diff --git a/lib/extensions/admin/login/index.html b/lib/extensions/admin/login/index.html
index 19704e3..6c18266 100644
--- a/lib/extensions/admin/login/index.html
+++ b/lib/extensions/admin/login/index.html
@@ -7,6 +7,10 @@
   <script>document.body.hidden = true;</script>
 
   <div class="js-error" hidden>
+    <h1>Invalid Magic Link</h1>
+    <div class="js-magic-link">'{{magic_link}}' isn't a valid magic link code.
+      <br>Links are only good for 5 minutes, so you gotta act fast.
+    </div>
   </div>
 
   <div class="js-magic" hidden>
@@ -22,8 +26,3 @@
   <script src="js/app.js"></script>
 </body>
 </html>
-
-    res.send("<h1>Invalid Magic Link</h1>"
-    + "<pre><code>'" + magic + "' isn't a valid link.\nLinks are only good for 5 minutes, so act fast.\n"
-    + "(" + new Date(1000*((_auths[magic]||{}).dt||0)).toISOString() + ")</code></pre>\n"
-    );
diff --git a/lib/extensions/admin/login/js/app.js b/lib/extensions/admin/login/js/app.js
index 76f1547..7270d64 100644
--- a/lib/extensions/admin/login/js/app.js
+++ b/lib/extensions/admin/login/js/app.js
@@ -9,15 +9,21 @@ if (magic) {
   , cors: true
   }).then(function (resp) {
     return resp.json().then(function (json) {
+      if (json.error) {
+        document.querySelector('.js-error').hidden = false;
+        document.querySelector('.js-magic-link').innerText = magic;
+        return;
+      }
       document.querySelector('body').hidden = false;
-      document.querySelector('js-magic').hidden = false;
-      document.querySelector('js-token-data').innerText = JSON.stringify(json, null, 2);
-      document.querySelector('js-new-href').href = json.domains[0];
-      document.querySelector('js-new-href').innerText = json.domains[0];
+      document.querySelector('.js-magic').hidden = false;
+      document.querySelector('.js-token-data').innerText = JSON.stringify(json, null, 2);
+      document.querySelector('.js-new-href').href = json.domains[0];
+      document.querySelector('.js-new-href').innerText = json.domains[0];
     });
   });
 } else {
   document.querySelector('body').hidden = false;
+  document.querySelector('.js-error').hidden = false;
 }
 
 }());
diff --git a/lib/extensions/index.js b/lib/extensions/index.js
index 8ccdf14..bc86359 100644
--- a/lib/extensions/index.js
+++ b/lib/extensions/index.js
@@ -74,7 +74,7 @@ module.exports.authenticate = function (opts) {
         // TODO use global interval whenever the number of active links is high
         var t = setTimeout(function () {
           console.log("[Magic Link] Timeout for '" + auth.subject + "'");
-          delete _auths[id];
+          delete _auths[auth.id];
           var err = new Error("Login Failure: Magic Link was not clicked within 5 minutes");
           err.code = 'E_LOGIN_TIMEOUT';
           reject();
@@ -83,7 +83,7 @@ module.exports.authenticate = function (opts) {
         function authorize() {
           console.log("mighty auth'n ranger!");
           clearTimeout(t);
-          delete _auths[id];
+          delete _auths[auth.id];
           var hri = require('human-readable-ids').hri;
           var hrname = hri.random() + '.' + state.config.sharedDomain;
           var jwt = require('jsonwebtoken');
@@ -92,7 +92,7 @@ module.exports.authenticate = function (opts) {
           , ports: [ 1024 + Math.round(Math.random() * 6300) ]
           , aud: state.config.webminDomain
           , iss: Math.round(Date.now() / 1000)
-          , id: id
+          , id: auth.id
           , hostname: auth.hostname
           };
           tokenData.jwt = jwt.sign(tokenData, state.secret);
@@ -106,7 +106,7 @@ module.exports.authenticate = function (opts) {
           return tokenData;
         }
 
-        _auths[id] = {
+        _auths[auth.id] = {
           dt: Date.now()
         , resolve: authorize
         , reject: reject
@@ -139,7 +139,7 @@ app.get('/api/telebit.cloud/magic/:magic', function (req, res) {
   console.log("DEBUG telebit.cloud magic");
   var tokenData;
   var magic = req.params.magic || req.query.magic;
-  console.log("DEBUG telebit.cloud magic 1a");
+  console.log("DEBUG telebit.cloud magic 1a", magic);
   if (_auths[magic]) {
     console.log("DEBUG telebit.cloud magic 1b");
     tokenData = _auths[magic].resolve();
@@ -147,7 +147,7 @@ app.get('/api/telebit.cloud/magic/:magic', function (req, res) {
     res.send(tokenData);
   } else {
     console.log("DEBUG telebit.cloud magic 2");
-    res.send({ error: { code: "E_TOKEN", message: "Invalid or expired magic link." } });
+    res.send({ error: { code: "E_TOKEN", message: "Invalid or expired magic link. (" + magic + ")" } });
     console.log("DEBUG telebit.cloud magic 2b");
   }
 });