diff --git a/apps/core/src/pages/desktop-signin.tsx b/apps/core/src/pages/desktop-signin.tsx
index de957fffe2..f258fc16f2 100644
--- a/apps/core/src/pages/desktop-signin.tsx
+++ b/apps/core/src/pages/desktop-signin.tsx
@@ -1,7 +1,8 @@
-import type { LoaderFunction } from 'react-router-dom';
+import { getSession } from 'next-auth/react';
+import { type LoaderFunction } from 'react-router-dom';
 import { z } from 'zod';
 
-import { signInCloud } from '../utils/cloud-utils';
+import { signInCloud, signOutCloud } from '../utils/cloud-utils';
 
 const supportedProvider = z.enum(['google']);
 
@@ -13,6 +14,16 @@ export const loader: LoaderFunction = async ({ request }) => {
   if (!callback_url) {
     return null;
   }
+
+  const session = await getSession();
+
+  if (session) {
+    // already signed in, need to sign out first
+    await signOutCloud({
+      callbackUrl: request.url, // retry
+    });
+  }
+
   const maybeProvider = supportedProvider.safeParse(provider);
   if (maybeProvider.success) {
     const provider = maybeProvider.data;
diff --git a/apps/core/src/pages/open-app.tsx b/apps/core/src/pages/open-app.tsx
index f452d6b165..00d828af9d 100644
--- a/apps/core/src/pages/open-app.tsx
+++ b/apps/core/src/pages/open-app.tsx
@@ -57,7 +57,7 @@ interface OpenAppProps {
 }
 
 interface LoaderData {
-  action: 'url' | 'oauth-jwt';
+  action: 'url' | 'signin-redirect';
   currentUser?: GetCurrentUserQuery['currentUser'];
 }
 
@@ -86,12 +86,7 @@ const OpenAppImpl = ({ urlToOpen, channel }: OpenAppProps) => {
   return (
     <div className={styles.root}>
       <div className={styles.topNav}>
-        <a
-          href="https://affine.pro"
-          target="_blank"
-          rel="noreferrer"
-          className={styles.affineLogo}
-        >
+        <a href="/" rel="noreferrer" className={styles.affineLogo}>
           <Logo1Icon width={24} height={24} />
         </a>
 
@@ -182,7 +177,7 @@ const OpenOAuthJwt = () => {
     return null;
   }
 
-  const urlToOpen = `${schema}://oauth-jwt?token=${currentUser.token.sessionToken}`;
+  const urlToOpen = `${schema}://signin-redirect?token=${currentUser.token.sessionToken}`;
 
   return <OpenAppImpl urlToOpen={urlToOpen} channel={channel} />;
 };
@@ -192,7 +187,7 @@ export const Component = () => {
 
   if (action === 'url') {
     return <OpenUrl />;
-  } else if (action === 'oauth-jwt') {
+  } else if (action === 'signin-redirect') {
     return <OpenOAuthJwt />;
   }
   return null;
diff --git a/apps/core/src/utils/cloud-utils.tsx b/apps/core/src/utils/cloud-utils.tsx
index c2b1e43f62..bb8fe43b31 100644
--- a/apps/core/src/utils/cloud-utils.tsx
+++ b/apps/core/src/utils/cloud-utils.tsx
@@ -54,7 +54,7 @@ export const signInCloud: typeof signIn = async (provider, ...rest) => {
         `${
           runtimeConfig.serverUrlPrefix
         }/desktop-signin?provider=google&callback_url=${buildCallbackUrl(
-          '/open-app/oauth-jwt'
+          '/open-app/signin-redirect'
         )}`,
         '_target'
       );
@@ -63,7 +63,9 @@ export const signInCloud: typeof signIn = async (provider, ...rest) => {
       const [options, ...tail] = rest;
       const callbackUrl =
         runtimeConfig.serverUrlPrefix +
-        (provider === 'email' ? '/open-app/oauth-jwt' : location.pathname);
+        (provider === 'email'
+          ? '/open-app/signin-redirect'
+          : location.pathname);
       return signIn(
         provider,
         {
@@ -85,8 +87,8 @@ export const signInCloud: typeof signIn = async (provider, ...rest) => {
 export const signOutCloud: typeof signOut = async options => {
   const traceParams = genTraceParams();
   return signOut({
-    ...options,
     callbackUrl: '/',
+    ...options,
   })
     .then(result => {
       if (result) {
diff --git a/apps/electron/src/main/deep-link.ts b/apps/electron/src/main/deep-link.ts
index 3c77e83d3c..d006c55bb5 100644
--- a/apps/electron/src/main/deep-link.ts
+++ b/apps/electron/src/main/deep-link.ts
@@ -59,7 +59,7 @@ async function handleAffineUrl(url: string) {
   logger.info('handle affine schema action', urlObj.hostname);
   // handle more actions here
   // hostname is the action name
-  if (urlObj.hostname === 'oauth-jwt') {
+  if (urlObj.hostname === 'signin-redirect') {
     await handleOauthJwt(url);
   }
 }