diff --git a/src/app/api/auth/route.ts b/src/app/api/auth/route.ts
index 4556625..06b0b15 100644
--- a/src/app/api/auth/route.ts
+++ b/src/app/api/auth/route.ts
@@ -1,6 +1,11 @@
 import { NextRequest, NextResponse } from "next/server";
-import { COOKIE, isAllowed, parseUsers, signSession, verifyPassword, SESSION_MAX_AGE } from "@/lib/auth";
+import { COOKIE, isAllowed, signSession, SESSION_MAX_AGE } from "@/lib/auth";
 
+const API_URL =
+  process.env.NEXT_PUBLIC_API_URL || "https://api.devops.norteamericano.cl";
+
+// Login IT: valida en el backend (sige_sam_v3.usuario, plano o SHA256)
+// y exige que el correo esté en IT_USERS (allowlist).
 export async function POST(req: NextRequest) {
   try {
     const { email, password } = await req.json();
@@ -8,10 +13,23 @@ export async function POST(req: NextRequest) {
     if (!mail || !password) {
       return NextResponse.json({ error: "Faltan credenciales" }, { status: 400 });
     }
-    const users = parseUsers();
-    const hash = users.get(mail);
-    if (!hash || !isAllowed(mail) || !(await verifyPassword(String(password), hash))) {
-      // Mensaje genérico: no revela si el correo existe
+    if (!isAllowed(mail)) {
+      await new Promise((r) => setTimeout(r, 600));
+      return NextResponse.json({ error: "Credenciales inválidas" }, { status: 401 });
+    }
+    let ok = false;
+    try {
+      const res = await fetch(`${API_URL}/api/Auth/it-login`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ email: mail, password: String(password) }),
+        cache: "no-store",
+      });
+      ok = res.ok;
+    } catch {
+      ok = false;
+    }
+    if (!ok) {
       await new Promise((r) => setTimeout(r, 600));
       return NextResponse.json({ error: "Credenciales inválidas" }, { status: 401 });
     }