diff --git a/backend/src/auth.js b/backend/src/auth.js
index 852129a..dca5704 100644
--- a/backend/src/auth.js
+++ b/backend/src/auth.js
@@ -1,36 +1,24 @@
-import { jwtVerify } from 'jose'
-import { isOnsite } from './ip-check.js'
-
 const APP_SLUG = process.env.APP_SLUG || 'noticeboard'
-const secret = new TextEncoder().encode(process.env.CENTRAL_AUTH_SECRET || '')
+const AUTH_URL = process.env.AUTH_URL || 'http://10.10.10.101:3001'
 
 export async function requireAuth(request, reply) {
-  const token = request.cookies?.hnf_session
-  if (!token) return reply.status(401).send({ error: 'Not authenticated' })
+  const cookie = request.headers.cookie || ''
+  if (!cookie) return reply.status(401).send({ error: 'Not authenticated' })
 
-  let payload
+  let res
   try {
-    const { payload: p } = await jwtVerify(token, secret)
-    payload = p
+    res = await fetch(`${AUTH_URL}/api/auth/verify?app=${APP_SLUG}`, {
+      headers: { cookie },
+      signal: AbortSignal.timeout(3000),
+    })
   } catch {
-    return reply.status(401).send({ error: 'Invalid session' })
+    return reply.status(503).send({ error: 'Auth service unavailable' })
   }
 
-  if (!payload.apps?.includes(APP_SLUG)) {
-    return reply.status(403).send({ error: 'No permission for this app' })
+  if (!res.ok) {
+    const body = await res.json().catch(() => ({}))
+    return reply.status(res.status).send(body)
   }
 
-  // Offsite check — only for users without offsite_allowed flag
-  if (!payload.offsite_allowed) {
-    const clientIP = request.headers['x-real-ip'] || request.ip
-    if (!(await isOnsite(clientIP))) {
-      return reply.status(403).send({ error: 'Access restricted to site network' })
-    }
-  }
-
-  request.user = {
-    email: payload.sub,
-    name: payload.name,
-    is_admin: payload.is_admin ?? false,
-  }
+  request.user = await res.json()
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index 7d9b91b..9308c46 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -8,6 +8,7 @@ services:
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
       - APP_SLUG=noticeboard
       - OFFICE_IP_CHECK=${OFFICE_IP_CHECK:-disabled}
+      - AUTH_URL=${AUTH_URL:-http://10.10.10.101:3001}
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:3001/health || exit 1"]
       interval: 10s