diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
index 6a19c5f0d2..453e055cdf 100644
--- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
+++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx
@@ -51,6 +51,10 @@ export default function ProviderAuthPanel({
   const [addingKey, setAddingKey] = useState(false);
   const [newKey, setNewKey] = useState("");
   const [keyBusy, setKeyBusy] = useState(false);
+  const [importingJson, setImportingJson] = useState(false);
+  const [importJsonText, setImportJsonText] = useState("");
+  const [importBusy, setImportBusy] = useState(false);
+  const [importResult, setImportResult] = useState<{ imported: number; failed: number } | null>(null);
   const [reserveQuotaSlots, setReserveQuotaSlots] = useState(false);
   const deviceCodeCopy = useCopyFeedback<string>();
 
@@ -278,11 +282,93 @@ export default function ProviderAuthPanel({
             {accountLoadState === "ready" && loggedIn && accounts.length === 0 && (
               <div className="pwi-auth-state pwi-auth-state--empty">{t("pws.noAccounts")}</div>
             )}
-            {loggedIn && (
-              <button type="button" className="btn btn-ghost btn-sm" style={{ marginTop: 8 }}
-                onClick={() => void authHandlers.onLogin(item.name, true)} disabled={busy || Boolean(switchingAccountId)}>
-                {t("pws.addAccount")}
-              </button>
+            {importingJson ? (
+              <div className="pwi-auth-add-key" style={{ marginTop: 8, flexDirection: "column", alignItems: "stretch" }}>
+                <textarea
+                  className="input"
+                  rows={4}
+                  value={importJsonText}
+                  onChange={e => setImportJsonText(e.target.value)}
+                  placeholder='[{"email":"user@gmail.com","refresh_token":"1//..."}]'
+                  disabled={importBusy}
+                  style={{ fontFamily: "var(--font-mono, monospace)", fontSize: 12 }}
+                />
+                {importResult && (
+                  <div className="muted faint" style={{ fontSize: 12, marginTop: 4 }}>
+                    {t("pws.importResultSummary", { imported: importResult.imported, failed: importResult.failed })}
+                  </div>
+                )}
+                <div style={{ display: "flex", gap: 8, marginTop: 8 }}>
+                  <button
+                    type="button"
+                    className="btn btn-primary btn-sm"
+                    disabled={importBusy || !importJsonText.trim()}
+                    onClick={async () => {
+                      const text = importJsonText.trim();
+                      if (!text) return;
+                      setImportBusy(true);
+                      setImportResult(null);
+                      try {
+                        let parsed: unknown;
+                        try {
+                          parsed = JSON.parse(text);
+                        } catch (err) {
+                        void err;
+                          setImportResult({ imported: 0, failed: 1 });
+                          return;
+                        }
+                        const res = await fetch(`${apiBase}/api/oauth/accounts/import`, {
+                          method: "POST",
+                          headers: { "Content-Type": "application/json" },
+                          body: JSON.stringify({
+                            provider: item.name,
+                            accounts: Array.isArray(parsed) ? parsed : (parsed as { accounts?: unknown })?.accounts ?? parsed,
+                          }),
+                        });
+                        if (res.ok) {
+                          const data = (await res.json()) as { importedCount?: number; failedCount?: number };
+                          setImportResult({ imported: data.importedCount ?? 0, failed: data.failedCount ?? 0 });
+                          if ((data.importedCount ?? 0) > 0) {
+                            setImportJsonText("");
+                            void authHandlers.onRetryAccounts?.(item.name);
+                          }
+                        } else {
+                          setImportResult({ imported: 0, failed: 1 });
+                        }
+                      } catch (err) {
+                        void err;
+                        setImportResult({ imported: 0, failed: 1 });
+                      } finally {
+                        setImportBusy(false);
+                      }
+                    }}
+                  >
+                    {importBusy ? t("pws.saving") : t("pws.importJson")}
+                  </button>
+                  <button
+                    type="button"
+                    className="btn btn-ghost btn-sm"
+                    onClick={() => { setImportingJson(false); setImportJsonText(""); setImportResult(null); }}
+                  >
+                    {t("common.cancel")}
+                  </button>
+                </div>
+              </div>
+            ) : (
+              <div style={{ display: "flex", gap: 8, marginTop: 8 }}>
+                {loggedIn && (
+                  <button type="button" className="btn btn-ghost btn-sm"
+                    onClick={() => void authHandlers.onLogin(item.name, true)} disabled={busy || Boolean(switchingAccountId)}>
+                    {t("pws.addAccount")}
+                  </button>
+                )}
+                {item.name === "google-antigravity" && (
+                  <button type="button" className="btn btn-ghost btn-sm"
+                    onClick={() => setImportingJson(true)} disabled={busy || Boolean(switchingAccountId)}>
+                    {t("pws.importJsonCockpit")}
+                  </button>
+                )}
+              </div>
             )}
           </>
         )}
diff --git a/gui/src/i18n/de.ts b/gui/src/i18n/de.ts
index 46d78faceb..15fb4edc79 100644
--- a/gui/src/i18n/de.ts
+++ b/gui/src/i18n/de.ts
@@ -1454,6 +1454,9 @@ export const de: Record<TKey, string> = {
  "pws.noModelMatch": "Keine Modelle entsprechen dem Filter.",
   "pws.adapterBaseRequired": "Adapter und Basis-URL sind erforderlich.",
   "pws.addAccount": "Konto hinzufügen",
+  "pws.importJson": "JSON importieren",
+  "pws.importJsonCockpit": "JSON importieren (Cockpit)",
+  "pws.importResultSummary": "{imported} Konto/en importiert, {failed} fehlgeschlagen.",
   "pws.addKey": "API-Schlüssel hinzufügen",
   "pws.apiKeys": "API-Schlüssel",
   "pws.authMode": "Auth-Modus",
diff --git a/gui/src/i18n/en.ts b/gui/src/i18n/en.ts
index 8389a237a2..9bafb63c22 100644
--- a/gui/src/i18n/en.ts
+++ b/gui/src/i18n/en.ts
@@ -1005,6 +1005,9 @@ export const en = {
  "pws.noModelMatch": "No models match the filter.",
   "pws.adapterBaseRequired": "Adapter and base URL are required.",
   "pws.addAccount": "Add account",
+  "pws.importJson": "Import JSON",
+  "pws.importJsonCockpit": "Import JSON (Cockpit)",
+  "pws.importResultSummary": "Imported {imported} account(s), {failed} failed.",
   "pws.addKey": "Add API key",
   "pws.apiKeys": "API Keys",
   "pws.authMode": "Auth mode",
diff --git a/gui/src/i18n/ja.ts b/gui/src/i18n/ja.ts
index 77aaa0dd82..ebe28d5468 100644
--- a/gui/src/i18n/ja.ts
+++ b/gui/src/i18n/ja.ts
@@ -953,6 +953,9 @@ export const ja: Record<TKey, string> = {
   "pws.noModelMatch": "フィルタに一致するモデルがありません。",
   "pws.adapterBaseRequired": "アダプターとベース URL は必須です。",
   "pws.addAccount": "アカウントを追加",
+  "pws.importJson": "JSON をインポート",
+  "pws.importJsonCockpit": "JSON をインポート (Cockpit)",
+  "pws.importResultSummary": "{imported} 件のアカウントをインポートしました（失敗: {failed} 件）。",
   "pws.addKey": "API キーを追加",
   "pws.apiKeys": "API キー",
   "pws.authMode": "認証モード",
diff --git a/gui/src/i18n/ko.ts b/gui/src/i18n/ko.ts
index 93e03755ec..b684c194c5 100644
--- a/gui/src/i18n/ko.ts
+++ b/gui/src/i18n/ko.ts
@@ -1481,6 +1481,9 @@ export const ko: Record<TKey, string> = {
  "pws.noModelMatch": "필터와 일치하는 모델이 없습니다.",
   "pws.adapterBaseRequired": "어댑터와 기본 URL은 필수입니다.",
   "pws.addAccount": "계정 추가",
+  "pws.importJson": "JSON 가져오기",
+  "pws.importJsonCockpit": "JSON 가져오기 (Cockpit)",
+  "pws.importResultSummary": "{imported}개 계정을 가져왔습니다 ({failed}개 실패).",
   "pws.addKey": "API 키 추가",
   "pws.apiKeys": "API 키",
   "pws.authMode": "인증 방식",
diff --git a/gui/src/i18n/ru.ts b/gui/src/i18n/ru.ts
index 48e9149b63..319a38ff42 100644
--- a/gui/src/i18n/ru.ts
+++ b/gui/src/i18n/ru.ts
@@ -995,6 +995,9 @@ export const ru: Record<TKey, string> = {
   "pws.noModelMatch": "Нет моделей, соответствующих фильтру.",
   "pws.adapterBaseRequired": "Укажите адаптер и базовый URL.",
   "pws.addAccount": "Добавить аккаунт",
+  "pws.importJson": "Импортировать JSON",
+  "pws.importJsonCockpit": "Импорт JSON (Cockpit)",
+  "pws.importResultSummary": "Импортировано аккаунтов: {imported}, ошибок: {failed}.",
   "pws.addKey": "Добавить API-ключ",
   "pws.apiKeys": "API-ключи",
   "pws.authMode": "Режим аутентификации",
diff --git a/gui/src/i18n/zh.ts b/gui/src/i18n/zh.ts
index 15e6053b33..9ee969e49c 100644
--- a/gui/src/i18n/zh.ts
+++ b/gui/src/i18n/zh.ts
@@ -1474,6 +1474,9 @@ export const zh: Record<TKey, string> = {
  "pws.noModelMatch": "没有匹配筛选的模型。",
   "pws.adapterBaseRequired": "适配器和基本 URL 为必填项。",
   "pws.addAccount": "添加账户",
+  "pws.importJson": "导入 JSON",
+  "pws.importJsonCockpit": "导入 JSON (Cockpit)",
+  "pws.importResultSummary": "已导入 {imported} 个账户，{failed} 个失败。",
   "pws.addKey": "添加 API 密钥",
   "pws.apiKeys": "API 密钥",
   "pws.authMode": "认证方式",
diff --git a/src/cli/account-extended.ts b/src/cli/account-extended.ts
index 500d407bec..bff0d51d35 100644
--- a/src/cli/account-extended.ts
+++ b/src/cli/account-extended.ts
@@ -20,7 +20,8 @@ const EXTENDED_USAGE = `Usage:
   ocx account alias <provider> <id|main> <display-name|-> [--json]
   ocx account remove <provider> <id|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|main> [--json]
-  ocx account add-key <provider> [--label <label>] [--json]`;
+  ocx account add-key <provider> [--label <label>] [--json]
+  ocx account import <provider> <file-or-json> [--json]`;
 const PIPE_GUIDANCE = `Pipe the API key on stdin, for example:
   ocx account add-key <provider> <<< "$MY_KEY"
   security find-generic-password -w <item> | ocx account add-key <provider>`;
@@ -348,3 +349,63 @@ export async function cmdAlias(args: string[], deps: AccountDeps): Promise<numbe
   else console.log(alias ? `${name}: ${requestedId} is now “${alias}”` : `${name}: cleared alias for ${requestedId}`);
   return 0;
 }
+
+
+export async function cmdImport(args: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = flag(args, "--json");
+  const name = args.shift();
+  const input = args.shift();
+  if (!name || !input || args.length) return usage();
+
+  const classified = configAndType(deps, name);
+  if ("error" in classified) return usage(`Error: ${classified.error}`);
+  if (classified.type !== "oauth") {
+    return usage("Error: account import only applies to OAuth providers (such as google-antigravity)");
+  }
+
+  let jsonText = input;
+  const { existsSync, readFileSync } = await import("node:fs");
+  if (existsSync(input)) {
+    try {
+      jsonText = readFileSync(input, "utf8");
+    } catch (err) {
+      return usage(`Error reading file "${input}": ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(jsonText);
+  } catch (err) {
+    return usage(`Error parsing JSON: ${err instanceof Error ? err.message : String(err)}`);
+  }
+
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+
+  const response = await apiJson(deps, baseUrl, "POST", "/api/oauth/accounts/import", {
+    provider: name,
+    accounts: Array.isArray(parsed) ? parsed : (parsed as { accounts?: unknown })?.accounts ?? parsed,
+  });
+
+  if (response.status === 0) return proxyUnreachable();
+  if (response.status !== 200) return apiError(response.json, `failed to import accounts for ${name}`);
+
+  if (wantsJson) {
+    console.log(JSON.stringify(response.json, null, 2));
+  } else {
+    const imp = response.json.importedCount ?? 0;
+    const fail = response.json.failedCount ?? 0;
+    console.log(`${name}: imported ${imp} account(s) successfully (${fail} failed)`);
+    if (Array.isArray(response.json.results)) {
+      for (const res of response.json.results) {
+        if (res.status === "imported") {
+          console.log(`  ✓ ${res.email ?? res.accountId}`);
+        } else {
+          console.log(`  ✗ ${res.email ?? "account"}: ${res.error}`);
+        }
+      }
+    }
+  }
+  return 0;
+}
diff --git a/src/cli/account.ts b/src/cli/account.ts
index d9bc38687b..3ba9a3e6c5 100644
--- a/src/cli/account.ts
+++ b/src/cli/account.ts
@@ -2,7 +2,7 @@
 import { loadConfig } from "../config";
 import { providerCodexAccountMode } from "../providers/registry";
 import type { OcxConfig } from "../types";
-import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdRefresh, cmdRemove } from "./account-extended";
+import { cmdAddKey, cmdAlias, cmdAutoSwitch, cmdClearCooldown, cmdImport, cmdRefresh, cmdRemove } from "./account-extended";
 import { apiError, apiJson, classifyAccount, fetchRows, proxyUnreachable, resolveBaseUrl, type AccountDeps, type AccountRow, type AccountType, type ApiResult }
   from "./account-api";
 
@@ -25,6 +25,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account remove <provider> <account-or-key-id|main> --yes [--json]
   ocx account clear-cooldown <provider> <account-id|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
+  ocx account import <provider> <file-or-json> [--json]
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
   ocx account cancel <provider> [--flow <flow-id>] [--json]
@@ -263,6 +264,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
+    if (sub === "import") return await cmdImport(rest, deps);
     if (sub === "main") {
       const { cmdNativeMainAccount } = await import("./account-main");
       return await cmdNativeMainAccount(rest, deps);
diff --git a/src/server/management/oauth-account-routes.ts b/src/server/management/oauth-account-routes.ts
index f3db21c6a6..22da9e8ffa 100644
--- a/src/server/management/oauth-account-routes.ts
+++ b/src/server/management/oauth-account-routes.ts
@@ -376,6 +376,93 @@ export async function handleOauthAccountRoutes(ctx: ManagementContext): Promise<
     return jsonResponse({ ok: true, cleared });
   }
 
+  if (url.pathname === "/api/oauth/accounts/import" && req.method === "POST") {
+    const rawBody = await readManagementJsonBodyOr(req, null);
+    let provider = (url.searchParams.get("provider") ?? "").trim().toLowerCase();
+    let accountEntriesRaw: unknown[] = [];
+
+    if (Array.isArray(rawBody)) {
+      accountEntriesRaw = rawBody;
+    } else if (isPlainRecord(rawBody)) {
+      if (typeof rawBody.provider === "string" && rawBody.provider.trim()) {
+        provider = rawBody.provider.trim().toLowerCase();
+      }
+      if (Array.isArray(rawBody.accounts)) {
+        accountEntriesRaw = rawBody.accounts;
+      }
+    }
+
+    if (!provider) provider = "google-antigravity";
+    if (!isPublicOAuthProvider(provider)) return jsonResponse({ error: "unknown oauth provider" }, 400);
+    if (provider !== "google-antigravity") {
+      return jsonResponse({ error: "account import is currently only supported for google-antigravity" }, 400);
+    }
+    if (accountEntriesRaw.length === 0) return jsonResponse({ error: "no valid accounts array provided" }, 400);
+    if (accountEntriesRaw.length > 100) return jsonResponse({ error: "batch import exceeds maximum limit of 100 accounts" }, 400);
+
+    const { saveCredential, getAccountSet } = await import("../../oauth/store");
+    const { refreshAntigravityToken } = await import("../../oauth/google-antigravity");
+    const { clearProviderQuotaCache, clearAccountQuotaCache } = await import("../../providers/quota");
+
+    const results: Array<{ email?: string; accountId?: string; status: "imported" | "failed"; error?: string }> = [];
+    let importedCount = 0;
+    let failedCount = 0;
+
+    for (const rawItem of accountEntriesRaw) {
+      if (!isPlainRecord(rawItem)) {
+        results.push({ status: "failed", error: "invalid account object" });
+        failedCount++;
+        continue;
+      }
+
+      const entry = rawItem as Record<string, unknown>;
+      const refreshToken = (
+        (typeof entry.refresh_token === "string" ? entry.refresh_token : "")
+        || (typeof entry.refreshToken === "string" ? entry.refreshToken : "")
+        || (typeof entry.refresh === "string" ? entry.refresh : "")
+      ).trim();
+      const inputEmail = typeof entry.email === "string" ? entry.email.trim().toLowerCase() : undefined;
+
+      if (!refreshToken) {
+        results.push({ email: inputEmail, status: "failed", error: "missing refresh token" });
+        failedCount++;
+        continue;
+      }
+
+      try {
+        const creds = await refreshAntigravityToken(refreshToken);
+        if (inputEmail && !creds.email) creds.email = inputEmail;
+        const identity = creds.accountId ?? creds.email;
+        if (!identity) {
+          results.push({ email: inputEmail, status: "failed", error: "account identity required (email or accountId)" });
+          failedCount++;
+          continue;
+        }
+        await saveCredential(provider, creds, { preserveIdentityless: true });
+        const set = getAccountSet(provider);
+        const activeAcc = set?.accounts.find(a => (a.credential.accountId ?? a.credential.email) === identity);
+        results.push({ email: creds.email ?? inputEmail, accountId: activeAcc?.id, status: "imported" });
+        importedCount++;
+      } catch (err) {
+        results.push({ email: inputEmail, status: "failed", error: err instanceof Error ? err.message : String(err) });
+        failedCount++;
+      }
+    }
+
+    reconcileLiveStateStores();
+    clearProviderQuotaCache();
+    clearAccountQuotaCache(provider);
+
+    return jsonResponse({
+      ok: importedCount > 0,
+      provider,
+      importedCount,
+      failedCount,
+      totalCount: accountEntriesRaw.length,
+      results,
+    });
+  }
+
   if (url.pathname === "/api/oauth/accounts/alias" && req.method === "PUT") {
     const body = await readManagementJsonBodyOr(req, {}) as { provider?: unknown; accountId?: unknown; alias?: unknown };
     const provider = typeof body.provider === "string" ? body.provider.trim().toLowerCase() : "";
diff --git a/tests/cli-account.test.ts b/tests/cli-account.test.ts
index c767aad8a4..ed7be6d1d3 100644
--- a/tests/cli-account.test.ts
+++ b/tests/cli-account.test.ts
@@ -206,7 +206,32 @@ async function mockManagementApi(req: Request): Promise<Response> {
     return json({ ok: true, activeAccountId: accountId });
   }
 
-  if (req.method === "PUT" && url.pathname === "/api/oauth/accounts/alias") {
+  if (req.method === "POST" && url.pathname === "/api/oauth/accounts/import") {
+    const payload = body as { provider?: string; accounts?: Array<{ email?: string; refresh_token?: string }> };
+    if (payload.provider !== "google-antigravity") {
+      return json({ error: "account import is currently only supported for google-antigravity" }, 400);
+    }
+    const accounts = payload.accounts ?? [];
+    if (!Array.isArray(accounts) || accounts.length === 0) {
+      return json({ error: "no valid accounts array provided" }, 400);
+    }
+    const importedCount = accounts.filter(a => a && typeof a === "object" && typeof (a as { refresh_token?: string }).refresh_token === "string" && (a as { refresh_token: string }).refresh_token.startsWith("1//")).length;
+    const failedCount = accounts.length - importedCount;
+    return json({
+      ok: importedCount > 0,
+      provider: payload.provider,
+      importedCount,
+      failedCount,
+      totalCount: accounts.length,
+      results: accounts.map(a => ({
+        email: (a && typeof a === "object" && (a as { email?: string }).email) || "imported@example.com",
+        status: (a && typeof a === "object" && typeof (a as { refresh_token?: string }).refresh_token === "string" && (a as { refresh_token: string }).refresh_token.startsWith("1//")) ? "imported" : "failed",
+        error: (a && typeof a === "object" && typeof (a as { refresh_token?: string }).refresh_token === "string" && (a as { refresh_token: string }).refresh_token.startsWith("1//")) ? undefined : "invalid refresh token",
+      })),
+    });
+  }
+
+    if (req.method === "PUT" && url.pathname === "/api/oauth/accounts/alias") {
     const payload = body as { accountId: string; alias: string };
     const account = oauthAccounts.find(entry => entry.id === payload.accountId);
     if (!account) return json({ error: "account not found" }, 404);
@@ -1329,4 +1354,46 @@ describe("ocx account CLI (issue #180 matrix)", () => {
       sleepSpy.mockRestore();
     }
   });
+
+  test("ocx account import validates inputs and outputs results", async () => {
+    const missingArgs = await run(["import"]);
+    expect(missingArgs.code).toBe(1);
+    expect(missingArgs.stderr).toContain("ocx account import");
+
+    const nonOauth = await run(["import", "openai", '[{"refresh_token":"1//abc"}]']);
+    expect(nonOauth.code).toBe(1);
+    expect(nonOauth.stderr).toContain("account import only applies to OAuth providers");
+
+    const badJson = await run(["import", "google-antigravity", "{not-valid-json}"]);
+    expect(badJson.code).toBe(1);
+    expect(badJson.stderr).toContain("Error parsing JSON");
+
+    const inlineOk = await run(["import", "google-antigravity", '[{"email":"user@gmail.com","refresh_token":"1//abc"}]']);
+    expect(inlineOk.code).toBe(0);
+    expect(inlineOk.stdout).toContain("google-antigravity: imported 1 account(s) successfully (0 failed)");
+    expect(inlineOk.stdout).toContain("✓ user@gmail.com");
+
+    const jsonOutput = await run(["import", "google-antigravity", '[{"email":"user@gmail.com","refresh_token":"1//abc"}]', "--json"]);
+    expect(jsonOutput.code).toBe(0);
+    expect(jsonOutput.stdout).toContain('"importedCount": 1');
+
+    // Test file-based JSON import
+    const { writeFileSync, unlinkSync } = await import("node:fs");
+    const { tmpdir } = await import("node:os");
+    const { join } = await import("node:path");
+    const filePath = join(tmpdir(), `test-import-${Date.now()}.json`);
+    writeFileSync(filePath, '[{"email":"fileuser@gmail.com","refresh_token":"1//file"}]');
+    try {
+      const fileOk = await run(["import", "google-antigravity", filePath]);
+      expect(fileOk.code).toBe(0);
+      expect(fileOk.stdout).toContain("google-antigravity: imported 1 account(s) successfully");
+      expect(fileOk.stdout).toContain("✓ fileuser@gmail.com");
+    } finally {
+      try {
+        unlinkSync(filePath);
+      } catch (err) {
+        void err;
+      }
+    }
+  });
 });
diff --git a/tests/oauth-accounts-api.test.ts b/tests/oauth-accounts-api.test.ts
index 7d50b81dc7..11989c3d91 100644
--- a/tests/oauth-accounts-api.test.ts
+++ b/tests/oauth-accounts-api.test.ts
@@ -175,6 +175,66 @@ describe("multiauth accounts API", () => {
     }
   });
 
+
+  test("POST import validates provider and accounts payload", async () => {
+    const originalFetch = globalThis.fetch;
+    globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => {
+      const urlStr = typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      if (urlStr.includes("oauth2.googleapis.com/token")) {
+        return new Response(JSON.stringify({ error: "invalid_grant", error_description: "Invalid refresh token" }), { status: 400 });
+      }
+      return originalFetch(input, init);
+    }) as typeof globalThis.fetch;
+
+    const server = startServer(0);
+    try {
+      const badProvider = await fetch(new URL("/api/oauth/accounts/import", server.url), {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider: "not-a-provider", accounts: [{ refresh_token: "1//foo" }] }),
+      });
+      expect(badProvider.status).toBe(400);
+
+      const nonAntigravityProvider = await fetch(new URL("/api/oauth/accounts/import", server.url), {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider: "anthropic", accounts: [{ refresh_token: "1//foo" }] }),
+      });
+      expect(nonAntigravityProvider.status).toBe(400);
+
+      const emptyAccounts = await fetch(new URL("/api/oauth/accounts/import", server.url), {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider: "google-antigravity", accounts: [] }),
+      });
+      expect(emptyAccounts.status).toBe(400);
+
+      const tooManyAccounts = await fetch(new URL("/api/oauth/accounts/import", server.url), {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ provider: "google-antigravity", accounts: Array(101).fill({ refresh_token: "1//foo" }) }),
+      });
+      expect(tooManyAccounts.status).toBe(400);
+      const tooManyJson = await tooManyAccounts.json() as { error: string };
+      expect(tooManyJson.error).toContain("exceeds maximum limit");
+
+      const invalidTokenAndNonObject = await fetch(new URL("/api/oauth/accounts/import", server.url), {
+        method: "POST", headers: { "Content-Type": "application/json" },
+        body: JSON.stringify([
+          "not-an-object",
+          { email: "bad@example.com", refresh_token: "invalid-token" }
+        ]),
+      });
+      expect(invalidTokenAndNonObject.status).toBe(200);
+      const resJson = await invalidTokenAndNonObject.json() as { ok: boolean; totalCount: number; failedCount: number; results: Array<{ status: string; error?: string }> };
+      expect(resJson.ok).toBe(false);
+      expect(resJson.totalCount).toBe(2);
+      expect(resJson.failedCount).toBe(2);
+      expect(resJson.results[0]?.status).toBe("failed");
+      expect(resJson.results[0]?.error).toBe("invalid account object");
+      expect(resJson.results[1]?.status).toBe("failed");
+    } finally {
+      globalThis.fetch = originalFetch;
+      await server.stop(true);
+    }
+  });
+
   test("DELETE removes one account; active removal promotes the other", async () => {
     const server = startServer(0);
     try {