diff --git a/mautrix_telegram/web/provisioning/__init__.py b/mautrix_telegram/web/provisioning/__init__.py
index 95919c58..a792720b 100644
--- a/mautrix_telegram/web/provisioning/__init__.py
+++ b/mautrix_telegram/web/provisioning/__init__.py
@@ -31,12 +31,12 @@ class ProvisioningAPI(AuthAPI):
 
         self.app = web.Application(loop=loop)
 
-        self.app.router.add_route("GET", "/{mxid:@[^:]*:.+}/get_me", self.get_me)
-        login_prefix = "/login/{mxid:@[^:]*:.+}"
-        self.app.router.add_route("POST", f"{login_prefix}/bot_token", self.send_bot_token)
-        self.app.router.add_route("POST", f"{login_prefix}/request_code", self.request_code)
-        self.app.router.add_route("POST", f"{login_prefix}/send_code", self.send_code)
-        self.app.router.add_route("POST", f"{login_prefix}/send_password", self.send_password)
+        auth_prefix = "/auth/{mxid:@[^:]*:.+}"
+        self.app.router.add_route("GET", f"{auth_prefix}/get_me", self.get_me)
+        self.app.router.add_route("POST", f"{auth_prefix}/send_bot_token", self.send_bot_token)
+        self.app.router.add_route("POST", f"{auth_prefix}/request_code", self.request_code)
+        self.app.router.add_route("POST", f"{auth_prefix}/send_code", self.send_code)
+        self.app.router.add_route("POST", f"{auth_prefix}/send_password", self.send_password)
 
     def get_login_response(self, status=200, state="", username="", mxid="", message="", error="",
                            errcode=""):
diff --git a/mautrix_telegram/web/provisioning/spec.yaml b/mautrix_telegram/web/provisioning/spec.yaml
index 5766af2e..c0b5e3a6 100644
--- a/mautrix_telegram/web/provisioning/spec.yaml
+++ b/mautrix_telegram/web/provisioning/spec.yaml
@@ -26,7 +26,7 @@ tags:
 - name: Authentication
 
 paths:
-  /{mxid}/get_me:
+  /auth/{mxid}/get_me:
     get:
       operationId: get_me
       summary: Get the info of the Telegram user the given Matrix user is logged in as
@@ -71,7 +71,7 @@ paths:
                 type: string
                 description: The access token of the bot to log in as
                 example: "297900271:IXjeGEcAN61zHnjPgkWnYWyvVp9K4ulHBEv"
-  /login/{mxid}/bot_token:
+  /auth/{mxid}/send_bot_token:
     post:
       operationId: post_bot_token
       summary: Log in with a bot token
@@ -122,7 +122,7 @@ paths:
                 type: string
                 description: The access token of the bot to log in as
                 example: "297900271:IXjeGEcAN61zHnjPgkWnYWyvVp9K4ulHBEv"
-  /login/{mxid}/request_code:
+  /auth/{mxid}/request_code:
     post:
       operationId: post_login_phone
       summary: Request a phone code from Telegram
@@ -229,7 +229,7 @@ paths:
                 type: string
                 description: The phone number to log in as.
                 example: "+123456789"
-  /login/{mxid}/send_code:
+  /auth/{mxid}/send_code:
     post:
       operationId: post_login_code
       summary: Send the login code
@@ -297,7 +297,7 @@ paths:
                 description: The phone code from Telegram.
                 format: int32
                 example: 123456
-  /login/{mxid}/send_password:
+  /auth/{mxid}/send_password:
     post:
       operationId: post_login_password
       summary: Send the two-factor auth password