diff --git a/docs/apps-proxy/kai-preview.md b/docs/apps-proxy/kai-preview.md
new file mode 100644
index 0000000000..c619dfdacf
--- /dev/null
+++ b/docs/apps-proxy/kai-preview.md
@@ -0,0 +1,343 @@
+# Kai-Preview Iframe-Auth: Operator Guide
+
+## 1. Overview
+
+apps-proxy exposes a dev-mode-only authentication path that lets the kbc-ui SPA
+embed a running data app inside an `<iframe>` without prompting the user with the
+app's configured OAuth or Basic auth flow. The flow uses a short-lived HMAC
+handshake JWT (60 s) that the SPA mints via a Storage API token and then exchanges
+for a host-only session cookie. Direct (non-iframe) access to the app still goes
+through the configured `AuthRules` as before; the kai-preview path is invisible to
+end-users browsing directly.
+
+---
+
+## 2. When Does It Activate?
+
+The kai-preview path is active only when **both** of the following are true:
+
+1. The app's `App` CRD has `spec.devMode.enabled: true`.
+2. The kbc-ui SPA calls `POST /_proxy/kai-preview/handshake-token` with a valid
+   Storage API token in the `X-StorageApi-Token` header.
+
+When `spec.devMode.enabled` is `false` (or absent) every kai-preview endpoint
+returns `404`. No config flag disables the path at the proxy level — dev-mode on
+the CRD is the single gate.
+
+---
+
+## 3. Endpoints
+
+All endpoints live under the prefix `/_proxy/kai-preview`. They return `404` on
+apps that do not have dev-mode enabled.
+
+| Endpoint | Method | Auth | Notes |
+|---|---|---|---|
+| `/_proxy/kai-preview/handshake-token` | `POST` | `X-StorageApi-Token` header (CORS) | Mint a 60 s handshake JWT after verifying the Storage token against Storage API |
+| `/_proxy/kai-preview/bootstrap`   | `GET`  | none | Return the postMessage handshake shim HTML; sets `Content-Security-Policy: frame-ancestors <allowed-origins>` |
+| `/_proxy/kai-preview/exchange`    | `POST` | JWT in JSON body `{"token":"..."}` | Verify handshake JWT, set the `kbc-kai-preview-session` session cookie |
+| `/_proxy/kai-preview/refresh`     | `POST` | session cookie (CORS) | Re-mint and slide the session cookie; returns `204 No Content` |
+
+**CORS note.** `handshake-token` and `refresh` enforce an origin allowlist
+(`kaiPreview.allowedOrigins`). Requests from origins not in the list are
+rejected with `403` before any business logic runs. `bootstrap` and `exchange` are
+not cross-origin calls (they are frame navigations / same-origin fetch from inside
+the frame).
+
+---
+
+## 4. Configuration
+
+### 4.1 Config keys
+
+| Key | Default | Notes |
+|---|---|---|
+| `kaiPreview.handshakeSigningKey` | *(required)* | HMAC-SHA256 key for the 60 s handshake JWT |
+| `kaiPreview.sessionSigningKey`   | *(required)* | HMAC-SHA256 key for the session cookie JWT |
+| `kaiPreview.sessionTTL`          | `4h`          | Sliding session cookie lifetime |
+| `kaiPreview.allowedOrigins`      | *(required)* | Origins permitted to call `handshake-token` and `refresh`, e.g. `https://connection.keboola.com` |
+| `storageApiUrl`                  | `https://connection.keboola.com` | Storage API base URL used to verify Storage tokens in `handshake-token` |
+
+### 4.2 Provisioning new signing keys
+
+Two new Kubernetes / Helm secrets must be provisioned **per stack**. Generate each
+key with:
+
+```bash
+openssl rand -hex 32   # run once for handshakeSigningKey
+openssl rand -hex 32   # run once for sessionSigningKey
+```
+
+Store the output as separate secret values and mount them via the appropriate Helm
+values path. Do **not** share keys between stacks or between the two key roles.
+
+---
+
+## 5. Routing Decision Tree
+
+The following shows the order in which `appHandler.ServeHTTP` evaluates an
+incoming request. Earlier steps short-circuit; later steps are only reached if
+all prior steps pass.
+
+```
+Incoming request
+│
+├─1─ Host != canonical host?
+│       └─ YES → 308 redirect to canonical URL
+│
+├─2─ App has dev-mode enabled?
+│     │
+│     ├─ YES + path starts with /_proxy/kai-preview/*
+│     │       └─ kai-preview composite handler (handshake-token / bootstrap / exchange / refresh)
+│     │
+│     ├─ YES + request has a valid kbc-kai-preview-session cookie
+│     │       └─ forward to upstream app
+│     │             (if cookie is past its midpoint TTL, slide the cookie on the way out)
+│     │
+│     └─ YES + Sec-Fetch-Dest=iframe|frame, Accept=text/html, no valid session cookie
+│               └─ serve bootstrap shim (rewrites path to /_proxy/kai-preview/bootstrap)
+│
+├─3─ Path starts with /_proxy/* (internal auth URLs)?
+│       └─ existing auth handler (OAuth2 Proxy / Basic)
+│
+└─4─ AuthRules matching
+        └─ matching rule found → apply configured auth (OAuth / Basic / none), forward to upstream
+           no match → 404
+```
+
+---
+
+## 6. Multi-Replica Behavior
+
+All JWTs (both handshake and session cookie) are **stateless HMAC**. There is no
+shared cache, Redis, or database involved. Any replica that holds the same signing
+key can verify a token minted by any other replica. This means:
+
+- Mint (`handshake-token`) and exchange can land on different replicas — no affinity
+  required.
+- Cookie validation is fully per-request and stateless — works identically across
+  all replicas.
+- Sliding refresh (`refresh`) re-mints a fresh JWT on every call — also stateless
+  and replica-agnostic.
+
+The only operational requirement is that **all replicas share the same signing
+keys** (injected via Kubernetes secret).
+
+---
+
+## 7. Smoke-Test Runbook
+
+Use this runbook to verify that a fresh stack deployment is wired correctly. Each
+step is designed to be copy-paste runnable. Substitute the environment variables at
+the top for your target environment.
+
+### 7.0 Environment variables
+
+```bash
+export APP_HOST="myapp.data-apps.keboola.com"   # FQDN of the data app
+export IDE_ORIGIN="https://connection.keboola.com"
+export STORAGE_TOKEN="<your-storage-api-token>"
+
+# Signing keys — use the same values provisioned to the stack
+export HANDSHAKE_KEY="$(openssl rand -hex 32)"
+export SESSION_KEY="$(openssl rand -hex 32)"
+```
+
+### 7.1 Boot apps-proxy locally with kai-preview config
+
+```bash
+APPS_PROXY_KAI_PREVIEW_HANDSHAKE_SIGNING_KEY="${HANDSHAKE_KEY}" \
+APPS_PROXY_KAI_PREVIEW_SESSION_SIGNING_KEY="${SESSION_KEY}" \
+APPS_PROXY_KAI_PREVIEW_SESSION_TTL="4h" \
+APPS_PROXY_KAI_PREVIEW_ALLOWED_ORIGINS="${IDE_ORIGIN}" \
+APPS_PROXY_STORAGE_API_URL="https://connection.keboola.com" \
+  ./apps-proxy
+```
+
+Expected: proxy starts, logs `kai-preview enabled` (or similar), no startup errors.
+
+### 7.2 Mint a handshake token
+
+```bash
+HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
+  -H "Content-Type: application/json" \
+  | jq -r '.token')
+
+echo "handshake token: ${HANDSHAKE_TOKEN}"
+```
+
+**Expected:**
+- HTTP `200`
+- Response body: `{"token":"<jwt>"}`
+- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` response header present
+- `Cache-Control: no-store` response header present
+
+### 7.3 Fetch the bootstrap shim
+
+```bash
+curl -sI "https://${APP_HOST}/_proxy/kai-preview/bootstrap"
+```
+
+**Expected:**
+- HTTP `200`
+- `Content-Type: text/html; charset=utf-8`
+- `Content-Security-Policy` header contains `frame-ancestors ${IDE_ORIGIN}`
+- `Cache-Control: no-store`
+
+To inspect the body:
+
+```bash
+curl -s "https://${APP_HOST}/_proxy/kai-preview/bootstrap" | head -20
+```
+
+Expected: HTML containing a `<script>` block that performs the postMessage
+handshake.
+
+### 7.4 Exchange the handshake token for a session cookie
+
+```bash
+SESSION_COOKIE=$(curl -s -c - -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
+  -D - \
+  | grep -i 'set-cookie')
+
+echo "${SESSION_COOKIE}"
+```
+
+**Expected:**
+- HTTP `200`
+- `Set-Cookie` header present with:
+  - name `kbc-kai-preview-session`
+  - `SameSite=None`
+  - `Partitioned`
+  - `Secure`
+  - `HttpOnly`
+  - `Max-Age=14400` (or the configured `sessionTTL` in seconds)
+- `Cache-Control: no-store`
+
+Save the cookie for subsequent steps:
+
+```bash
+curl -s -c /tmp/kai-preview-cookies.txt -X POST \
+  "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" > /dev/null
+```
+
+### 7.5 Make an authenticated request using the session cookie
+
+```bash
+curl -s -b /tmp/kai-preview-cookies.txt \
+  "https://${APP_HOST}/"
+```
+
+**Expected:**
+- HTTP `200` with the upstream app's response body (not an OAuth redirect or login
+  page).
+- No `Location:` header redirecting to an auth provider.
+
+### 7.6 Refresh the session cookie
+
+```bash
+curl -s -b /tmp/kai-preview-cookies.txt \
+     -c /tmp/kai-preview-cookies.txt \
+     -X POST "https://${APP_HOST}/_proxy/kai-preview/refresh" \
+     -H "Origin: ${IDE_ORIGIN}" \
+     -D -
+```
+
+**Expected:**
+- HTTP `204 No Content`
+- Fresh `Set-Cookie: kbc-kai-preview-session=...` header (new JWT, new `Max-Age`)
+- `Access-Control-Allow-Origin: ${IDE_ORIGIN}` header present
+
+### 7.7 Verify 404 when dev-mode is off
+
+Flip the app CRD to disable dev-mode:
+
+```bash
+kubectl edit app/<app-name> -n <apps-namespace>
+# Set spec.devMode.enabled: false, save and quit
+```
+
+Then re-run the mint step:
+
+```bash
+curl -s -o /dev/null -w "%{http_code}" \
+  -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}"
+```
+
+**Expected:** `404`. All four kai-preview endpoints should return `404`.
+
+Re-enable dev-mode before continuing:
+
+```bash
+kubectl edit app/<app-name> -n <apps-namespace>
+# Set spec.devMode.enabled: true
+```
+
+### 7.8 Multi-replica stateless check
+
+Scale apps-proxy to two replicas:
+
+```bash
+kubectl scale deployment apps-proxy --replicas=2 -n <apps-namespace>
+kubectl rollout status deployment/apps-proxy -n <apps-namespace>
+```
+
+Mint a token (this will land on an arbitrary replica):
+
+```bash
+HANDSHAKE_TOKEN=$(curl -s -X POST "https://${APP_HOST}/_proxy/kai-preview/handshake-token" \
+  -H "Origin: ${IDE_ORIGIN}" \
+  -H "X-StorageApi-Token: ${STORAGE_TOKEN}" \
+  | jq -r '.token')
+```
+
+Exchange it (may land on a different replica due to load-balancer round-robin):
+
+```bash
+curl -s -c /tmp/kai-preview-cookies-mr.txt \
+  -X POST "https://${APP_HOST}/_proxy/kai-preview/exchange" \
+  -H "Content-Type: application/json" \
+  -d "{\"token\":\"${HANDSHAKE_TOKEN}\"}" \
+  -o /dev/null -w "%{http_code}\n"
+```
+
+**Expected:** `200`. The exchange succeeds regardless of which replica handles it,
+proving stateless JWT validation.
+
+---
+
+## 8. Known Limitations
+
+- **No user identity headers.** Apps that read `X-Kbc-User-*` headers to determine
+  the acting user will not receive them in kai-preview iframe sessions — the session
+  cookie carries only an app-scoped JWT with no user identity. Apps should fall back
+  to `KBC_TOKEN` (the app's own service token) for user identity, or implement their
+  own identity resolution via the Storage API.
+
+- **Safari ITP.** Safari's Intelligent Tracking Prevention may purge partitioned
+  cookies aggressively under low-traffic conditions. The SPA's sliding-refresh
+  heartbeat (the `/_proxy/kai-preview/refresh` call made periodically by kbc-ui)
+  compensates by re-minting the cookie before it is evicted. Operators should
+  ensure the heartbeat interval in kbc-ui is shorter than the Safari ITP eviction
+  window (typically 7 days for partitioned cookies, but may vary).
+
+- **Dev-mode only.** The entire kai-preview path is disabled for production apps
+  (`spec.devMode.enabled: false`). There is no override. Do not rely on this path
+  for production embedding scenarios.
+
+---
+
+## 9. Reference
+
+The full design rationale (threat model, cookie attribute choices, multi-replica
+analysis, and kbc-ui SPA side) is captured in the internal design spec recorded
+separately from this repository. Refer to your team's design documentation archive
+for the `2026-05-14-dev-iframe-auth-design` specification.
diff --git a/go.mod b/go.mod
index e019d44be1..e3842ed53d 100644
--- a/go.mod
+++ b/go.mod
@@ -32,6 +32,7 @@ require (
 	github.com/go-resty/resty/v2 v2.17.2
 	github.com/gofrs/flock v0.13.0
 	github.com/gofrs/uuid/v5 v5.4.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/go-cmp v0.7.0
 	github.com/google/go-jsonnet v0.22.0
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
@@ -302,7 +303,6 @@ require (
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/gohugoio/hashstructure v0.6.0 // indirect
 	github.com/gohugoio/hugo v0.147.6 // indirect
-	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
 	github.com/golang/gddo v0.0.0-20210115222349-20d68f94ee1f // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
diff --git a/internal/pkg/service/appsproxy/config/config.go b/internal/pkg/service/appsproxy/config/config.go
index 198345343a..591ff8c527 100644
--- a/internal/pkg/service/appsproxy/config/config.go
+++ b/internal/pkg/service/appsproxy/config/config.go
@@ -2,6 +2,7 @@ package config
 
 import (
 	"net/url"
+	"strings"
 	"time"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/telemetry/datadog"
@@ -24,10 +25,20 @@ type Config struct {
 	Upstream         Upstream          `configKey:"-" configUsage:"Configuration options for upstream"`
 	SandboxesAPI     SandboxesAPI      `configKey:"sandboxesAPI"`
 	CsrfTokenSalt    string            `configKey:"csrfTokenSalt" configUsage:"Salt used for generating CSRF tokens" validate:"required" sensitive:"true"`
+	StorageAPIURL    *url.URL          `configKey:"storageApiUrl" configUsage:"Base URL of the Keboola Storage API used for Storage token verification (kai-preview flow). E.g. https://connection.keboola.com" validate:"required"`
+	KaiPreview       KaiPreview        `configKey:"kaiPreview" configUsage:"kai-preview iframe-auth configuration."`
 	K8s              K8s               `configKey:"k8s" configUsage:"Kubernetes configuration."`
 	E2bWebhook       E2BWebhook        `configKey:"e2bWebhook"`
 }
 
+// KaiPreview configures the stateless iframe-auth path for the kai-preview flow.
+type KaiPreview struct {
+	HandshakeSigningKey string        `configKey:"handshakeSigningKey" configUsage:"HMAC key for kai-preview handshake JWT (30-60s lifetime)." validate:"required" sensitive:"true"`
+	SessionSigningKey   string        `configKey:"sessionSigningKey" configUsage:"HMAC key for kai-preview session cookie JWT." validate:"required" sensitive:"true"`
+	SessionTTL          time.Duration `configKey:"sessionTTL" configUsage:"Lifetime of the kai-preview session cookie (sliding)."`
+	AllowedOrigins      []string      `configKey:"allowedOrigins" configUsage:"Origins allowed to mint kai-preview embed tokens (e.g. https://connection.keboola.com)." validate:"required,min=1,dive,http_url"`
+}
+
 type API struct {
 	Listen    string   `configKey:"listen" configUsage:"Listen address of the configuration HTTP API." validate:"required,hostname_port"`
 	PublicURL *url.URL `configKey:"publicUrl" configUsage:"Public URL of the configuration HTTP API for link generation." validate:"required"`
@@ -74,12 +85,25 @@ func New() Config {
 				Host:   "localhost:8000",
 			},
 		},
+		KaiPreview: KaiPreview{
+			SessionTTL: 4 * time.Hour,
+		},
+		StorageAPIURL: &url.URL{
+			Scheme: "https",
+			Host:   "connection.keboola.com",
+		},
 	}
 }
 
 func (c *Config) Normalize() {
 }
 
+func (c *KaiPreview) Normalize() {
+	for i, o := range c.AllowedOrigins {
+		c.AllowedOrigins[i] = strings.TrimRight(o, "/")
+	}
+}
+
 func (c *API) Normalize() {
 	if c.PublicURL != nil {
 		c.PublicURL.Host = strhelper.NormalizeHost(c.PublicURL.Host)
diff --git a/internal/pkg/service/appsproxy/config/config_test.go b/internal/pkg/service/appsproxy/config/config_test.go
new file mode 100644
index 0000000000..aa5c6571e3
--- /dev/null
+++ b/internal/pkg/service/appsproxy/config/config_test.go
@@ -0,0 +1,48 @@
+package config_test
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/common/configmap"
+)
+
+func TestKaiPreviewConfig_Defaults(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	assert.Equal(t, 4*time.Hour, cfg.KaiPreview.SessionTTL)
+}
+
+func TestKaiPreviewConfig_RequiresSigningKeys(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	// KaiPreview signing keys intentionally empty
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "kaiPreview.handshakeSigningKey")
+	assert.Contains(t, err.Error(), "kaiPreview.sessionSigningKey")
+}
+
+func TestKaiPreviewConfig_NormalizeStripsTrailingSlash(t *testing.T) {
+	t.Parallel()
+	cfg := config.New()
+	cfg.CookieSecretSalt = "x"
+	cfg.CsrfTokenSalt = "x"
+	cfg.SandboxesAPI = config.SandboxesAPI{URL: "https://example", Token: "t"}
+	cfg.K8s = config.K8s{AppsNamespace: "ns"}
+	cfg.KaiPreview = config.KaiPreview{
+		HandshakeSigningKey: "k1",
+		SessionSigningKey:   "k2",
+		AllowedOrigins:      []string{"https://connection.keboola.com/", "https://staging.keboola.com"},
+	}
+	err := configmap.ValidateAndNormalize(&cfg)
+	require.NoError(t, err)
+	assert.Equal(t, "https://connection.keboola.com", cfg.KaiPreview.AllowedOrigins[0])
+	assert.Equal(t, "https://staging.keboola.com", cfg.KaiPreview.AllowedOrigins[1])
+}
diff --git a/internal/pkg/service/appsproxy/dependencies/mocked.go b/internal/pkg/service/appsproxy/dependencies/mocked.go
index d857f0b688..86df586638 100644
--- a/internal/pkg/service/appsproxy/dependencies/mocked.go
+++ b/internal/pkg/service/appsproxy/dependencies/mocked.go
@@ -77,6 +77,20 @@ func newMockedServiceScope(tb testing.TB, ctx context.Context, cfg config.Config
 	if cfg.SandboxesAPI.Token == "" {
 		cfg.SandboxesAPI.Token = "my-token"
 	}
+	if cfg.StorageAPIURL == nil {
+		var err error
+		cfg.StorageAPIURL, err = url.Parse("https://connection.keboola.com")
+		require.NoError(tb, err)
+	}
+	if cfg.KaiPreview.HandshakeSigningKey == "" {
+		cfg.KaiPreview.HandshakeSigningKey = "test-handshake-signing-key-for-mocked-scope"
+	}
+	if cfg.KaiPreview.SessionSigningKey == "" {
+		cfg.KaiPreview.SessionSigningKey = "test-session-signing-key-for-mocked-scope"
+	}
+	if len(cfg.KaiPreview.AllowedOrigins) == 0 {
+		cfg.KaiPreview.AllowedOrigins = []string{"https://connection.keboola.com"}
+	}
 	if cfg.K8s.AppsNamespace == "" {
 		cfg.K8s.AppsNamespace = "keboola"
 	}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
index 5c2ec57699..4c014ef191 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/apphandler.go
@@ -3,6 +3,7 @@
 package apphandler
 
 import (
+	"context"
 	"net/http"
 	"net/url"
 	"strings"
@@ -13,6 +14,8 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/auth/provider"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+	kpendpoints "github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/selector"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/chain"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/common/ctxattr"
@@ -29,11 +32,18 @@ type appHandler struct {
 	upstream           chain.Handler
 	allAuthHandlers    chain.Handler
 	authHandlerPerRule map[ruleIndex]chain.Handler
+	kaiPreview         *kpendpoints.Handler
 }
 
 type ruleIndex int
 
 func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handler, authHandlers map[provider.ID]selector.Handler) (http.Handler, error) {
+	// DevModeChecker is backed by the live K8s state watcher: re-evaluates on every request.
+	devModeChecker := kpendpoints.DevModeCheckerFunc(func(ctx context.Context, appID string) bool {
+		info, ok := manager.upstreamManager.AppInfo(ctx, api.AppID(appID))
+		return ok && info.DevMode
+	})
+
 	handler := &appHandler{
 		manager:            manager,
 		app:                app,
@@ -41,6 +51,18 @@ func newAppHandler(manager *Manager, app api.AppConfig, appUpstream chain.Handle
 		attrs:              app.Telemetry(),
 		upstream:           appUpstream,
 		authHandlerPerRule: make(map[ruleIndex]chain.Handler),
+		kaiPreview: kpendpoints.NewHandler(kpendpoints.HandlerDeps{
+			Clock:                manager.clock,
+			StorageTokenVerifier: manager.storageTokenVerifier,
+			DevMode:              devModeChecker,
+			CORS:                 kaipreview.NewCORS(manager.config.KaiPreview.AllowedOrigins),
+			HandshakeKey:         manager.config.KaiPreview.HandshakeSigningKey,
+			SessionKey:           manager.config.KaiPreview.SessionSigningKey,
+			SessionTTL:           manager.config.KaiPreview.SessionTTL,
+			AllowedOrigins:       manager.config.KaiPreview.AllowedOrigins,
+			AppID:                string(app.ID),
+			AppProjectID:         app.ProjectID,
+		}),
 	}
 
 	// Create handler with all auth handlers, to route internal URLs
@@ -146,6 +168,14 @@ func (h *appHandler) serveHTTPOrError(w http.ResponseWriter, req *http.Request)
 		return nil
 	}
 
+	// kai-preview: dev-mode iframe-auth path.
+	// (routing decision documented in spec § "apps-proxy: routing decision for dev-mode apps")
+	if h.isDevMode(req.Context()) { //nolint:contextcheck // false positive: req.Context() is the correct context here
+		if handled, err := h.serveKaiPreview(w, req); handled {
+			return err
+		}
+	}
+
 	// Route internal URLs if there is at least one auth handler
 	if strings.HasPrefix(req.URL.Path, config.InternalPrefix) && h.allAuthHandlers != nil {
 		return h.allAuthHandlers.ServeHTTPOrError(w, req)
@@ -173,3 +203,56 @@ func (h *appHandler) serveRule(w http.ResponseWriter, req *http.Request, index r
 	// Serve the request without authentication
 	return h.upstream.ServeHTTPOrError(w, req)
 }
+
+// serveKaiPreview handles the three dev-mode routing cases for the kai-preview iframe-auth path.
+// Returns (true, err) when it handled the request, or (false, nil) when the caller should continue routing.
+func (h *appHandler) serveKaiPreview(w http.ResponseWriter, req *http.Request) (bool, error) {
+	// 1. /_proxy/kai-preview/* routes go to the kai-preview composite handler.
+	if strings.HasPrefix(req.URL.Path, kpendpoints.PathPrefix) {
+		return true, h.kaiPreview.ServeHTTPOrError(w, req)
+	}
+	// 2. Valid session cookie → forward to upstream (skip AuthRules), with sliding refresh.
+	if claims, ok := kaipreview.ValidateSessionCookie(
+		req,
+		h.manager.config.KaiPreview.SessionSigningKey,
+		h.manager.clock,
+		string(h.app.ID),
+		h.app.ProjectID,
+	); ok {
+		h.maybeRefreshSessionCookie(w, claims)
+		return true, h.upstream.ServeHTTPOrError(w, req)
+	}
+	// 3. Iframe document load on a dev-mode app with no session → serve bootstrap shim.
+	if kaipreview.IsIframeDocumentLoad(req) {
+		bootstrapReq := req.Clone(req.Context()) //nolint:contextcheck // false positive: req.Context() is the correct context here
+		bootstrapReq.URL.Path = kpendpoints.PathPrefix + "/bootstrap"
+		return true, h.kaiPreview.ServeHTTPOrError(w, bootstrapReq)
+	}
+	return false, nil
+}
+
+// maybeRefreshSessionCookie re-mints the session JWT when the session has passed its midpoint.
+// If minting fails, the existing cookie is left in place (it is still valid).
+func (h *appHandler) maybeRefreshSessionCookie(w http.ResponseWriter, claims *kaipreview.SessionClaims) {
+	if !claims.NeedsRefresh(h.manager.clock.Now()) {
+		return
+	}
+	newJWT, err := kaipreview.MintSessionJWT(
+		h.manager.config.KaiPreview.SessionSigningKey,
+		h.manager.clock,
+		string(h.app.ID),
+		h.app.ProjectID,
+		h.manager.config.KaiPreview.SessionTTL,
+	)
+	if err == nil {
+		kaipreview.SetSessionCookie(w, newJWT, h.manager.config.KaiPreview.SessionTTL)
+	}
+}
+
+// isDevMode reports whether this app currently has DevMode enabled.
+// It reads from the live K8s state cache so toggling DevMode on the App CRD takes
+// effect on the next request without requiring handler recreation.
+func (h *appHandler) isDevMode(ctx context.Context) bool {
+	info, ok := h.manager.upstreamManager.AppInfo(ctx, h.app.ID)
+	return ok && info.DevMode
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
new file mode 100644
index 0000000000..d66a14ebe7
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie.go
@@ -0,0 +1,75 @@
+package kaipreview
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+)
+
+const SessionCookieName = "kbc-kai-preview-session"
+
+// SetSessionCookie writes the kai-preview session cookie on w. The cookie is
+// host-only (no Domain), Secure, HttpOnly, SameSite=None, Partitioned (CHIPS).
+// See the kai-preview design doc for the full attribute rationale.
+func SetSessionCookie(w http.ResponseWriter, jwt string, ttl time.Duration) {
+	if ttl <= 0 {
+		ClearSessionCookie(w)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{
+		Name:        SessionCookieName,
+		Value:       jwt,
+		Path:        "/",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteNoneMode,
+		Partitioned: true,
+		MaxAge:      int(ttl.Seconds()),
+	})
+}
+
+// ClearSessionCookie writes a cookie that invalidates any existing kai-preview
+// session cookie on the same host. Used by the exchange endpoint on validation
+// failure and by future sign-out flows.
+func ClearSessionCookie(w http.ResponseWriter) {
+	http.SetCookie(w, &http.Cookie{
+		Name:        SessionCookieName,
+		Value:       "",
+		Path:        "/",
+		Secure:      true,
+		HttpOnly:    true,
+		SameSite:    http.SameSiteNoneMode,
+		Partitioned: true,
+		MaxAge:      -1,
+	})
+}
+
+// ReadSessionCookie returns the value of the kai-preview session cookie if
+// present on the request, or "" if absent or unreadable.
+func ReadSessionCookie(r *http.Request) string {
+	c, err := r.Cookie(SessionCookieName)
+	if err != nil || c == nil {
+		return ""
+	}
+	return c.Value
+}
+
+// ValidateSessionCookie reads the kai-preview session cookie from the request,
+// verifies the signature, expiry, and (app_id, project) scope. Returns claims
+// + true on success, nil + false on any failure. Stateless — relies only on the
+// signing key.
+func ValidateSessionCookie(r *http.Request, sessionKey string, clock clockwork.Clock, appID, projectID string) (*SessionClaims, bool) {
+	raw := ReadSessionCookie(r)
+	if raw == "" {
+		return nil, false
+	}
+	claims, err := VerifySessionJWT(sessionKey, clock, raw)
+	if err != nil {
+		return nil, false
+	}
+	if claims.AppID != appID || claims.ProjectID != projectID {
+		return nil, false
+	}
+	return claims, true
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
new file mode 100644
index 0000000000..2e560310f3
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cookie_test.go
@@ -0,0 +1,140 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestSetSessionCookie_Attributes(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	clock := clockwork.NewFakeClock()
+	ttl := 4 * time.Hour
+
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", ttl)
+	require.NoError(t, err)
+
+	SetSessionCookie(w, jwt, ttl)
+
+	resp := w.Result()
+	cookies := resp.Cookies()
+	require.Len(t, cookies, 1)
+	c := cookies[0]
+
+	assert.Equal(t, SessionCookieName, c.Name)
+	assert.Equal(t, jwt, c.Value)
+	assert.Equal(t, "/", c.Path)
+	assert.True(t, c.Secure)
+	assert.True(t, c.HttpOnly)
+	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
+	assert.True(t, c.Partitioned)
+	assert.Empty(t, c.Domain, "must be host-only — no Domain attribute")
+	assert.Equal(t, int(ttl.Seconds()), c.MaxAge)
+}
+
+func TestReadSessionCookie_Present(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: "the-jwt"})
+	got := ReadSessionCookie(r)
+	assert.Equal(t, "the-jwt", got)
+}
+
+func TestReadSessionCookie_Missing(t *testing.T) {
+	t.Parallel()
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/", nil)
+	got := ReadSessionCookie(r)
+	assert.Empty(t, got)
+}
+
+func TestSetSessionCookie_NonPositiveTTL_ClearsInstead(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	SetSessionCookie(w, "ignored-jwt", 0)
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, -1, cookies[0].MaxAge, "ttl=0 must invalidate, not create a session cookie")
+	assert.Empty(t, cookies[0].Value)
+}
+
+func TestClearSessionCookie_Attributes(t *testing.T) {
+	t.Parallel()
+	w := httptest.NewRecorder()
+	ClearSessionCookie(w)
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	c := cookies[0]
+	assert.Equal(t, SessionCookieName, c.Name)
+	assert.Empty(t, c.Value)
+	assert.Equal(t, -1, c.MaxAge, "clear cookie must use MaxAge=-1")
+	assert.True(t, c.Secure)
+	assert.True(t, c.HttpOnly)
+	assert.True(t, c.Partitioned)
+	assert.Equal(t, http.SameSiteNoneMode, c.SameSite)
+}
+
+func TestValidateSessionCookie_Valid(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	claims, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.True(t, ok)
+	require.NotNil(t, claims)
+	assert.Equal(t, "app-123", claims.AppID)
+}
+
+func TestValidateSessionCookie_Missing(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_AppMismatch(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_Expired(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	clock.Advance(5 * time.Hour)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
+
+func TestValidateSessionCookie_ProjectMismatch(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+	jwt, err := MintSessionJWT(testSessionKey, clock, "app-123", "different-project", 4*time.Hour)
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/anything", nil)
+	r.AddCookie(&http.Cookie{Name: SessionCookieName, Value: jwt})
+
+	_, ok := ValidateSessionCookie(r, testSessionKey, clock, "app-123", "proj-456")
+	assert.False(t, ok)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
new file mode 100644
index 0000000000..082974994d
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors.go
@@ -0,0 +1,49 @@
+package kaipreview
+
+import (
+	"net/http"
+	"slices"
+)
+
+type CORS struct {
+	allowedOrigins []string
+}
+
+func NewCORS(allowedOrigins []string) *CORS {
+	return &CORS{allowedOrigins: allowedOrigins}
+}
+
+func (c *CORS) IsAllowed(origin string) bool {
+	return slices.Contains(c.allowedOrigins, origin)
+}
+
+// HandlePreflight returns true when the request was a preflight OPTIONS and was handled.
+// Caller should return immediately if true. Returns false for non-OPTIONS requests.
+func (c *CORS) HandlePreflight(w http.ResponseWriter, r *http.Request) bool {
+	if r.Method != http.MethodOptions {
+		return false
+	}
+	origin := r.Header.Get("Origin")
+	if !c.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return true
+	}
+	w.Header().Set("Access-Control-Allow-Origin", origin)
+	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
+	w.Header().Set("Access-Control-Allow-Headers", "X-StorageApi-Token, Content-Type")
+	w.Header().Set("Access-Control-Max-Age", "600")
+	w.WriteHeader(http.StatusNoContent)
+	return true
+}
+
+// WriteResponseHeaders sets the CORS response headers on a regular (non-preflight) response.
+// Call this from the actual handler before writing the body.
+func (c *CORS) WriteResponseHeaders(w http.ResponseWriter, origin string) {
+	if !c.IsAllowed(origin) {
+		return
+	}
+	w.Header().Set("Access-Control-Allow-Origin", origin)
+	w.Header().Set("Access-Control-Allow-Credentials", "true")
+	w.Header().Set("Vary", "Origin")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
new file mode 100644
index 0000000000..c35c4f5fc2
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/cors_test.go
@@ -0,0 +1,60 @@
+package kaipreview
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestCORS_AllowedOrigin_Preflight(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	r.Header.Set("Access-Control-Request-Headers", "X-StorageApi-Token, Content-Type")
+	w := httptest.NewRecorder()
+
+	handled := cors.HandlePreflight(w, r)
+	assert.True(t, handled)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+	assert.Contains(t, w.Header().Get("Access-Control-Allow-Headers"), "X-StorageApi-Token")
+}
+
+func TestCORS_DisallowedOrigin_Preflight(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	w := httptest.NewRecorder()
+
+	handled := cors.HandlePreflight(w, r)
+	assert.True(t, handled)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestCORS_WriteResponseHeaders(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+
+	w := httptest.NewRecorder()
+	cors.WriteResponseHeaders(w, "https://connection.keboola.com")
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+	assert.Equal(t, "true", w.Header().Get("Access-Control-Allow-Credentials"))
+}
+
+func TestCORS_NonPreflightPassesThrough(t *testing.T) {
+	t.Parallel()
+	cors := NewCORS([]string{"https://connection.keboola.com"})
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	w := httptest.NewRecorder()
+	handled := cors.HandlePreflight(w, r)
+	assert.False(t, handled)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
new file mode 100644
index 0000000000..3698a2f8a1
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap.go
@@ -0,0 +1,69 @@
+package endpoints
+
+import (
+	"embed"
+	"encoding/json"
+	"html/template"
+	"net/http"
+	"strings"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+//go:embed template/bootstrap.gohtml
+var bootstrapFS embed.FS
+
+var bootstrapTmpl = template.Must(template.ParseFS(bootstrapFS, "template/bootstrap.gohtml")) //nolint:gochecknoglobals // template must be parsed at package init
+
+type BootstrapHandler struct {
+	allowedOrigins []string
+	originsJSON    template.JS
+	devMode        DevModeChecker
+	appID          string
+}
+
+func NewBootstrapHandler(allowedOrigins []string, devMode DevModeChecker, appID string) *BootstrapHandler {
+	bs, err := json.Marshal(allowedOrigins)
+	if err != nil {
+		// []string marshalling never fails; this is a safety guard.
+		bs = []byte("[]")
+	}
+	return &BootstrapHandler{
+		allowedOrigins: allowedOrigins,
+		originsJSON:    template.JS(bs), //nolint:gosec // G203: bs is json.Marshal output of config-supplied URL strings, safe to embed as JS literal
+		devMode:        devMode,
+		appID:          appID,
+	}
+}
+
+func (h *BootstrapHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodGet {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.devMode.IsDevMode(r.Context(), h.appID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	csp := "frame-ancestors 'none'"
+	if len(h.allowedOrigins) > 0 {
+		csp = "frame-ancestors " + strings.Join(h.allowedOrigins, " ")
+	}
+
+	w.Header().Set("Content-Security-Policy", csp)
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-store")
+
+	data := struct {
+		AllowedOriginsJSON template.JS
+	}{
+		AllowedOriginsJSON: h.originsJSON,
+	}
+	if err := bootstrapTmpl.Execute(w, data); err != nil {
+		return errors.Errorf("kai-preview: render bootstrap shim: %w", err)
+	}
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
new file mode 100644
index 0000000000..c3c303b376
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/bootstrap_test.go
@@ -0,0 +1,52 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestBootstrapHandler_ServesHTMLWithCSP(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
+	r := httptest.NewRequestWithContext(t.Context(), "GET", "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, 200, w.Code)
+	assert.Contains(t, w.Header().Get("Content-Type"), "text/html")
+	assert.Contains(t, w.Header().Get("Content-Security-Policy"), "frame-ancestors https://connection.keboola.com")
+
+	body := w.Body.String()
+	assert.Contains(t, body, "postMessage", "shim must postMessage")
+	assert.Contains(t, body, "kai-preview-ready", "shim must send 'kai-preview-ready' to parent")
+	assert.Contains(t, body, "/_proxy/kai-preview/exchange", "shim must POST to exchange")
+	assert.Contains(t, body, "https://connection.keboola.com", "shim must restrict postMessage targetOrigin")
+	assert.NotContains(t, body, `targetOrigin: "*"`, "shim must NEVER postMessage with wildcard targetOrigin")
+	assert.NotContains(t, strings.ToLower(body), "innerhtml", "shim must not write user-supplied data via innerHTML")
+}
+
+func TestBootstrapHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: true}, "app-123")
+	r := httptest.NewRequestWithContext(t.Context(), "POST", "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, 405, w.Code)
+}
+
+func TestBootstrapHandler_NonDevModeReturns404(t *testing.T) {
+	t.Parallel()
+	h := NewBootstrapHandler([]string{"https://connection.keboola.com"}, &stubDevModeChecker{devMode: false}, "app-123")
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
new file mode 100644
index 0000000000..6e47b22416
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange.go
@@ -0,0 +1,71 @@
+package endpoints
+
+import (
+	"encoding/json"
+	"net/http"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+type ExchangeDeps struct {
+	Clock        clockwork.Clock
+	DevMode      DevModeChecker
+	HandshakeKey string
+	SessionKey   string
+	SessionTTL   time.Duration
+	AppID        string
+	AppProjectID string
+}
+
+type ExchangeHandler struct {
+	deps ExchangeDeps
+}
+
+func NewExchangeHandler(deps ExchangeDeps) *ExchangeHandler {
+	return &ExchangeHandler{deps: deps}
+}
+
+func (h *ExchangeHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	// Dev-mode gate: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	var body struct {
+		Token string `json:"token"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil || body.Token == "" {
+		http.Error(w, "invalid body", http.StatusBadRequest)
+		return nil //nolint:nilerr // intentional: decode error handled via HTTP 400 response
+	}
+
+	claims, err := kaipreview.VerifyHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, body.Token)
+	if err != nil {
+		http.Error(w, "invalid handshake token", http.StatusUnauthorized)
+		return nil //nolint:nilerr // intentional: invalid token handled via HTTP 401 response
+	}
+	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "handshake token scope mismatch", http.StatusForbidden)
+		return nil
+	}
+
+	sessionJWT, err := kaipreview.MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	if err != nil {
+		return errors.Errorf("kai-preview: mint session JWT: %w", err)
+	}
+
+	kaipreview.SetSessionCookie(w, sessionJWT, h.deps.SessionTTL)
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
new file mode 100644
index 0000000000..aaf2a9e8dc
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/exchange_test.go
@@ -0,0 +1,138 @@
+package endpoints
+
+import (
+	"bytes"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+func newTestExchangeHandler(devMode bool) *ExchangeHandler {
+	return NewExchangeHandler(ExchangeDeps{
+		Clock:        clockwork.NewFakeClock(),
+		DevMode:      &stubDevModeChecker{devMode: devMode},
+		HandshakeKey: testHandshakeKey,
+		SessionKey:   testSessionKey,
+		SessionTTL:   4 * time.Hour,
+		AppID:        "app-123",
+		AppProjectID: "proj-456",
+	})
+}
+
+func mintForTest(t *testing.T, appID, projectID string) string {
+	t.Helper()
+	clock := clockwork.NewFakeClock()
+	jwt, err := kaipreview.MintHandshakeJWT(testHandshakeKey, clock, appID, projectID)
+	require.NoError(t, err)
+	return jwt
+}
+
+func TestExchangeHandler_Success(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "app-123", "proj-456")
+
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	r.Header.Set("Content-Type", "application/json")
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, w.Code)
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, kaipreview.SessionCookieName, cookies[0].Name)
+	assert.True(t, cookies[0].Partitioned)
+}
+
+func TestExchangeHandler_InvalidJWT(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+
+	body, err := json.Marshal(map[string]string{"token": "not-a-jwt"})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestExchangeHandler_AppIDMismatch(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "different-app", "proj-456")
+
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestExchangeHandler_ProjectMismatch(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	jwt := mintForTest(t, "app-123", "different-project")
+
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestExchangeHandler_DevModeOff(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(false)
+	jwt := mintForTest(t, "app-123", "proj-456")
+
+	body, err := json.Marshal(map[string]string{"token": jwt})
+	require.NoError(t, err)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader(body))
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestExchangeHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/exchange", nil)
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
+
+func TestExchangeHandler_EmptyBody(t *testing.T) {
+	t.Parallel()
+	h := newTestExchangeHandler(true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", bytes.NewReader([]byte("{}")))
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
new file mode 100644
index 0000000000..6707059e0a
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler.go
@@ -0,0 +1,92 @@
+package endpoints
+
+import (
+	"context"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+// PathPrefix is the URL prefix all kai-preview endpoints live under.
+const PathPrefix = config.InternalPrefix + "/kai-preview"
+
+const (
+	pathHandshakeToken = "/handshake-token"
+	pathBootstrap      = "/bootstrap"
+	pathExchange       = "/exchange"
+	pathRefresh        = "/refresh"
+)
+
+// DevModeCheckerFunc adapts a plain function to the DevModeChecker interface.
+type DevModeCheckerFunc func(ctx context.Context, appID string) bool
+
+// IsDevMode implements DevModeChecker.
+func (f DevModeCheckerFunc) IsDevMode(ctx context.Context, appID string) bool { return f(ctx, appID) }
+
+type HandlerDeps struct {
+	Clock                clockwork.Clock
+	StorageTokenVerifier kaipreview.StorageTokenVerifier
+	DevMode              DevModeChecker
+	CORS                 *kaipreview.CORS
+	HandshakeKey         string
+	SessionKey           string
+	SessionTTL           time.Duration
+	AllowedOrigins       []string
+	AppID                string
+	AppProjectID         string
+}
+
+// Handler is the per-app composite handler that serves all four kai-preview
+// internal endpoints. One instance per app. Routes by URL path suffix.
+type Handler struct {
+	handshakeToken *HandshakeTokenHandler
+	bootstrap      *BootstrapHandler
+	exchange       *ExchangeHandler
+	refresh        *RefreshHandler
+}
+
+func NewHandler(deps HandlerDeps) *Handler {
+	return &Handler{
+		handshakeToken: NewHandshakeTokenHandler(HandshakeTokenDeps{
+			Clock: deps.Clock, StorageTokenVerifier: deps.StorageTokenVerifier, DevMode: deps.DevMode, CORS: deps.CORS,
+			HandshakeKey: deps.HandshakeKey, AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+		bootstrap: NewBootstrapHandler(deps.AllowedOrigins, deps.DevMode, deps.AppID),
+		exchange: NewExchangeHandler(ExchangeDeps{
+			Clock: deps.Clock, DevMode: deps.DevMode,
+			HandshakeKey: deps.HandshakeKey, SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL,
+			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+		refresh: NewRefreshHandler(RefreshDeps{
+			Clock: deps.Clock, DevMode: deps.DevMode,
+			SessionKey: deps.SessionKey, SessionTTL: deps.SessionTTL, CORS: deps.CORS,
+			AppID: deps.AppID, AppProjectID: deps.AppProjectID,
+		}),
+	}
+}
+
+func (h *Handler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if !strings.HasPrefix(r.URL.Path, PathPrefix) {
+		http.NotFound(w, r)
+		return nil
+	}
+	sub := r.URL.Path[len(PathPrefix):]
+	switch sub {
+	case pathHandshakeToken:
+		return h.handshakeToken.ServeHTTPOrError(w, r)
+	case pathBootstrap:
+		return h.bootstrap.ServeHTTPOrError(w, r)
+	case pathExchange:
+		return h.exchange.ServeHTTPOrError(w, r)
+	case pathRefresh:
+		return h.refresh.ServeHTTPOrError(w, r)
+	default:
+		http.NotFound(w, r)
+		return nil
+	}
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
new file mode 100644
index 0000000000..9327b267c7
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handler_test.go
@@ -0,0 +1,80 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+func newTestCompositeHandler() *Handler {
+	return NewHandler(HandlerDeps{
+		Clock:                clockwork.NewFakeClock(),
+		StorageTokenVerifier: &stubStorageTokenVerifier{projectID: "proj-456"},
+		DevMode:              &stubDevModeChecker{devMode: true},
+		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:         testHandshakeKey,
+		SessionKey:           testSessionKey,
+		SessionTTL:           4 * time.Hour,
+		AllowedOrigins:       []string{"https://connection.keboola.com"},
+		AppID:                "app-123",
+		AppProjectID:         "proj-456",
+	})
+}
+
+func TestCompositeHandler_RoutesHandshakeToken(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid")
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusOK, w.Code)
+}
+
+func TestCompositeHandler_RoutesBootstrap(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/bootstrap", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Contains(t, w.Header().Get("Content-Type"), "text/html")
+}
+
+func TestCompositeHandler_RoutesExchange(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler()
+	// Empty body — exchange should return 400 (handler reached, valid path)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/exchange", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+}
+
+func TestCompositeHandler_RoutesRefresh(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler()
+	// No cookie — refresh should return 401 (handler reached, valid path)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+}
+
+func TestCompositeHandler_UnknownSubpath404(t *testing.T) {
+	t.Parallel()
+	h := newTestCompositeHandler()
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/does-not-exist", nil)
+	w := httptest.NewRecorder()
+	require.NoError(t, h.ServeHTTPOrError(w, r))
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
new file mode 100644
index 0000000000..f1041a7130
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token.go
@@ -0,0 +1,93 @@
+package endpoints
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+// DevModeChecker tells the handler whether the current app is in dev mode.
+// Backed by the apps-proxy CRD watcher (AppInfo.DevMode).
+type DevModeChecker interface {
+	IsDevMode(ctx context.Context, appID string) bool
+}
+
+type HandshakeTokenDeps struct {
+	Clock                clockwork.Clock
+	StorageTokenVerifier kaipreview.StorageTokenVerifier
+	DevMode              DevModeChecker
+	CORS                 *kaipreview.CORS
+	HandshakeKey         string
+	AppID                string
+	AppProjectID         string
+}
+
+type HandshakeTokenHandler struct {
+	deps HandshakeTokenDeps
+}
+
+func NewHandshakeTokenHandler(deps HandshakeTokenDeps) *HandshakeTokenHandler {
+	return &HandshakeTokenHandler{deps: deps}
+}
+
+func (h *HandshakeTokenHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if h.deps.CORS.HandlePreflight(w, r) {
+		return nil
+	}
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	// Origin must be allowed even on the actual request (defence in depth).
+	origin := r.Header.Get("Origin")
+	if !h.deps.CORS.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return nil
+	}
+	// All remaining responses are to an allowed origin — emit CORS headers now so the
+	// SPA can read status codes and bodies of auth-failure responses, not just successes.
+	h.deps.CORS.WriteResponseHeaders(w, origin)
+
+	// Dev-mode gate first: pretend the endpoint doesn't exist on non-dev apps.
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	storageToken := r.Header.Get("X-StorageApi-Token")
+	if storageToken == "" {
+		http.Error(w, "missing X-StorageApi-Token", http.StatusUnauthorized)
+		return nil
+	}
+
+	res, err := h.deps.StorageTokenVerifier.Verify(r.Context(), storageToken)
+	if err != nil {
+		// Never echo the raw Storage token in the error body or logs.
+		http.Error(w, "Storage token invalid", http.StatusUnauthorized)
+		return nil //nolint:nilerr // intentional: error is handled via HTTP response, not propagated
+	}
+	if res.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "app belongs to a different project", http.StatusForbidden)
+		return nil
+	}
+
+	jwt, err := kaipreview.MintHandshakeJWT(h.deps.HandshakeKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID)
+	if err != nil {
+		return errors.Errorf("kai-preview: mint handshake JWT: %w", err)
+	}
+
+	// CORS headers already set above.
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusOK)
+	if err := json.NewEncoder(w).Encode(map[string]string{"token": jwt}); err != nil {
+		return errors.Errorf("kai-preview: write handshake token response: %w", err)
+	}
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
new file mode 100644
index 0000000000..f69ce9c5eb
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/handshake_token_test.go
@@ -0,0 +1,196 @@
+package endpoints
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+const (
+	testHandshakeKey = "test-handshake-key-must-be-long-enough"
+	testSessionKey   = "test-session-key-also-long-enough"
+)
+
+type stubStorageTokenVerifier struct {
+	projectID string
+	err       error
+}
+
+func (s *stubStorageTokenVerifier) Verify(_ context.Context, _ string) (*kaipreview.StorageTokenVerifyResult, error) {
+	if s.err != nil {
+		return nil, s.err
+	}
+	return &kaipreview.StorageTokenVerifyResult{ProjectID: s.projectID}, nil
+}
+
+type stubDevModeChecker struct{ devMode bool }
+
+func (s *stubDevModeChecker) IsDevMode(_ context.Context, _ string) bool { return s.devMode }
+
+var errStubUnauth = &stubError{msg: "unauthorized"}
+
+type stubError struct{ msg string }
+
+func (e *stubError) Error() string { return e.msg }
+
+func newTestHandshakeHandler(tokenValid bool, storageTokenProject string, devMode bool) *HandshakeTokenHandler {
+	var verifier kaipreview.StorageTokenVerifier
+	if tokenValid {
+		verifier = &stubStorageTokenVerifier{projectID: storageTokenProject}
+	} else {
+		verifier = &stubStorageTokenVerifier{err: errStubUnauth}
+	}
+	return NewHandshakeTokenHandler(HandshakeTokenDeps{
+		Clock:                clockwork.NewFakeClock(),
+		StorageTokenVerifier: verifier,
+		DevMode:              &stubDevModeChecker{devMode: devMode},
+		CORS:                 kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		HandshakeKey:         testHandshakeKey,
+		AppID:                "app-123",
+		AppProjectID:         "proj-456",
+	})
+}
+
+func TestHandshakeTokenHandler_Success(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusOK, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+
+	var body struct {
+		Token string `json:"token"`
+	}
+	require.NoError(t, json.Unmarshal(w.Body.Bytes(), &body))
+	require.NotEmpty(t, body.Token)
+}
+
+func TestHandshakeTokenHandler_PreflightOptions(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestHandshakeTokenHandler_MissingSTAHeader(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
+}
+
+func TestHandshakeTokenHandler_STAInvalid(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(false, "", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "bad-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
+}
+
+func TestHandshakeTokenHandler_WrongProject(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "different-project", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-but-wrong-project")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers so SPA can read status")
+}
+
+func TestHandshakeTokenHandler_AppNotInDevMode(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", false)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code, "must look like the endpoint doesn't exist when app isn't in dev mode")
+}
+
+func TestHandshakeTokenHandler_DisallowedOrigin(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	r.Header.Set("X-StorageApi-Token", "valid-token")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"),
+		"disallowed origins must NOT receive CORS headers")
+}
+
+func TestHandshakeTokenHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(true, "proj-456", true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
+
+func TestHandshakeTokenHandler_NoTokenInErrorBody(t *testing.T) {
+	t.Parallel()
+	h := newTestHandshakeHandler(false, "", true)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/handshake-token", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("X-StorageApi-Token", "secret-token-do-not-leak")
+	w := httptest.NewRecorder()
+	_ = h.ServeHTTPOrError(w, r)
+	assert.NotContains(t, w.Body.String(), "secret-token-do-not-leak")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
new file mode 100644
index 0000000000..3004389dd5
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh.go
@@ -0,0 +1,79 @@
+package endpoints
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+type RefreshDeps struct {
+	Clock        clockwork.Clock
+	DevMode      DevModeChecker
+	SessionKey   string
+	SessionTTL   time.Duration
+	CORS         *kaipreview.CORS
+	AppID        string
+	AppProjectID string
+}
+
+type RefreshHandler struct {
+	deps RefreshDeps
+}
+
+func NewRefreshHandler(deps RefreshDeps) *RefreshHandler {
+	return &RefreshHandler{deps: deps}
+}
+
+func (h *RefreshHandler) ServeHTTPOrError(w http.ResponseWriter, r *http.Request) error {
+	if h.deps.CORS.HandlePreflight(w, r) {
+		return nil
+	}
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", http.StatusMethodNotAllowed)
+		return nil
+	}
+
+	origin := r.Header.Get("Origin")
+	if !h.deps.CORS.IsAllowed(origin) {
+		http.Error(w, "origin not allowed", http.StatusForbidden)
+		return nil
+	}
+	// All remaining responses are to an allowed origin — emit CORS headers now so the
+	// SPA can read status codes and bodies of auth-failure responses, not just successes.
+	h.deps.CORS.WriteResponseHeaders(w, origin)
+
+	if !h.deps.DevMode.IsDevMode(r.Context(), h.deps.AppID) {
+		http.NotFound(w, r)
+		return nil
+	}
+
+	cookieValue := kaipreview.ReadSessionCookie(r)
+	if cookieValue == "" {
+		http.Error(w, "no session", http.StatusUnauthorized)
+		return nil
+	}
+
+	claims, err := kaipreview.VerifySessionJWT(h.deps.SessionKey, h.deps.Clock, cookieValue)
+	if err != nil {
+		http.Error(w, "session expired", http.StatusUnauthorized)
+		return nil //nolint:nilerr // intentional: invalid session handled via HTTP 401 response
+	}
+	if claims.AppID != h.deps.AppID || claims.ProjectID != h.deps.AppProjectID {
+		http.Error(w, "session scope mismatch", http.StatusForbidden)
+		return nil
+	}
+
+	newJWT, err := kaipreview.MintSessionJWT(h.deps.SessionKey, h.deps.Clock, h.deps.AppID, h.deps.AppProjectID, h.deps.SessionTTL)
+	if err != nil {
+		return errors.Errorf("kai-preview: re-mint session JWT: %w", err)
+	}
+	kaipreview.SetSessionCookie(w, newJWT, h.deps.SessionTTL)
+
+	w.Header().Set("Cache-Control", "no-store")
+	w.WriteHeader(http.StatusNoContent)
+	return nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
new file mode 100644
index 0000000000..fc8f328101
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/refresh_test.go
@@ -0,0 +1,154 @@
+package endpoints
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
+)
+
+func newTestRefreshHandler(devMode bool) (*RefreshHandler, *clockwork.FakeClock) {
+	clock := clockwork.NewFakeClock()
+	return NewRefreshHandler(RefreshDeps{
+		Clock:        clock,
+		DevMode:      &stubDevModeChecker{devMode: devMode},
+		SessionKey:   testSessionKey,
+		SessionTTL:   4 * time.Hour,
+		CORS:         kaipreview.NewCORS([]string{"https://connection.keboola.com"}),
+		AppID:        "app-123",
+		AppProjectID: "proj-456",
+	}), clock
+}
+
+func TestRefreshHandler_Success(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+
+	cookies := w.Result().Cookies()
+	require.Len(t, cookies, 1)
+	assert.Equal(t, kaipreview.SessionCookieName, cookies[0].Name)
+	assert.NotEqual(t, jwt, cookies[0].Value, "must be a fresh JWT, not the old one")
+}
+
+func TestRefreshHandler_PreflightOptions(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodOptions, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.Header.Set("Access-Control-Request-Method", "POST")
+	w := httptest.NewRecorder()
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNoContent, w.Code)
+}
+
+func TestRefreshHandler_MissingCookie(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"),
+		"auth-failure responses to allowed origins must include CORS headers")
+}
+
+func TestRefreshHandler_ExpiredCookie(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+	clock.Advance(5 * time.Hour)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusUnauthorized, w.Code)
+	assert.Equal(t, "https://connection.keboola.com", w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestRefreshHandler_DevModeOff(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(false)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestRefreshHandler_ScopeMismatch(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "different-app", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+}
+
+func TestRefreshHandler_DisallowedOrigin(t *testing.T) {
+	t.Parallel()
+	h, clock := newTestRefreshHandler(true)
+	jwt, err := kaipreview.MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodPost, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://evil.example.com")
+	r.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: jwt})
+	w := httptest.NewRecorder()
+
+	err = h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusForbidden, w.Code)
+	assert.Empty(t, w.Header().Get("Access-Control-Allow-Origin"))
+}
+
+func TestRefreshHandler_WrongMethod(t *testing.T) {
+	t.Parallel()
+	h, _ := newTestRefreshHandler(true)
+	r := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/_proxy/kai-preview/refresh", nil)
+	r.Header.Set("Origin", "https://connection.keboola.com")
+	w := httptest.NewRecorder()
+
+	err := h.ServeHTTPOrError(w, r)
+	require.NoError(t, err)
+	assert.Equal(t, http.StatusMethodNotAllowed, w.Code)
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
new file mode 100644
index 0000000000..0fb59b4273
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/endpoints/template/bootstrap.gohtml
@@ -0,0 +1,82 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <title>Loading preview…</title>
+  <style>
+    html, body { margin: 0; padding: 0; background: #fff; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; }
+    .status { display: flex; align-items: center; justify-content: center; height: 100vh; color: #888; font-size: 14px; }
+  </style>
+</head>
+<body>
+<div class="status" id="status">Loading preview…</div>
+<script>
+(function () {
+  "use strict";
+
+  // Server-rendered: the list of IDE origins this preview is allowed to handshake with.
+  var ALLOWED_ORIGINS = {{ .AllowedOriginsJSON }};
+
+  var EXCHANGE_PATH = "/_proxy/kai-preview/exchange";
+  var status = document.getElementById("status");
+  var didHandshake = false;
+  var readyInterval;
+
+  function setStatus(text) { if (status) { status.textContent = text; } }
+
+  function originAllowed(origin) {
+    for (var i = 0; i < ALLOWED_ORIGINS.length; i++) {
+      if (ALLOWED_ORIGINS[i] === origin) { return true; }
+    }
+    return false;
+  }
+
+  function broadcastReady() {
+    if (!window.parent || window.parent === window) {
+      setStatus("This preview only loads from the Keboola UI.");
+      return;
+    }
+    for (var i = 0; i < ALLOWED_ORIGINS.length; i++) {
+      try { window.parent.postMessage({ type: "kai-preview-ready" }, ALLOWED_ORIGINS[i]); }
+      catch (e) { /* targetOrigin mismatch is benign */ }
+    }
+  }
+
+  function onMessage(event) {
+    if (didHandshake) { return; }
+    if (!originAllowed(event.origin)) { return; }
+    if (!event.data || event.data.type !== "kai-preview-token" || typeof event.data.token !== "string") { return; }
+    didHandshake = true;
+    if (readyInterval) { clearInterval(readyInterval); readyInterval = null; }
+
+    fetch(EXCHANGE_PATH, {
+      method: "POST",
+      credentials: "include",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token: event.data.token })
+    }).then(function (r) {
+      if (!r.ok) {
+        setStatus("Preview authorization failed (" + r.status + "). Reload the parent page.");
+        return;
+      }
+      window.location.replace("/");
+    }).catch(function () {
+      setStatus("Preview authorization failed — network error.");
+    });
+  }
+
+  window.addEventListener("message", onMessage);
+  broadcastReady();
+  readyInterval = setInterval(broadcastReady, 500);
+  // Give up after ~10s if no parent responds.
+  setTimeout(function () {
+    if (!didHandshake && readyInterval) {
+      clearInterval(readyInterval);
+      readyInterval = null;
+      setStatus("This preview only loads from the Keboola UI.");
+    }
+  }, 10000);
+})();
+</script>
+</body>
+</html>
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go
new file mode 100644
index 0000000000..ffa27bd1e3
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect.go
@@ -0,0 +1,22 @@
+package kaipreview
+
+import (
+	"net/http"
+	"strings"
+)
+
+// IsIframeDocumentLoad heuristically detects a top-level iframe document load by
+// looking at the Sec-Fetch-Dest header and Accept header. Used as a routing
+// signal (not a security gate) to decide when to serve the bootstrap shim on a
+// dev-mode app with no valid session cookie.
+//
+// The signal is UX-only because Sec-Fetch-* is forgeable by non-browser clients.
+// The bootstrap shim itself is harmless without the postMessage handshake from a
+// trusted IDE origin.
+func IsIframeDocumentLoad(r *http.Request) bool {
+	dest := r.Header.Get("Sec-Fetch-Dest")
+	if dest != "iframe" && dest != "frame" {
+		return false
+	}
+	return strings.Contains(r.Header.Get("Accept"), "text/html")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
new file mode 100644
index 0000000000..6b7d71573c
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/iframe_detect_test.go
@@ -0,0 +1,39 @@
+package kaipreview
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestIsIframeDocumentLoad(t *testing.T) {
+	t.Parallel()
+
+	cases := []struct {
+		name   string
+		dest   string
+		accept string
+		want   bool
+	}{
+		{"iframe-html", "iframe", "text/html,*/*;q=0.8", true},
+		{"frame-html", "frame", "text/html", true},
+		{"document-html", "document", "text/html", false}, // top-level navigation, not iframe
+		{"xhr", "empty", "application/json", false},
+		{"image", "image", "image/*", false},
+		{"script", "script", "*/*", false},
+		{"iframe-but-json-accept", "iframe", "application/json", false},
+		{"no-sec-fetch-headers", "", "text/html", false},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			r := httptest.NewRequestWithContext(t.Context(), "GET", "/some/path", nil)
+			if tc.dest != "" {
+				r.Header.Set("Sec-Fetch-Dest", tc.dest)
+			}
+			r.Header.Set("Accept", tc.accept)
+			assert.Equal(t, tc.want, IsIframeDocumentLoad(r))
+		})
+	}
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
new file mode 100644
index 0000000000..cddad8195b
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt.go
@@ -0,0 +1,134 @@
+// Package kaipreview implements the kai-preview iframe-auth path: a stateless
+// JWT handshake (mint → bootstrap → exchange) that yields a host-only session
+// cookie for embedding dev-mode data apps inside the kbc-ui SPA.
+package kaipreview
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/jonboulle/clockwork"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+const (
+	purposeHandshake = "kai-preview-handshake"
+	purposeSession   = "kai-preview-session"
+	handshakeTTL     = 60 * time.Second
+)
+
+// HandshakeClaims carries the authorization scope from mint to exchange.
+type HandshakeClaims struct {
+	AppID     string `json:"appId"`
+	ProjectID string `json:"project"`
+	Purpose   string `json:"purpose"`
+	jwt.RegisteredClaims
+}
+
+// SessionClaims carries the authorization scope inside the session cookie.
+type SessionClaims struct {
+	AppID     string `json:"appId"`
+	ProjectID string `json:"project"`
+	Purpose   string `json:"purpose"`
+	TTL       int64  `json:"ttlS"` // total intended lifetime in seconds (for halfway-refresh detection)
+	jwt.RegisteredClaims
+}
+
+// NeedsRefresh returns true when the cookie has passed the midpoint of its TTL.
+func (c SessionClaims) NeedsRefresh(now time.Time) bool {
+	if c.IssuedAt == nil {
+		return true
+	}
+	elapsed := now.Sub(c.IssuedAt.Time)
+	return elapsed*2 > time.Duration(c.TTL)*time.Second
+}
+
+func MintHandshakeJWT(key string, clock clockwork.Clock, appID, projectID string) (string, error) {
+	now := clock.Now()
+	jti, err := randomHex(16)
+	if err != nil {
+		return "", errors.Errorf("kai-preview: generate jti: %w", err)
+	}
+	claims := HandshakeClaims{
+		AppID:     appID,
+		ProjectID: projectID,
+		Purpose:   purposeHandshake,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        jti,
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(handshakeTTL)),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(key))
+	if err != nil {
+		return "", errors.Errorf("kai-preview: sign handshake JWT: %w", err)
+	}
+	return signed, nil
+}
+
+func VerifyHandshakeJWT(key string, clock clockwork.Clock, raw string) (*HandshakeClaims, error) {
+	claims := &HandshakeClaims{}
+	parser := jwt.NewParser(jwt.WithTimeFunc(clock.Now), jwt.WithValidMethods([]string{"HS256"}))
+	_, err := parser.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
+		return []byte(key), nil
+	})
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: verify handshake JWT: %w", err)
+	}
+	if claims.Purpose != purposeHandshake {
+		return nil, errors.Errorf("kai-preview: handshake JWT has wrong purpose: %q", claims.Purpose)
+	}
+	return claims, nil
+}
+
+func MintSessionJWT(key string, clock clockwork.Clock, appID, projectID string, ttl time.Duration) (string, error) {
+	now := clock.Now()
+	jti, err := randomHex(16)
+	if err != nil {
+		return "", errors.Errorf("kai-preview: generate jti: %w", err)
+	}
+	claims := SessionClaims{
+		AppID:     appID,
+		ProjectID: projectID,
+		Purpose:   purposeSession,
+		TTL:       int64(ttl.Seconds()),
+		RegisteredClaims: jwt.RegisteredClaims{
+			ID:        jti,
+			IssuedAt:  jwt.NewNumericDate(now),
+			ExpiresAt: jwt.NewNumericDate(now.Add(ttl)),
+		},
+	}
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	signed, err := token.SignedString([]byte(key))
+	if err != nil {
+		return "", errors.Errorf("kai-preview: sign session JWT: %w", err)
+	}
+	return signed, nil
+}
+
+func VerifySessionJWT(key string, clock clockwork.Clock, raw string) (*SessionClaims, error) {
+	claims := &SessionClaims{}
+	parser := jwt.NewParser(jwt.WithTimeFunc(clock.Now), jwt.WithValidMethods([]string{"HS256"}))
+	_, err := parser.ParseWithClaims(raw, claims, func(t *jwt.Token) (any, error) {
+		return []byte(key), nil
+	})
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: verify session JWT: %w", err)
+	}
+	if claims.Purpose != purposeSession {
+		return nil, errors.Errorf("kai-preview: session JWT has wrong purpose: %q", claims.Purpose)
+	}
+	return claims, nil
+}
+
+func randomHex(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
new file mode 100644
index 0000000000..d743ef998d
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/jwt_test.go
@@ -0,0 +1,101 @@
+package kaipreview
+
+import (
+	"testing"
+	"time"
+
+	"github.com/jonboulle/clockwork"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testHandshakeKey = "test-handshake-key-must-be-long-enough"
+	testSessionKey   = "test-session-key-also-long-enough"
+)
+
+func TestHandshakeJWT_RoundTrip(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+	require.NotEmpty(t, token)
+
+	claims, err := VerifyHandshakeJWT(testHandshakeKey, clock, token)
+	require.NoError(t, err)
+	assert.Equal(t, "app-123", claims.AppID)
+	assert.Equal(t, "proj-456", claims.ProjectID)
+	assert.Equal(t, "kai-preview-handshake", claims.Purpose)
+	assert.NotEmpty(t, claims.ID)
+}
+
+func TestHandshakeJWT_ExpiredAfter60s(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+
+	clock.Advance(61 * time.Second)
+
+	_, err = VerifyHandshakeJWT(testHandshakeKey, clock, token)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "expired")
+}
+
+func TestHandshakeJWT_WrongKeyRejected(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintHandshakeJWT(testHandshakeKey, clock, "app-123", "proj-456")
+	require.NoError(t, err)
+
+	_, err = VerifyHandshakeJWT("different-key-different-length", clock, token)
+	require.Error(t, err)
+}
+
+func TestSessionJWT_RoundTrip(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	claims, err := VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.Equal(t, "app-123", claims.AppID)
+	assert.Equal(t, "proj-456", claims.ProjectID)
+	assert.Equal(t, "kai-preview-session", claims.Purpose)
+}
+
+func TestSessionJWT_ExpiredAfterTTL(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	clock.Advance(4*time.Hour + time.Second)
+
+	_, err = VerifySessionJWT(testSessionKey, clock, token)
+	require.Error(t, err)
+}
+
+func TestSessionJWT_HalfwayDetection(t *testing.T) {
+	t.Parallel()
+	clock := clockwork.NewFakeClock()
+
+	token, err := MintSessionJWT(testSessionKey, clock, "app-123", "proj-456", 4*time.Hour)
+	require.NoError(t, err)
+
+	clock.Advance(1 * time.Hour) // < 50% — should not need refresh
+	claims, err := VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.False(t, claims.NeedsRefresh(clock.Now()))
+
+	clock.Advance(2 * time.Hour) // total 3h, > 50% of 4h
+	claims, err = VerifySessionJWT(testSessionKey, clock, token)
+	require.NoError(t, err)
+	assert.True(t, claims.NeedsRefresh(clock.Now()))
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
new file mode 100644
index 0000000000..9b3b6c4fb9
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier.go
@@ -0,0 +1,66 @@
+package kaipreview
+
+import (
+	"context"
+	"encoding/json"
+	"net/http"
+
+	"github.com/keboola/keboola-as-code/internal/pkg/utils/errors"
+)
+
+// StorageTokenVerifier abstracts HTTPStorageTokenVerifier so tests can inject a stub without HTTP.
+type StorageTokenVerifier interface {
+	Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error)
+}
+
+// StorageTokenVerifyResult is the subset of Storage API's tokens/verify response that the
+// kai-preview flow consumes. We deliberately ignore email, name, roles — see
+// docs/superpowers/specs/2026-05-14-dev-iframe-auth-design.md "no identity in
+// transit".
+type StorageTokenVerifyResult struct {
+	ProjectID string
+}
+
+type HTTPStorageTokenVerifier struct {
+	baseURL string
+	client  *http.Client
+}
+
+func NewHTTPStorageTokenVerifier(baseURL string, client *http.Client) *HTTPStorageTokenVerifier {
+	return &HTTPStorageTokenVerifier{baseURL: baseURL, client: client}
+}
+
+func (v *HTTPStorageTokenVerifier) Verify(ctx context.Context, token string) (*StorageTokenVerifyResult, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, v.baseURL+"/v2/storage/tokens/verify", nil)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: build Storage token verify request: %w", err)
+	}
+	req.Header.Set("X-StorageApi-Token", token)
+	req.Header.Set("Accept", "application/json")
+
+	resp, err := v.client.Do(req)
+	if err != nil {
+		return nil, errors.Errorf("kai-preview: Storage token verify call: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode == http.StatusUnauthorized {
+		return nil, errors.New("kai-preview: Storage token unauthorized")
+	}
+	if resp.StatusCode != http.StatusOK {
+		return nil, errors.Errorf("kai-preview: Storage token verify returned %d", resp.StatusCode)
+	}
+
+	var body struct {
+		Owner struct {
+			ID string `json:"id"`
+		} `json:"owner"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
+		return nil, errors.Errorf("kai-preview: decode Storage token verify response: %w", err)
+	}
+	if body.Owner.ID == "" {
+		return nil, errors.New("kai-preview: Storage token verify response missing owner.id")
+	}
+	return &StorageTokenVerifyResult{ProjectID: body.Owner.ID}, nil
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
new file mode 100644
index 0000000000..56360149d8
--- /dev/null
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview/storage_token_verifier_test.go
@@ -0,0 +1,94 @@
+package kaipreview
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestStorageTokenVerifier_Success(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		assert.Equal(t, "GET", r.Method)
+		assert.Equal(t, "/v2/storage/tokens/verify", r.URL.Path)
+		assert.Equal(t, "test-token", r.Header.Get("X-StorageApi-Token"))
+		w.Header().Set("Content-Type", "application/json")
+		if err := json.NewEncoder(w).Encode(map[string]any{
+			"owner": map[string]any{"id": "proj-456", "name": "Test Project"},
+		}); err != nil {
+			http.Error(w, err.Error(), http.StatusInternalServerError)
+		}
+	}))
+	defer srv.Close()
+
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
+	res, err := v.Verify(t.Context(), "test-token")
+	require.NoError(t, err)
+	assert.Equal(t, "proj-456", res.ProjectID)
+}
+
+func TestStorageTokenVerifier_Unauthorized(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, `{"error":"unauthorized"}`, http.StatusUnauthorized)
+	}))
+	defer srv.Close()
+
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(t.Context(), "bad-token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unauthorized")
+}
+
+func TestStorageTokenVerifier_NetworkError(t *testing.T) {
+	t.Parallel()
+	v := NewHTTPStorageTokenVerifier("http://127.0.0.1:1", http.DefaultClient) // port 1 = unreachable
+	_, err := v.Verify(t.Context(), "token")
+	require.Error(t, err)
+}
+
+func TestStorageTokenVerifier_MissingOwnerID(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte(`{"owner":{}}`))
+	}))
+	defer srv.Close()
+
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(t.Context(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "missing owner.id")
+}
+
+func TestStorageTokenVerifier_ServerError(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		http.Error(w, "internal error", http.StatusInternalServerError)
+	}))
+	defer srv.Close()
+
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(t.Context(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "500")
+}
+
+func TestStorageTokenVerifier_MalformedJSON(t *testing.T) {
+	t.Parallel()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write([]byte("not-json"))
+	}))
+	defer srv.Close()
+
+	v := NewHTTPStorageTokenVerifier(srv.URL, srv.Client())
+	_, err := v.Verify(t.Context(), "token")
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "decode Storage token verify response")
+}
diff --git a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
index 9359ead14d..35d83c6a5a 100644
--- a/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
+++ b/internal/pkg/service/appsproxy/proxy/apphandler/manager.go
@@ -6,12 +6,16 @@ import (
 	"encoding/hex"
 	"net/http"
 	"sync"
+	"time"
+
+	"github.com/jonboulle/clockwork"
 
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/config"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/api"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/appconfig"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/k8sapp"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/upstream"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/pagewriter"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/syncmap"
@@ -22,13 +26,15 @@ import (
 )
 
 type Manager struct {
-	config           config.Config
-	telemetry        telemetry.Telemetry
-	configLoader     appconfig.Loader
-	upstreamManager  *upstream.Manager
-	authProxyManager *authproxy.Manager
-	pageWriter       *pagewriter.Writer
-	handlers         *syncmap.SyncMap[api.AppID, appHandlerWrapper]
+	config               config.Config
+	telemetry            telemetry.Telemetry
+	configLoader         appconfig.Loader
+	upstreamManager      *upstream.Manager
+	authProxyManager     *authproxy.Manager
+	pageWriter           *pagewriter.Writer
+	handlers             *syncmap.SyncMap[api.AppID, appHandlerWrapper]
+	clock                clockwork.Clock
+	storageTokenVerifier kaipreview.StorageTokenVerifier
 }
 
 type appHandlerWrapper struct {
@@ -39,6 +45,7 @@ type appHandlerWrapper struct {
 }
 
 type dependencies interface {
+	Clock() clockwork.Clock
 	Config() config.Config
 	Telemetry() telemetry.Telemetry
 	PageWriter() *pagewriter.Writer
@@ -48,8 +55,14 @@ type dependencies interface {
 }
 
 func NewManager(d dependencies) *Manager {
+	cfg := d.Config()
+	if cfg.StorageAPIURL == nil {
+		panic("appsproxy: StorageAPIURL is required for kai-preview Storage token verification")
+	}
+	storageAPIURL := cfg.StorageAPIURL.String()
+	storageTokenHTTPClient := &http.Client{Timeout: 5 * time.Second}
 	return &Manager{
-		config:           d.Config(),
+		config:           cfg,
 		telemetry:        d.Telemetry(),
 		configLoader:     d.AppConfigLoader(),
 		upstreamManager:  d.UpstreamManager(),
@@ -58,6 +71,8 @@ func NewManager(d dependencies) *Manager {
 		handlers: syncmap.New[api.AppID, appHandlerWrapper](func(api.AppID) *appHandlerWrapper {
 			return &appHandlerWrapper{lock: &sync.Mutex{}}
 		}),
+		clock:                d.Clock(),
+		storageTokenVerifier: kaipreview.NewHTTPStorageTokenVerifier(storageAPIURL, storageTokenHTTPClient),
 	}
 }
 
diff --git a/internal/pkg/service/appsproxy/proxy/proxy_test.go b/internal/pkg/service/appsproxy/proxy/proxy_test.go
index 9c6ef20c03..13cb5ad387 100644
--- a/internal/pkg/service/appsproxy/proxy/proxy_test.go
+++ b/internal/pkg/service/appsproxy/proxy/proxy_test.go
@@ -22,6 +22,7 @@ import (
 
 	"github.com/coder/websocket"
 	"github.com/coder/websocket/wsjson"
+	"github.com/jonboulle/clockwork"
 	"github.com/keboola/go-utils/pkg/wildcards"
 	"github.com/oauth2-proxy/mockoidc"
 	"github.com/oauth2-proxy/oauth2-proxy/v7/pkg/logger"
@@ -47,6 +48,7 @@ import (
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dataapps/k8sapp"
 	proxyDependencies "github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/dependencies"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy"
+	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/kaipreview"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/apphandler/authproxy/oauthproxy/logging"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/pagewriter"
 	"github.com/keboola/keboola-as-code/internal/pkg/service/appsproxy/proxy/testutil"
@@ -2429,6 +2431,91 @@ func TestAppProxyRouter(t *testing.T) {
 			},
 			expectedNotifications: map[string]int{},
 		},
+		{
+			// kai-preview: GET /_proxy/kai-preview/bootstrap on a dev-mode app (Running) → 200 with HTML shim.
+			name: "kai-preview-bootstrap-dev-mode-running",
+			setupK8s: func(t *testing.T, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+				_, err := fakeClient.Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+					t.Context(), "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+				)
+				require.NoError(t, err)
+				require.Eventually(t, func() bool {
+					info, ok := watcher.GetState(t.Context(), api.AppID("devmode"))
+					return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+				}, 5*time.Second, 50*time.Millisecond)
+			},
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/_proxy/kai-preview/bootstrap", nil)
+				require.NoError(t, err)
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// The bootstrap shim is an HTML page with postMessage logic.
+				assert.Contains(t, response.Header.Get("Content-Type"), "text/html")
+				// The bootstrap shim references the exchange path.
+				assert.Contains(t, string(body), "/_proxy/kai-preview/exchange")
+			},
+			expectedNotifications: map[string]int{},
+		},
+		{
+			// kai-preview: GET /_proxy/kai-preview/bootstrap on a non-dev-mode app falls through to
+			// AuthRules. The "devmode" app has AuthRequired=false, so the upstream is reached — the
+			// kai-preview bootstrap shim is NOT served.
+			name: "kai-preview-bootstrap-non-dev-mode",
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				// "devmode" app has DevMode=false by default (makeDefaultK8sObjects does not set devMode).
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/_proxy/kai-preview/bootstrap", nil)
+				require.NoError(t, err)
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				// With DevMode=false the request falls through to the AuthRules path.
+				// The "devmode" app is public (AuthRequired=false), so the upstream responds directly.
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// Upstream app returns its response; the bootstrap shim is NOT served.
+				assert.Equal(t, "Hello, client", string(body))
+			},
+			expectedNotifications: map[string]int{
+				"devmode": 1,
+			},
+		},
+		{
+			// kai-preview: GET / with Sec-Fetch-Dest=iframe on a dev-mode Running app and no session cookie
+			// → proxy serves the bootstrap shim (iframe document load detection).
+			name: "kai-preview-iframe-bootstrap-fallback",
+			setupK8s: func(t *testing.T, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+				_, err := fakeClient.Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+					t.Context(), "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+				)
+				require.NoError(t, err)
+				require.Eventually(t, func() bool {
+					info, ok := watcher.GetState(t.Context(), api.AppID("devmode"))
+					return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+				}, 5*time.Second, 50*time.Millisecond)
+			},
+			run: func(t *testing.T, client *http.Client, m []*mockoidc.MockOIDC, appServer *testutil.AppServer, service *testutil.DataAppsAPI, fakeClient *k8sfake.FakeDynamicClient, watcher *k8sapp.StateWatcher) {
+				request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "https://dev-devmode.hub.keboola.local/", nil)
+				require.NoError(t, err)
+				// Simulate an iframe document load (Sec-Fetch-Dest=iframe + Accept=text/html).
+				request.Header.Set("Sec-Fetch-Dest", "iframe")
+				request.Header.Set("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8")
+				response, err := client.Do(request)
+				require.NoError(t, err)
+				require.Equal(t, http.StatusOK, response.StatusCode)
+				body, err := io.ReadAll(response.Body)
+				require.NoError(t, err)
+				// Should be the bootstrap shim HTML, not the upstream app response.
+				assert.Contains(t, response.Header.Get("Content-Type"), "text/html")
+				assert.NotEqual(t, "Hello, client", strings.TrimSpace(string(body)))
+				assert.NotEmpty(t, string(body))
+			},
+			expectedNotifications: map[string]int{},
+		},
 	}
 
 	publicAppTestCaseFactory := func(method string) testCase {
@@ -3071,6 +3158,152 @@ func registerDefaultK8sApps(t *testing.T, watcher *k8sapp.StateWatcher) {
 	require.True(t, watcher.WaitForCacheSync(t.Context()), "App CRD informer cache sync timed out")
 }
 
+// TestKaiPreviewSlidingRefresh is a focused regression test for the sliding-refresh path in
+// apphandler.serveHTTPOrError. It boots a dev-mode app via the standard harness but injects a
+// FakeClock so that time can be advanced deterministically.
+//
+//   - At t+1h (before midpoint of 4h TTL) → no Set-Cookie on the response.
+//   - At t+3h (past midpoint) → Set-Cookie: kbc-kai-preview-session=… appears and the new JWT
+//     validates as fresh (NeedsRefresh==false immediately after issuance).
+func TestKaiPreviewSlidingRefresh(t *testing.T) {
+	t.Parallel()
+	ctx := t.Context()
+
+	const sessionTTL = 4 * time.Hour
+
+	fakeClock := clockwork.NewFakeClock()
+
+	// Create testing apps API and upstream.
+	tmpDir := t.TempDir()
+	pm, _ := server.NewPortManager(t, tmpDir, "appsproxy")
+	appsAPI := testutil.StartDataAppsAPI(t, pm)
+	t.Cleanup(func() { appsAPI.Close() })
+	appServer := testutil.StartAppServer(t, pm)
+	t.Cleanup(func() { appServer.Close() })
+
+	providers := testAuthProviders(t, pm)
+	appURL := testutil.AppServerURL(t, appServer)
+	apps := testDataApps(appURL, providers)
+	appsAPI.Register(apps)
+
+	// Build the service scope with an injected FakeClock so the proxy sees our
+	// controlled notion of "now".
+	secret := make([]byte, 32)
+	_, err := rand.Read(secret)
+	require.NoError(t, err)
+	csrfSecret := make([]byte, 32)
+	_, err = rand.Read(csrfSecret)
+	require.NoError(t, err)
+
+	cfg := config.New()
+	cfg.API.PublicURL, _ = url.Parse("https://hub.keboola.local")
+	cfg.CookieSecretSalt = string(secret)
+	cfg.CsrfTokenSalt = string(csrfSecret)
+	cfg.SandboxesAPI.URL = appsAPI.URL
+	cfg.KaiPreview.SessionTTL = sessionTTL
+
+	d, mocked := proxyDependencies.NewMockedServiceScopeWithK8sObjects(
+		t, ctx, cfg,
+		makeDefaultK8sObjects(apps, appURL.String()),
+		dependencies.WithRealHTTPClient(),
+		dependencies.WithClock(fakeClock),
+	)
+	defer func() {
+		d.Process().Shutdown(ctx, errors.New("bye bye"))
+		d.Process().WaitForShutdown()
+	}()
+
+	// Wire logging the same way as createProxyHandler.
+	loggerWriter := logging.NewLoggerWriter(d.Logger(), "info")
+	logger.SetOutput(loggerWriter)
+	logger.SetErrOutput(loggerWriter)
+	handler := proxy.NewHandler(ctx, d)
+
+	// Boot a TLS proxy server. Bind to :0 to let the OS assign a free port atomically,
+	// eliminating the TOCTOU race that occurs when GetFreePort() releases the port before Listen().
+	var lc net.ListenConfig
+	l, err := lc.Listen(ctx, "tcp", "127.0.0.1:0")
+	require.NoError(t, err)
+	proxySrv := &httptest.Server{
+		Listener: l,
+		Config:   &http.Server{Handler: handler, ReadHeaderTimeout: 5 * time.Second, ErrorLog: log.NewStdErrorLogger(d.Logger())},
+	}
+	proxySrv.StartTLS()
+	t.Cleanup(func() { proxySrv.Close() })
+
+	proxyURL, err := url.Parse(proxySrv.URL)
+	require.NoError(t, err)
+	client := createHTTPClient(t, proxyURL)
+
+	// Wait for K8s informer to sync, then enable DevMode=Running for the "devmode" app.
+	registerDefaultK8sApps(t, d.AppStateWatcher())
+	patch := []byte(`{"spec":{"devMode":{"enabled":true}},"status":{"currentState":"Running"}}`)
+	_, err = mocked.TestFakeK8sClient().Resource(k8sapp.AppGVR()).Namespace("keboola").Patch(
+		ctx, "app-devmode", k8stypes.MergePatchType, patch, metav1.PatchOptions{},
+	)
+	require.NoError(t, err)
+	require.Eventually(t, func() bool {
+		info, ok := d.AppStateWatcher().GetState(ctx, api.AppID("devmode"))
+		return ok && info.DevMode && info.ActualState == k8sapp.AppActualStateRunning
+	}, 5*time.Second, 50*time.Millisecond)
+
+	// Retrieve the session signing key that the mocked scope auto-filled.
+	sessionKey := mocked.TestConfig().KaiPreview.SessionSigningKey
+
+	// Mint a session JWT anchored at FakeClock's current time (t=0).
+	rawJWT, err := kaipreview.MintSessionJWT(sessionKey, fakeClock, "devmode", "123", sessionTTL)
+	require.NoError(t, err)
+
+	sendRequest := func(t *testing.T) *http.Response {
+		t.Helper()
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, "https://dev-devmode.hub.keboola.local/", nil)
+		require.NoError(t, err)
+		req.AddCookie(&http.Cookie{Name: kaipreview.SessionCookieName, Value: rawJWT})
+		resp, err := client.Do(req)
+		require.NoError(t, err)
+		return resp
+	}
+
+	// --- t+1h: before midpoint — no refresh expected ---
+	fakeClock.Advance(1 * time.Hour)
+	resp := sendRequest(t)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	_, _ = io.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	var setCookieHeader string
+	for _, c := range resp.Cookies() {
+		if c.Name == kaipreview.SessionCookieName {
+			setCookieHeader = c.Value
+		}
+	}
+	assert.Empty(t, setCookieHeader, "expected no Set-Cookie at t+1h (before midpoint)")
+
+	// --- t+3h: past midpoint (3h > 4h/2) — refresh expected ---
+	fakeClock.Advance(2 * time.Hour) // total 3h elapsed
+	resp = sendRequest(t)
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+	_, _ = io.ReadAll(resp.Body)
+	resp.Body.Close()
+
+	var refreshedJWT string
+	for _, c := range resp.Cookies() {
+		if c.Name == kaipreview.SessionCookieName {
+			refreshedJWT = c.Value
+		}
+	}
+	require.NotEmpty(t, refreshedJWT, "expected Set-Cookie with refreshed JWT at t+3h")
+
+	// Verify the new JWT is valid and immediately fresh (NeedsRefresh should be false right now).
+	newClaims, err := kaipreview.VerifySessionJWT(sessionKey, fakeClock, refreshedJWT)
+	require.NoError(t, err)
+	assert.Equal(t, "devmode", newClaims.AppID)
+	assert.Equal(t, "123", newClaims.ProjectID)
+	assert.False(t, newClaims.NeedsRefresh(fakeClock.Now()), "newly minted JWT should not need refresh immediately")
+
+	assert.Empty(t, mocked.DebugLogger().ErrorMessages())
+}
+
 // makeDefaultK8sObjects converts a slice of app configs into K8s unstructured App CRD objects
 // with Running state and the given upstream URL. Pass the result to NewMockedServiceScopeWithK8sObjects
 // so the fake client is pre-populated before the informer starts.