diff --git a/crates/kv-proto/src/lib.rs b/crates/kv-proto/src/lib.rs
index bae488a..e495cf1 100644
--- a/crates/kv-proto/src/lib.rs
+++ b/crates/kv-proto/src/lib.rs
@@ -134,6 +134,14 @@ pub struct SetupRequest {
     pub device: DeviceEnroll,
 }
 
+/// `GET /v1/auth/prelogin`: the public inputs a new device needs to derive `AUTH_INPUT`
+/// before it can build `ke1` (docs/02 "Key derivation"). Unauthenticated, rate limited.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct PreloginResponse {
+    pub account_id: Uuid,
+    pub kdf: KdfParams,
+}
+
 /// `POST /v1/auth/login/start`.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct LoginStart {