diff --git a/src/aare/gui/auth.py b/src/aare/gui/auth.py
index fa25edbe..f87e0709 100644
--- a/src/aare/gui/auth.py
+++ b/src/aare/gui/auth.py
@@ -1,7 +1,6 @@
-import os
+import json
+import subprocess
 import jwt
-import requests
-from requests_gssapi import HTTPSPNEGOAuth
 
 from aare.common.models import TokenData
 from aare.common.auth_models import get_user
@@ -19,38 +18,45 @@ def auth(base_url: str | None) -> str:
         return jwt.encode(token_data.model_dump(), "ABC123")
 
     url = f"{base_url}/token"
+    apache_url = f"https://mx-x10sa-queue-01.psi.ch/"
     try:
-        response = requests.post(
-            url,
-            data={
-                "username": curr_user,
-                "password": ""
-            },
-            headers={
-                "Content-Type": "application/x-www-form-urlencoded"
-            },
-            auth=HTTPSPNEGOAuth(),  # Kerberos SPNEGO negotiation via user's TGT
-            timeout=(3.0, 15.0),  # (connect timeout, read timeout)
+        result = subprocess.run(
+            [
+                'curl', '-sk', '--cacert', '/my/top/secret/path',
+                '--negotiate', '-u', ':',
+                apache_url,
+            ],
+            capture_output=True,
+            text=True,
+            timeout=18.0,
         )
-    except requests.RequestException as e:
-        logger.error(f"Authentication request failed (network): {e}")
+    except subprocess.TimeoutExpired as e:
+        logger.error(f"Authentication curl timed out: {e}")
         raise RuntimeError(
-            "Cannot reach AareDAQ server (network error). "
+            "Cannot reach AareDAQ server (timeout). "
+            "Please check the server is running and your connection."
+        ) from e
+    except FileNotFoundError as e:
+        logger.error(f"curl not found: {e}")
+        raise RuntimeError("curl not found on this system.") from e
+    except OSError as e:
+        logger.error(f"Authentication curl failed (OS error): {e}")
+        raise RuntimeError(
+            "Cannot reach AareDAQ server (OS error). "
             "Please check the server is running and your connection."
         ) from e
 
-    if response.status_code != 200:
-        # Avoid dumping full HTML/tracebacks into the GUI; keep it short and actionable
-        logger.error(f"Authentication request failed: HTTP {response.status_code}. Body: {response.text[:500]}")
+    if result.returncode != 0:
+        logger.error(f"Authentication curl exited {result.returncode}. stderr: {result.stderr[:500]}")
         raise RuntimeError(
-            f"Authentication failed (HTTP {response.status_code}). "
-            "The server may be starting up or unavailable."
+            f"Authentication failed (curl exit {result.returncode}). "
+            "Check server is running and Kerberos ticket is valid (kinit)."
         )
 
     try:
-        response_json = response.json()
-    except ValueError as e:
-        logger.error(f"Authentication response was not JSON. Body: {response.text[:500]}")
+        response_json = json.loads(result.stdout)
+    except json.JSONDecodeError as e:
+        logger.error(f"Authentication response not JSON. stdout: {result.stdout[:500]}")
         raise RuntimeError(
             "Authentication failed (invalid server response). "
             "The server may be starting up or misconfigured."