diff --git a/app/api/auto-login/route.ts b/app/api/auto-login/route.ts
new file mode 100644
index 0000000..68b5994
--- /dev/null
+++ b/app/api/auto-login/route.ts
@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createHmac } from "crypto";
+import { getSession } from "../../../lib/auth";
+import { getPlatformDb } from "../../../lib/platform-db";
+
+export async function GET(request: NextRequest) {
+  const session = await getSession();
+  if (!session) return NextResponse.redirect(new URL("/login", request.url));
+
+  const accountId = Number(request.nextUrl.searchParams.get("account_id"));
+  const slug = request.nextUrl.searchParams.get("slug");
+  if (!accountId || !slug) return NextResponse.redirect(new URL("/tenants", request.url));
+
+  const db = getPlatformDb();
+  const user = db
+    .prepare("SELECT id FROM users WHERE account_id = ? AND role = 'admin' LIMIT 1")
+    .get(accountId) as { id: number } | undefined;
+
+  if (!user) return NextResponse.redirect(new URL("/tenants?error=no-admin", request.url));
+
+  const secret = process.env.AUTO_LOGIN_SECRET!;
+  const expires = Date.now() + 60_000;
+  const payload = `${user.id}:${accountId}:${expires}`;
+  const sig = createHmac("sha256", secret).update(payload).digest("hex");
+  const token = encodeURIComponent(`${payload}:${sig}`);
+
+  return NextResponse.redirect(`https://${slug}.rikxplatform.nl/auto-login?token=${token}`);
+}
diff --git a/app/tenants/page.tsx b/app/tenants/page.tsx
index c7f70de..890daca 100644
--- a/app/tenants/page.tsx
+++ b/app/tenants/page.tsx
@@ -3,7 +3,6 @@ import { getSession } from "../../lib/auth";
 import { listAccounts } from "../../lib/platform-db";
 import { createTenant, deleteTenant } from "./actions";
 import { logout } from "./logout";
-import { autoLogin } from "./auto-login";
 
 export default async function TenantsPage({
   searchParams,
@@ -80,16 +79,14 @@ export default async function TenantsPage({
                         {new Date(a.created_at).toLocaleDateString("nl-NL")}
                       </td>
                       <td className="px-4 py-3 text-right">
-                        <form action={autoLogin}>
-                          <input type="hidden" name="account_id" value={a.id} />
-                          <input type="hidden" name="slug" value={a.slug} />
-                          <button
-                            type="submit"
-                            className="text-xs text-blue-600 hover:text-blue-800 dark:text-blue-400 dark:hover:text-blue-300 transition-colors"
-                          >
-                            Inloggen
-                          </button>
-                        </form>
+                        <a
+                          href={`/api/auto-login?account_id=${a.id}&slug=${a.slug}`}
+                          target="_blank"
+                          rel="noopener noreferrer"
+                          className="text-xs text-blue-600 hover:text-blue-800 dark:text-blue-400 dark:hover:text-blue-300 transition-colors"
+                        >
+                          Inloggen ↗
+                        </a>
                       </td>
                       <td className="px-4 py-3 text-right">
                         <form action={deleteTenant}>