diff --git a/src/handlers/accounts.rs b/src/handlers/accounts.rs
index 5054104..e6ee24a 100644
--- a/src/handlers/accounts.rs
+++ b/src/handlers/accounts.rs
@@ -343,6 +343,29 @@ pub async fn get_tasks() -> Result<Json<Value>, AppError> {
     })))
 }
 
+/// GET /api/auth-requests
+///
+/// Bitwarden clients may call this to fetch pending "login with device" auth requests.
+/// This minimal implementation doesn't support device auth requests, so we always return an empty list.
+///
+/// Vaultwarden currently aliases this endpoint to `/api/auth-requests/pending`.
+#[worker::send]
+pub async fn get_auth_requests(claims: Claims) -> Result<Json<Value>, AppError> {
+    get_auth_requests_pending(claims).await
+}
+
+/// GET /api/auth-requests/pending
+///
+/// Stub: always returns an empty list.
+#[worker::send]
+pub async fn get_auth_requests_pending(_claims: Claims) -> Result<Json<Value>, AppError> {
+    Ok(Json(json!({
+        "data": [],
+        "continuationToken": null,
+        "object": "list"
+    })))
+}
+
 #[worker::send]
 pub async fn get_profile(
     claims: Claims,
diff --git a/src/router.rs b/src/router.rs
index c11811d..6697758 100644
--- a/src/router.rs
+++ b/src/router.rs
@@ -47,6 +47,12 @@ pub fn api_router(env: Env) -> Router {
             "/api/accounts/key-management/rotate-user-account-keys",
             post(accounts::post_rotatekey),
         )
+        // Auth requests (login with device) - stub to prevent client 404s
+        .route("/api/auth-requests", get(accounts::get_auth_requests))
+        .route(
+            "/api/auth-requests/pending",
+            get(accounts::get_auth_requests_pending),
+        )
         // Ciphers CRUD
         .route("/api/ciphers", get(ciphers::list_ciphers))
         .route("/api/ciphers", post(ciphers::create_cipher_simple))