diff --git a/.lycheeignore b/.lycheeignore
index 76d4fe3..2821f58 100644
--- a/.lycheeignore
+++ b/.lycheeignore
@@ -15,6 +15,7 @@ https://your-domain/redirect.html
 # Localhost used in comments
 
 http://localhost:3000/
+http://localhost:4400/
 
 # POD OAuth endpoints that require authentication parameters
 
diff --git a/client-profile.jsonld b/client-profile.jsonld
index 815d336..8b017b7 100644
--- a/client-profile.jsonld
+++ b/client-profile.jsonld
@@ -1,17 +1,17 @@
 {
   "@context": "https://www.w3.org/ns/solid/oidc-context.jsonld",
-  "client_id": "https://solidcommunity.au/apps/geopod/client-profile.jsonld",
+  "client_id": "https://gjwgit.github.io/geopod/client-profile.jsonld",
   "client_name": "GeoPod",
   "application_type": "native",
   "redirect_uris": [
     "https://geopod.solidcommunity.au/redirect.html",
     "com.togaware.geopod://redirect",
-    "http://localhost:4400/redirect"
+    "http://localhost:4400/redirect.html"
   ],
   "post_logout_redirect_uris": [
     "https://geopod.solidcommunity.au/redirect.html",
     "com.togaware.geopod://redirect",
-    "http://localhost:4400/redirect"
+    "http://localhost:4400/redirect.html"
   ],
   "scope": "openid profile offline_access webid",
   "grant_types": [
diff --git a/lib/app.dart b/lib/app.dart
index 56439f2..59547e3 100644
--- a/lib/app.dart
+++ b/lib/app.dart
@@ -27,6 +27,7 @@ library;
 
 import 'dart:async';
 
+import 'package:flutter/foundation.dart' show kIsWeb;
 import 'package:flutter/material.dart';
 
 import 'package:solidpod/solidpod.dart' show registerLogoutCacheCallback;
@@ -70,12 +71,20 @@ class App extends StatelessWidget {
         'encrypted_data',
         'places',
       ],
-      clientId: 'https://solidcommunity.au/apps/geopod/client-profile.jsonld',
-      redirectUris: [
-        'https://geopod.solidcommunity.au/redirect.html',
-        'com.togaware.geopod://redirect',
-        'http://localhost:4400/redirect',
-      ],
+      clientId: 'https://gjwgit.github.io/geopod/client-profile.jsonld',
+      // On web the redirect must be same-origin as where the app is served,
+      // otherwise redirect.html's BroadcastChannel cannot hand the auth
+      // response back and login hangs on the spinner. solidpod's
+      // pickRedirectUri simply takes the first https:// entry (it does not
+      // match on origin), so we derive the web entry from Uri.base.origin:
+      // the deployed https host in production, and http://localhost:4400
+      // under `flutter run -d chrome --web-port=4400`.
+      redirectUris: kIsWeb
+          ? ['${Uri.base.origin}/redirect.html']
+          : const [
+              'com.togaware.geopod://redirect',
+              'http://localhost:4400/redirect.html',
+            ],
       child: appWithPreload,
     );
 
diff --git a/macos/Runner/DebugProfile.entitlements b/macos/Runner/DebugProfile.entitlements
index 159e5ed..1912118 100644
--- a/macos/Runner/DebugProfile.entitlements
+++ b/macos/Runner/DebugProfile.entitlements
@@ -10,12 +10,9 @@
 	<true/>
 	<key>com.apple.security.network.client</key>
 	<true/>
-	<!-- Note: keychain access entitlement is needed to use local secure storage and requires code signing app
 	<key>keychain-access-groups</key>
-	<array>
-		<string>$(AppIdentifierPrefix)com.togaware.geopod</string>
-	</array> -->
-	<key>keychain-access-groups</key>
-	</array>
+	<array/>
+	<key>com.apple.security.keychain</key>
+	<true/>
 </dict>
 </plist>
diff --git a/macos/Runner/Release.entitlements b/macos/Runner/Release.entitlements
index 64cabb4..1912118 100644
--- a/macos/Runner/Release.entitlements
+++ b/macos/Runner/Release.entitlements
@@ -4,9 +4,15 @@
 <dict>
 	<key>com.apple.security.app-sandbox</key>
 	<true/>
+	<key>com.apple.security.cs.allow-jit</key>
+	<true/>
 	<key>com.apple.security.network.server</key>
 	<true/>
 	<key>com.apple.security.network.client</key>
 	<true/>
+	<key>keychain-access-groups</key>
+	<array/>
+	<key>com.apple.security.keychain</key>
+	<true/>
 </dict>
 </plist>
diff --git a/pubspec.yaml b/pubspec.yaml
index d7cf3be..38a2a32 100644
--- a/pubspec.yaml
+++ b/pubspec.yaml
@@ -32,6 +32,7 @@ dependencies:
   intl: ^0.20.1
   latlong2: ^0.9.1
   markdown_tooltip: ^0.0.10
+  media_kit_libs_video: ^1.0.5
   path_provider: ^2.1.5
   pdf: ^3.11.1
   shared_preferences: ^2.3.3
diff --git a/web/callback.html b/web/callback.html
deleted file mode 100644
index b6dbc8f..0000000
--- a/web/callback.html
+++ /dev/null
@@ -1,39 +0,0 @@
-<!DOCTYPE html>
-<html>
-<head>
-  <meta charset="UTF-8">
-  <title>Authentication Callback</title>
-  <script>
-    // This script helps solid_auth handle the OAuth callback.
-    // It passes the authorization code back to the parent window
-    // and closes the popup if applicable.
-    const AUTH_DESTINATION_KEY = "openidconnect_auth_destination_url";
-    const AUTH_RESPONSE_KEY = "openidconnect_auth_response_info";
-    
-    window.onload = function () {
-      // Check if this is a popup window
-      if (window.opener && window.opener !== window) {
-        // Pass the full URL (including code) to the parent window
-        window.opener.postMessage(window.location.href, "*");
-        window.close();
-      } else {
-        // If not a popup, redirect to the main app with the code
-        // This handles the case where the browser doesn't support popups
-        const currentUrl = window.location.href;
-        if (currentUrl.includes('code=')) {
-          // Store the response info for the main window to pick up
-          localStorage.setItem(AUTH_RESPONSE_KEY, currentUrl);
-          // Redirect to the base URL (the main app will pick up the code)
-          window.location.href = window.location.origin + window.location.pathname.replace('/callback.html', '/');
-        }
-      }
-    }
-  </script>
-</head>
-<body>
-  <p>Authentication complete. You can close this window.</p>
-  <p>If this window does not close automatically, please close it manually.</p>
-</body>
-</html>
-
-