diff --git a/callback.html b/callback.html
index f99e43079..07cb873ff 100644
--- a/callback.html
+++ b/callback.html
@@ -1,5 +1,86 @@
 <html>
+  <head>
+    <meta http-equiv="Content-type" content="text/html;charset=UTF-8" />
+    <title>pyfa Authentication Proxy</title>
+    <style type="text/css">
+
+    
+      body { width: 600px; margin: 150px auto; }
+      h1 { font-size: 40px; }
+      h2 { font-size: 32px; }
+      body { font: 20px Helvetica, sans-serif; color: #333; }
+      #article { display: block; text-align: left; width: 650px; margin: 0 auto; }
+      .hidden { display:none; }
+      .success { color: #28a745; }
+      .error { color: #dc3545; }
+      textarea { width: 100%; height: 100px; }
+
+      @media (prefers-color-scheme: dark) {
+          body { background-color: #333; color: white; }
+          textarea { width: 100%; height: 100px; background-color: #aaa;}
+      }
+    </style>
+    
+  </head>
+
   <body>
-    <h1>Pure HTML</h1>
+    <!-- Layout from Short Circuit's CREST login. Shout out! https://github.com/farshield/shortcircuit -->
+      <h1>pyfa </h1>
+      <div id="mode0" class="hidden">
+        <p id="mode0-msg">Processing request...</p>
+      </div>
+      <div id="mode1" class="hidden">
+        <p>Please copy and paste the text below into pyfa.</p>
+        <textarea id="authCodeText" readonly></textarea>
+      </div>
+    </div>
+    <script>
+      function httpPostAsync(url, callback)
+      {
+          var xmlHttp = new XMLHttpRequest();
+          xmlHttp.onreadystatechange = function() { 
+              if (xmlHttp.readyState == XMLHttpRequest.DONE)
+                  callback(xmlHttp);
+          }
+          xmlHttp.open("GET", url, true); // true for asynchronous 
+          xmlHttp.send(null);
+      }
+
+      const urlSearchParams = new URLSearchParams(window.location.search);
+      const params = Object.fromEntries(urlSearchParams.entries());
+      let stateInfo;
+      try{
+        stateInfo = JSON.parse(atob(params.state))
+      } catch (err) {
+        // something has happened and we cannot continue.
+        // todo: show a simple message and exit.
+        throw err;
+      }
+
+      // determine which mode to show
+      var element = document.getElementById(`mode${stateInfo.mode}`);
+      element.classList.remove("hidden");
+      debugger;
+      if (stateInfo.mode == 0) { // auto / server mode 
+        httpPostAsync(stateInfo.redirect+window.location.search, (req)=>{
+          debugger;
+          const msgDiv = document.getElementById(`mode0-msg`);
+          if (req.status === 200) {
+            msgDiv.innerHTML ="<span class='success'>Success!</span> You may close this window and return to the application.";
+          } else if (req.status === 0){
+            msgDiv.innerHTML = "<span class='error'>Error!</span> Server response not received.<p><small>The local pyfa server may have timed out, or may not have started correctly.</small></p>";
+          } else if (req.status === 400){
+            msgDiv.innerHTML = `<span class='error'>Error!</span> <p><small>${req.responseText}</small></p>`
+          } else {
+            msgDiv.innerHTML = `<span class='error'>Error!</span> <p><small>There was an unknown error. Please report this to the pyfa issues page.</p><p><textarea readdonly>${req.responseText}</textarea></small></p>`
+          }
+          // todo: bad request error when it's not  an error itself, but rather
+        })
+        // todo: post message to local EVE server
+      } else if (stateInfo.mode == 1) { // manual copy / paste mode
+        document.getElementById(`authCodeText`).value = btoa(JSON.stringify(params))
+        // todo: display auth code and have usee enter into pyfa
+      }
+    </script>
   </body>
 </html>
