
-@auth_router.delete("/logout")
-async def logout_user_endpoint(
-    token: Annotated[str, Depends(get_request_api_key_id)],
-    crud: Annotated[Crud, Depends(Crud.get)],
-) -> bool:
-    await crud.delete_api_key(token)
-    return True
diff --git a/store/app/routers/auth/github.py b/store/app/routers/auth/github.py
index 4df01c1c..a7d7f585 100644
--- a/store/app/routers/auth/github.py
+++ b/store/app/routers/auth/github.py
@@ -12,14 +12,14 @@
 
 logger = logging.getLogger(__name__)
 
-github_auth_router = APIRouter()
+router = APIRouter()
 
 
 class ClientIdResponse(BaseModel):
     client_id: str
 
 
-@github_auth_router.get("/client-id", response_model=ClientIdResponse)
+@router.get("/client-id", response_model=ClientIdResponse)
 async def github_client_id_endpoint() -> ClientIdResponse:
     return ClientIdResponse(client_id=settings.oauth.github_client_id)
 
@@ -51,7 +51,7 @@ class GithubAuthResponse(BaseModel):
     api_key: str
 
 
-@github_auth_router.post("/code", response_model=GithubAuthResponse)
+@router.post("/code", response_model=GithubAuthResponse)
 async def github_code(
     data: GithubAuthRequest,
     crud: Annotated[Crud, Depends(Crud.get)],
diff --git a/store/app/routers/auth/google.py b/store/app/routers/auth/google.py
index c02adc53..e74e408e 100644
--- a/store/app/routers/auth/google.py
+++ b/store/app/routers/auth/google.py
@@ -12,7 +12,7 @@
 
 logger = logging.getLogger(__name__)
 
-google_auth_router = APIRouter()
+router = APIRouter()
 
 
 class GoogleLogin(BaseModel):
@@ -35,7 +35,7 @@ class ClientIdResponse(BaseModel):
     client_id: str
 
 
-@google_auth_router.get("/client-id", response_model=ClientIdResponse)
+@router.get("/client-id", response_model=ClientIdResponse)
 async def google_client_id_endpoint() -> ClientIdResponse:
     return ClientIdResponse(client_id=settings.oauth.google_client_id)
 
@@ -44,7 +44,7 @@ class AuthResponse(BaseModel):
     api_key: str
 
 
-@google_auth_router.post("/login", response_model=AuthResponse)
+@router.post("/login", response_model=AuthResponse)
 async def google_login_endpoint(
     data: GoogleLogin,
     crud: Annotated[Crud, Depends(Crud.get)],
diff --git a/store/app/routers/email.py b/store/app/routers/email.py
deleted file mode 100644
index 2a3b06c9..00000000
--- a/store/app/routers/email.py
+++ /dev/null
@@ -1,68 +0,0 @@
-"""This module defines the FastAPI routes for managing email related API routes."""
-
-from typing import Annotated
-
-from fastapi import APIRouter, Depends, HTTPException, status
-from pydantic.main import BaseModel
-from pydantic.networks import EmailStr
-
-from store.app.db import Crud
-from store.app.utils.email import send_signup_email
-
-signup_router = APIRouter()
-
-
-class EmailSignUpRequest(BaseModel):
-    email: EmailStr
-
-
-class EmailSignUpResponse(BaseModel):
-    message: str
-
-
-@signup_router.post("/create", response_model=EmailSignUpResponse)
-async def create_signup_token(
-    data: EmailSignUpRequest,
-    crud: Annotated[Crud, Depends(Crud.get)],
-) -> EmailSignUpResponse:
-    """Creates a signup token and emails it to the user."""
-    try:
-        signup_token = await crud.create_email_signup_token(data.email)
-        await send_signup_email(email=data.email, token=signup_token.id)
-
-        return EmailSignUpResponse(message="Sign up email sent! Follow the link sent to you to continue registration.")
-    except Exception as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=str(e))
-
-
-class GetTokenResponse(BaseModel):
-    id: str
-    email: str
-
-
-class DeleteTokenResponse(BaseModel):
-    message: str
-
-
-@signup_router.get("/get/{id}", response_model=GetTokenResponse)
-async def get_signup_token(
-    id: str,
-    crud: Annotated[Crud, Depends(Crud.get)],
-) -> GetTokenResponse:
-    signup_token = await crud.get_email_signup_token(id)
-    if not signup_token:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Token not found.")
-    return GetTokenResponse(id=signup_token.id, email=signup_token.email)
-
-
-@signup_router.delete("/delete/{id}", response_model=DeleteTokenResponse)
-async def delete_signup_token(
-    id: str,
-    crud: Annotated[Crud, Depends(Crud.get)],
-) -> DeleteTokenResponse:
-    await crud.delete_email_signup_token(id)
-    return DeleteTokenResponse(message="Token deleted successfully.")
-
-
-email_router = APIRouter()
-email_router.include_router(signup_router, prefix="/signup", tags=["signup"])
diff --git a/store/app/routers/kernel_images.py b/store/app/routers/kernel_images.py
index 33ff2e26..885438f1 100644
--- a/store/app/routers/kernel_images.py
+++ b/store/app/routers/kernel_images.py
@@ -11,7 +11,7 @@
 
 from store.app.db import Crud
 from store.app.model import User
-from store.app.routers.users import (
+from store.app.security.user import (
     get_session_user_with_read_permission,
     get_session_user_with_write_permission,
     maybe_get_user_from_api_key,
diff --git a/store/app/routers/keys.py b/store/app/routers/keys.py
index 83039f0f..ec8777ae 100644
--- a/store/app/routers/keys.py
+++ b/store/app/routers/keys.py
@@ -8,7 +8,7 @@
 
 from store.app.db import Crud
 from store.app.model import APIKeyPermission, User
-from store.app.routers.users import get_session_user_with_admin_permission
+from store.app.security.user import get_session_user_with_admin_permission
 
 logger = logging.getLogger(__name__)
 
diff --git a/store/app/routers/listings.py b/store/app/routers/listings.py
index fbafcb68..bc28aa78 100644
--- a/store/app/routers/listings.py
+++ b/store/app/routers/listings.py
@@ -20,7 +20,7 @@
 from store.app.db import Crud
 from store.app.model import Listing, User, can_write_listing
 from store.app.routers.artifacts import SingleArtifactResponse
-from store.app.routers.users import (
+from store.app.security.user import (
     get_session_user_with_read_permission,
     get_session_user_with_write_permission,
     maybe_get_user_from_api_key,
diff --git a/store/app/routers/onshape.py b/store/app/routers/onshape.py
index bbcb04ef..6f8031d4 100644
--- a/store/app/routers/onshape.py
+++ b/store/app/routers/onshape.py
@@ -11,7 +11,7 @@
 
 from store.app.db import Crud
 from store.app.model import User, can_write_listing
-from store.app.routers.users import get_session_user_with_write_permission
+from store.app.security.user import get_session_user_with_write_permission
 
 onshape_router = APIRouter()
 
diff --git a/store/app/routers/orders.py b/store/app/routers/orders.py
index f1684a96..c55362de 100644
--- a/store/app/routers/orders.py
+++ b/store/app/routers/orders.py
@@ -40,7 +40,9 @@ async def get_user_orders(
 
 @orders_router.get("/order/{order_id}", response_model=Order)
 async def get_order(
-    order_id: str, user: User = Depends(get_session_user_with_read_permission), crud: Crud = Depends(Crud.get)
+    order_id: str,
+    user: User = Depends(get_session_user_with_read_permission),
+    crud: Crud = Depends(Crud.get),
 ) -> Order:
     order = await crud.get_order(order_id)
     if order is None or order.user_id != user.id:
@@ -50,7 +52,9 @@ async def get_order(
 
 @orders_router.get("/order-with-product/{order_id}", response_model=OrderWithProduct)
 async def get_order_with_product(
-    order_id: str, user: User = Depends(get_session_user_with_read_permission), crud: Crud = Depends(Crud.get)
+    order_id: str,
+    user: User = Depends(get_session_user_with_read_permission),
+    crud: Crud = Depends(Crud.get),
 ) -> OrderWithProduct:
     order = await crud.get_order(order_id)
     if order is None or order.user_id != user.id:
@@ -65,7 +69,8 @@ async def get_order_with_product(
 
 @orders_router.get("/user-orders-with-products", response_model=List[OrderWithProduct])
 async def get_user_orders_with_products(
-    user: User = Depends(get_session_user_with_read_permission), crud: Crud = Depends(Crud.get)
+    user: User = Depends(get_session_user_with_read_permission),
+    crud: Crud = Depends(Crud.get),
 ) -> List[OrderWithProduct]:
     try:
         orders = await crud.get_orders_by_user_id(user.id)
diff --git a/store/app/routers/robots.py b/store/app/routers/robots.py
index 4a29c8ec..173009af 100644
--- a/store/app/routers/robots.py
+++ b/store/app/routers/robots.py
@@ -12,7 +12,7 @@
 from store.app.crud.base import ItemNotFoundError
 from store.app.db import Crud
 from store.app.model import Listing, Robot, User, get_artifact_url
-from store.app.routers.users import (
+from store.app.security.user import (
     get_session_user_with_read_permission,
     get_session_user_with_write_permission,
 )
diff --git a/store/app/routers/stripe.py b/store/app/routers/stripe.py
index c0e28a6d..0b87d08b 100644
--- a/store/app/routers/stripe.py
+++ b/store/app/routers/stripe.py
@@ -10,7 +10,7 @@
 
 from store.app.db import Crud
 from store.app.model import Order, User
-from store.app.routers.users import get_session_user_with_read_permission
+from store.app.security.user import get_session_user_with_read_permission
 from store.settings import settings
 
 logger = logging.getLogger(__name__)
diff --git a/store/app/routers/teleop/__init__.py b/store/app/routers/teleop/__init__.py
new file mode 100644
index 00000000..217eb297
--- /dev/null
+++ b/store/app/routers/teleop/__init__.py
@@ -0,0 +1,9 @@
+"""Defines the teleoperation endpoints for the API."""
+
+from fastapi import APIRouter
+
+from store.app.routers.teleop.webrtc import router as webrtc_router
+
+teleop_router = APIRouter()
+
+teleop_router.include_router(webrtc_router, prefix="/rtc")
diff --git a/store/app/routers/teleop/webrtc.py b/store/app/routers/teleop/webrtc.py
new file mode 100644
index 00000000..335781d8
--- /dev/null
+++ b/store/app/routers/teleop/webrtc.py
@@ -0,0 +1,77 @@
+# ruff: noqa: N815
+"""Defines the router endpoints for teleoperation."""
+
+import asyncio
+import time
+from typing import Annotated, AsyncIterable
+
+from fastapi import APIRouter, Depends, WebSocket, WebSocketDisconnect
+from fastapi.responses import StreamingResponse
+
+from store.app.db import Crud
+from store.app.model import TeleopICECandidate, User
+from store.app.security.user import get_session_user_with_write_permission
+
+router = APIRouter()
+
+MAX_ICE_CANDIDATES = 1
+
+
+async def ice_candidates_generator(
+    user_id: str,
+    robot_id: str,
+    crud: Crud,
+    max_candidates: int = MAX_ICE_CANDIDATES,
+) -> AsyncIterable[str]:
+    num_candidates = 0
+    prev_time = time.time()
+    while True:
+        ice_candidates = await crud.get_ice_candidates(user_id, robot_id)
+        for candidate in ice_candidates:
+            yield candidate.candidate
+            num_candidates += 1
+            if num_candidates >= max_candidates:
+                break
+
+        # Sleep until the next second.
+        next_time = time.time()
+        await asyncio.sleep(1 - (next_time - prev_time))
+        prev_time = next_time
+
+
+@router.post("/store")
+async def store_ice_candidate(
+    candidate: str,
+    robot_id: str,
+    user: Annotated[User, Depends(get_session_user_with_write_permission)],
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> None:
+    await crud.store_ice_candidate(TeleopICECandidate.create(user.id, robot_id, candidate))
+
+
+@router.websocket("/ws/ice-candidates")
+async def websocket_ice_candidates(
+    websocket: WebSocket,
+    robot_id: str,
+    user: Annotated[User, Depends(get_session_user_with_write_permission)],
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> None:
+    """Defines the WebSocket endpoint for ICE candidates."""
+    try:
+        async for candidate in ice_candidates_generator(user.id, robot_id, crud):
+            await websocket.send_text(candidate)
+    except WebSocketDisconnect:
+        pass
+
+
+@router.get("/poll/ice-candidates")
+async def poll_ice_candidates(
+    robot_id: str,
+    user: Annotated[User, Depends(get_session_user_with_write_permission)],
+    crud: Annotated[Crud, Depends(Crud.get)],
+) -> StreamingResponse:
+    """Defines the polling endpoint for ICE candidates."""
+    return StreamingResponse(
+        content=ice_candidates_generator(user.id, robot_id, crud),
+        media_type="text/event-stream",
+    )
diff --git a/store/app/routers/users.py b/store/app/routers/users.py
index 5f7cb94d..a9513563 100644
--- a/store/app/routers/users.py
+++ b/store/app/routers/users.py
@@ -2,15 +2,21 @@
 
 import logging
 from email.utils import parseaddr as parse_email_address
-from typing import Annotated, Literal, Mapping, Self, overload
+from typing import Annotated, Self
 
-from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
+from fastapi import APIRouter, Depends, HTTPException, Query, status
 from pydantic.main import BaseModel
 from pydantic.networks import EmailStr
 
 from store.app.db import Crud
-from store.app.errors import ItemNotFoundError, NotAuthenticatedError
+from store.app.errors import ItemNotFoundError
 from store.app.model import User, UserPermission, UserPublic
+from store.app.security.requests import get_request_api_key_id
+from store.app.security.user import (
+    get_session_user_with_admin_permission,
+    get_session_user_with_read_permission,
+    get_session_user_with_write_permission,
+)
 from store.app.utils.email import send_delete_email
 
 logger = logging.getLogger(__name__)
@@ -20,88 +26,6 @@
 TOKEN_TYPE = "Bearer"
 
 
-@overload
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[True]) -> str: ...
-
-
-@overload
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[False]) -> str | None: ...
-
-
-async def get_api_key_from_header(headers: Mapping[str, str], require_header: bool) -> str | None:
-    authorization = headers.get("Authorization") or headers.get("authorization")
-    logger.debug(f"Received authorization header: {authorization}")
-    if not authorization:
-        if require_header:
-            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
-        return None
-
-    # Check if the authorization header starts with "Bearer "
-    if authorization.startswith("Bearer "):
-        credentials = authorization[7:]  # Remove "Bearer " prefix
-    else:
-        # If "Bearer " is missing, assume the entire header is the token
-        credentials = authorization
-
-    if not credentials:
-        raise HTTPException(status_code=status.HTTP_406_NOT_ACCEPTABLE, detail="Authorization header is invalid")
-
-    return credentials
-
-
-async def get_request_api_key_id(request: Request) -> str:
-    return await get_api_key_from_header(request.headers, True)
-
-
-async def maybe_get_request_api_key_id(request: Request) -> str | None:
-    return await get_api_key_from_header(request.headers, False)
-
-
-async def get_session_user_with_permission(
-    permission: str,
-    crud: Crud,
-    api_key_id: str,
-) -> User:
-    try:
-        api_key = await crud.get_api_key(api_key_id)
-        if api_key.permissions is None or permission not in api_key.permissions:
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Permission denied")
-        return await crud.get_user(api_key.user_id, throw_if_missing=True)
-    except ItemNotFoundError:
-        raise NotAuthenticatedError("Not authenticated")
-
-
-async def get_session_user_with_read_permission(
-    crud: Annotated[Crud, Depends(Crud.get)],
-    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
-) -> User:
-    return await get_session_user_with_permission("read", crud, api_key_id)
-
-
-async def get_session_user_with_write_permission(
-    crud: Annotated[Crud, Depends(Crud.get)],
-    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
-) -> User:
-    return await get_session_user_with_permission("write", crud, api_key_id)
-
-
-async def get_session_user_with_admin_permission(
-    crud: Annotated[Crud, Depends(Crud.get)],
-    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
-) -> User:
-    return await get_session_user_with_permission("admin", crud, api_key_id)
-
-
-async def maybe_get_user_from_api_key(
-    crud: Annotated[Crud, Depends(Crud.get)],
-    api_key_id: Annotated[str | None, Depends(maybe_get_request_api_key_id)],
-) -> User | None:
-    if api_key_id is None:
-        return None
-    api_key = await crud.get_api_key(api_key_id)
-    return await crud.get_user(api_key.user_id, throw_if_missing=False)
-
-
 def validate_email(email: str) -> str:
     try:
         email = parse_email_address(email)[1]
diff --git a/store/app/security/__init__.py b/store/app/security/__init__.py
new file mode 100644
index 00000000..e69de29b
diff --git a/store/app/security/requests.py b/store/app/security/requests.py
new file mode 100644
index 00000000..28076969
--- /dev/null
+++ b/store/app/security/requests.py
@@ -0,0 +1,45 @@
+"""Defines utilities for handling requests."""
+
+import logging
+from typing import Literal, Mapping, overload
+
+from fastapi import HTTPException, Request, status
+
+logger = logging.getLogger(__name__)
+
+
+@overload
+async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[True]) -> str: ...
+
+
+@overload
+async def get_api_key_from_header(headers: Mapping[str, str], require_header: Literal[False]) -> str | None: ...
+
+
+async def get_api_key_from_header(headers: Mapping[str, str], require_header: bool) -> str | None:
+    authorization = headers.get("Authorization") or headers.get("authorization")
+    logger.debug(f"Received authorization header: {authorization}")
+    if not authorization:
+        if require_header:
+            raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+        return None
+
+    # Check if the authorization header starts with "Bearer "
+    if authorization.startswith("Bearer "):
+        credentials = authorization[7:]  # Remove "Bearer " prefix
+    else:
+        # If "Bearer " is missing, assume the entire header is the token
+        credentials = authorization
+
+    if not credentials:
+        raise HTTPException(status_code=status.HTTP_406_NOT_ACCEPTABLE, detail="Authorization header is invalid")
+
+    return credentials
+
+
+async def get_request_api_key_id(request: Request) -> str:
+    return await get_api_key_from_header(request.headers, True)
+
+
+async def maybe_get_request_api_key_id(request: Request) -> str | None:
+    return await get_api_key_from_header(request.headers, False)
diff --git a/store/app/security/user.py b/store/app/security/user.py
new file mode 100644
index 00000000..333fcdb8
--- /dev/null
+++ b/store/app/security/user.py
@@ -0,0 +1,55 @@
+"""Defines security-related functions for authenticating users with given permissions."""
+
+from typing import Annotated
+
+from fastapi import Depends, HTTPException, status
+
+from store.app.db import Crud
+from store.app.errors import ItemNotFoundError, NotAuthenticatedError
+from store.app.model import User
+from store.app.security.requests import get_request_api_key_id, maybe_get_request_api_key_id
+
+
+async def get_session_user_with_permission(
+    permission: str,
+    crud: Crud,
+    api_key_id: str,
+) -> User:
+    try:
+        api_key = await crud.get_api_key(api_key_id)
+        if api_key.permissions is None or permission not in api_key.permissions:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Permission denied")
+        return await crud.get_user(api_key.user_id, throw_if_missing=True)
+    except ItemNotFoundError:
+        raise NotAuthenticatedError("Not authenticated")
+
+
+async def get_session_user_with_read_permission(
+    crud: Annotated[Crud, Depends(Crud.get)],
+    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
+) -> User:
+    return await get_session_user_with_permission("read", crud, api_key_id)
+
+
+async def get_session_user_with_write_permission(
+    crud: Annotated[Crud, Depends(Crud.get)],
+    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
+) -> User:
+    return await get_session_user_with_permission("write", crud, api_key_id)
+
+
+async def get_session_user_with_admin_permission(
+    crud: Annotated[Crud, Depends(Crud.get)],
+    api_key_id: Annotated[str, Depends(get_request_api_key_id)],
+) -> User:
+    return await get_session_user_with_permission("admin", crud, api_key_id)
+
+
+async def maybe_get_user_from_api_key(
+    crud: Annotated[Crud, Depends(Crud.get)],
+    api_key_id: Annotated[str | None, Depends(maybe_get_request_api_key_id)],
+) -> User | None:
+    if api_key_id is None:
+        return None
+    api_key = await crud.get_api_key(api_key_id)
+    return await crud.get_user(api_key.user_id, throw_if_missing=False)
diff --git a/store/app/templates/oauth2_redirect.html b/store/app/templates/oauth2_redirect.html
new file mode 100644
index 00000000..6239158d
--- /dev/null
+++ b/store/app/templates/oauth2_redirect.html
@@ -0,0 +1,73 @@
+<!DOCTYPE html>
+<html lang="en-US">
+
+<body onload="run()">
+  <script>
+    'use strict';
+    function run() {
+      var oauth2 = window.opener.swaggerUIRedirectOauth2;
+      var sentState = oauth2.state;
+      var redirectUrl = oauth2.redirectUrl;
+      var isValid, qp, arr;
+
+      if (/code|token|error/.test(window.location.hash)) {
+        qp = window.location.hash.substring(1);
+      } else {
+        qp = location.search.substring(1);
+      }
+
+      arr = qp.split("&");
+      arr.forEach(function (v, i, _arr) { _arr[i] = '"' + v.replace('=', '":"') + '"'; });
+      qp = qp ? JSON.parse('{' + arr.join() + '}',
+        function (key, value) {
+          return key === "" ? value : decodeURIComponent(value);
+        }
+      ) : {};
+
+      isValid = qp.state === sentState;
+
+      if ((
+        oauth2.auth.schema.get("flow") === "accessCode" ||
+        oauth2.auth.schema.get("flow") === "authorizationCode" ||
+        oauth2.auth.schema.get("type") === "oauth2") && !oauth2.auth.code) {
+        if (!isValid) {
+          oauth2.errCb({
+            authId: oauth2.auth.name,
+            source: "auth",
+            level: "warning",
+            message: "Authorization may be unsafe, passed state was changed in server. " +
+              "The passed state wasn't returned from auth server."
+          });
+        }
+
+        if (qp.code) {
+          delete oauth2.state;
+          oauth2.auth.code = qp.code;
+          oauth2.callback({ auth: oauth2.auth, redirectUrl: redirectUrl });
+        } else {
+          let oauthErrorMsg;
+          if (qp.error) {
+            oauthErrorMsg = "[" + qp.error + "]: " +
+              (qp.error_description
+                ? qp.error_description + ". "
+                : "no accessCode received from the server. "
+              ) +
+              (qp.error_uri ? "More info: " + qp.error_uri : "");
+          }
+
+          oauth2.errCb({
+            authId: oauth2.auth.name,
+            source: "auth",
+            level: "error",
+            message: oauthErrorMsg || "[Authorization failed]: no accessCode received from the server."
+          });
+        }
+      } else {
+        oauth2.callback({ auth: oauth2.auth, token: qp, isValid: isValid, redirectUrl: redirectUrl });
+      }
+      window.close();
+    }
+  </script>
+</body>
+
+</html>
diff --git a/tests/test_users.py b/tests/test_users.py
index 7c9d3413..623d1398 100644
--- a/tests/test_users.py
+++ b/tests/test_users.py
@@ -14,7 +14,7 @@ def test_user_auth_functions(test_client: TestClient) -> None:
     assert response.json()["detail"] == "Not authenticated"
 
     # Checks that we can't log the user out without the session token.
-    response = test_client.delete("/auth/logout")
+    response = test_client.delete("/auth/api/logout")
     assert response.status_code == status.HTTP_401_UNAUTHORIZED, response.json()
 
     # Because of the way we patched GitHub functions for mocking, it doesn't matter what token we pass in.
@@ -28,7 +28,7 @@ def test_user_auth_functions(test_client: TestClient) -> None:
     assert response.status_code == status.HTTP_200_OK, response.json()
 
     # Log the user out, which deletes the session token.
-    response = test_client.delete("/auth/logout", headers=auth_headers)
+    response = test_client.delete("/auth/api/logout", headers=auth_headers)
     assert response.status_code == status.HTTP_200_OK, response.json()
     assert response.json() is True