diff --git a/src/auth.ts b/src/auth.ts
index 26d0713..695cae8 100644
--- a/src/auth.ts
+++ b/src/auth.ts
@@ -52,6 +52,9 @@ export const auth = betterAuth({
   logger: { level: (process.env.LOG_LEVEL as "debug" | "info") ?? "info" },
   trustedOrigins: (process.env.TRUSTED_ORIGINS ?? "").split(",").filter(Boolean),
   database: pool,
+  // Temporary, env-gated: lets us mint a session headlessly to debug the OAuth
+  // token exchange without a browser. Off unless DEBUG_EMAIL_PASSWORD=true.
+  emailAndPassword: { enabled: process.env.DEBUG_EMAIL_PASSWORD === "true" },
   socialProviders,
   plugins: [
     // oauth-provider looks up the jwt plugin (for JWKS-verifiable access tokens)