diff --git a/branding/config/vendor.conf b/branding/config/vendor.conf
index ac0f4b12008b9b7c39e2159a1707903d68139089..90ef36cf2d7f6588961c0aa3c6cff08416adb3af 100644
--- a/branding/config/vendor.conf
+++ b/branding/config/vendor.conf
@@ -72,7 +72,7 @@ binaryName          = demo-lib
 auth                = sip
 
 providerURL         = vpnlib.bitmask.net
-apiURL              = https://api.vpnlib.bitmask.net/
+apiURL              = https://api.vpnlib.bitmask.net:4430/
 caURL               = https://api.vpnlib.bitmask.net/ca.crt
 
 infoURL             = https://libraryvpn.org/
diff --git a/gui/gui.qrc b/gui/gui.qrc
index 28fcf7f4ea949ee8c40f1c70212dfd2be27247a3..6bc3d8def828e73ba90b695983d7fa43c2f7b81f 100644
--- a/gui/gui.qrc
+++ b/gui/gui.qrc
@@ -4,6 +4,7 @@
         <file>qml/AboutDialog.qml</file>
         <file>qml/DonateDialog.qml</file>
         <file>qml/LoginDialog.qml</file>
+        <file>qml/LoginOKDialog.qml</file>
          
         <file>assets/icon/png/black/vpn_off.png</file>
         <file>assets/icon/png/black/vpn_on.png</file>
diff --git a/gui/qml/LoginConfirmation.qml b/gui/qml/LoginConfirmation.qml
deleted file mode 100644
index 618b870508d74d67c3538b65337beeca7ff34285..0000000000000000000000000000000000000000
--- a/gui/qml/LoginConfirmation.qml
+++ /dev/null
@@ -1,11 +0,0 @@
-import QtQuick 2.0
-import QtQuick.Dialogs 1.2
-import QtQuick.Controls 1.4
-
-Dialog {
-    standardButtons: StandardButton.Ok
-    title: qsTr("Login Success")
-    text: qsTr("You are now logged in, connecting now")
-
-    visible: ctxSystray.loginConfirmationDialog == true
-}
diff --git a/gui/qml/LoginOKDialog.qml b/gui/qml/LoginOKDialog.qml
new file mode 100644
index 0000000000000000000000000000000000000000..52b37701f75c3d1c0f6b27bc81f866fc1d58c27c
--- /dev/null
+++ b/gui/qml/LoginOKDialog.qml
@@ -0,0 +1,23 @@
+import QtQuick 2.0
+import QtQuick.Dialogs 1.2
+import QtQuick.Controls 1.4
+
+Dialog {
+    standardButtons: StandardButton.Ok
+    title: qsTr("Login Successful")
+    Column {
+        anchors.fill: parent
+        Text {
+            text: qsTr("Login successful. You can now start the VPN.")
+        }
+    }
+
+    // TODO implement cleanNotifications on backend
+    function _loginOk() {
+        loginDone = true;
+    }
+
+    visible: false
+    onAccepted: _loginOk()
+    onRejected: _loginOk()
+}
diff --git a/gui/qml/main.qml b/gui/qml/main.qml
index 0242493417fc453df7c1147dfbd0c8ac31e749cb..f22bdf360290f1b7513d9498250c3b63b6d9e0a0 100644
--- a/gui/qml/main.qml
+++ b/gui/qml/main.qml
@@ -10,6 +10,7 @@ ApplicationWindow {
     visible: false
 
     property var ctx
+    property var loginDone 
 
     Connections {
         target: jsonModel
@@ -23,6 +24,9 @@ ApplicationWindow {
                 console.debug(jsonModel.getJson())
                 login.visible = true
             }
+            if (ctx.loginOk == 'true' && loginDone == false) {
+                loginOk.visible = true
+            }
             if (ctx.errors ) {
                if ( ctx.errors  == "nohelpers" ) {
                    showInitFailure(qsTr("Could not find helpers. Check your installation"))
@@ -44,6 +48,8 @@ ApplicationWindow {
     }
 
     Component.onCompleted: {
+        loginDone = false;
+
         /* stupid as it sounds, windows doesn't like to have the systray icon
          not being attached to an actual application window.
          We can still use this quirk, and can use the AppWindow with deferred
@@ -228,6 +234,11 @@ ApplicationWindow {
         visible: false
     }
 
+    LoginOKDialog{
+        id: loginOk
+        visible: false
+    }
+
     MessageDialog {
         id: errorStartingVPN
         buttons: MessageDialog.Ok
diff --git a/pkg/backend/api.go b/pkg/backend/api.go
index 7b48906ee6207becb473ccf2aa167a48badddb07..6609b1b7f65c21ecf7995713623d079f6445cace 100644
--- a/pkg/backend/api.go
+++ b/pkg/backend/api.go
@@ -16,16 +16,19 @@ import (
 func Login(username, password string) {
 	success, err := ctx.bm.DoLogin(username, password)
 	if err != nil {
-		// TODO
-		log.Printf("Error login: %v", err)
+		log.Printf("Error on login: %v", err)
+		ctx.Errors = "bad_auth_unknown"
 	} else if success {
-		// TODO: Notify success
 		log.Printf("Logged in as %s", username)
+		ctx.LoginOk = true
+		ctx.LoginDialog = false
 	} else {
 		// TODO: display login again with an err
 		log.Printf("Failed to login as %s", username)
 		ctx.LoginDialog = true
+		ctx.Errors = "bad_auth"
 	}
+	go ctx.updateStatus()
 }
 
 func SwitchOn() {
diff --git a/pkg/backend/status.go b/pkg/backend/status.go
index 5e9a0f800cc1eda32ab89e011e51827452041d4b..f06d26df5536106416bf55c568142ed8dbc83785 100644
--- a/pkg/backend/status.go
+++ b/pkg/backend/status.go
@@ -38,6 +38,7 @@ type connectionCtx struct {
 	DonateDialog    bool   `json:"donateDialog"`
 	DonateURL       string `json:"donateURL"`
 	LoginDialog     bool   `json:"loginDialog"`
+	LoginOk         bool   `json:"loginOk"`
 	Version         string `json:"version"`
 	Errors          string `json:"errors"`
 	Status          status `json:"status"`
diff --git a/pkg/bitmask/bitmask.go b/pkg/bitmask/bitmask.go
index 927e4868d9ed414380b71c6bf6f194076f871b9c..adfc8491cb89f0374507488ce6225133c9f977b1 100644
--- a/pkg/bitmask/bitmask.go
+++ b/pkg/bitmask/bitmask.go
@@ -20,6 +20,7 @@ type Bitmask interface {
 	Close()
 	Version() (string, error)
 	StartVPN(provider string) error
+	CanStartVPN() bool
 	StopVPN() error
 	ReloadFirewall() error
 	GetStatus() (string, error)
diff --git a/pkg/bitmask/init.go b/pkg/bitmask/init.go
index a96ab870047c44bd2bb730089054ad1109d891d3..b86deb825c5384e1058378e364f954e006bc7fac 100644
--- a/pkg/bitmask/init.go
+++ b/pkg/bitmask/init.go
@@ -131,7 +131,10 @@ func maybeStartVPN(b Bitmask, conf *config.Config) error {
 		return nil
 	}
 
-	err := b.StartVPN(config.Provider)
-	conf.SetUserStoppedVPN(false)
-	return err
+	if b.CanStartVPN() {
+		err := b.StartVPN(config.Provider)
+		conf.SetUserStoppedVPN(false)
+		return err
+	}
+	return nil
 }
diff --git a/pkg/config/config.go b/pkg/config/config.go
index e9866d2603d2b2e3f8bc33b875ed1c58c6ef938a..f3f9e6e0cef9f4b14e58346126ebb0a9c1b211d2 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -1,6 +1,6 @@
 // Code generated by go generate; DO NOT EDIT.
 // This file was generated by vendorize.py
-// At 2020-08-13 22:38:42
+// At 2020-08-15 20:39:01
 
 package config
 
@@ -15,7 +15,7 @@ const (
 	AskForDonations = "false"
 	HelpURL         = "https://libraryvpn.org/"
 	TosURL          = "https://libraryvpn.org/"
-	APIURL          = "https://api.vpnlib.bitmask.net/"
+	APIURL          = "https://api.vpnlib.bitmask.net:4430/"
 	GeolocationAPI  = "https://getmyip.vpnlib.bitmask.net/"
 )
 
diff --git a/pkg/vpn/bonafide/bonafide.go b/pkg/vpn/bonafide/bonafide.go
index 87801cca7eea3e592f54c86886a994b0b7fbcb73..dd8c597cbea5ae6cc4c69cc0e26a0c9ce3d46476 100644
--- a/pkg/vpn/bonafide/bonafide.go
+++ b/pkg/vpn/bonafide/bonafide.go
@@ -137,7 +137,7 @@ func (b *Bonafide) GetPemCertificate() ([]byte, error) {
 		log.Fatal("ERROR: bonafide did not initialize auth")
 	}
 	if b.auth.needsCredentials() && b.token == nil {
-		log.Println("BUG: expected token to be set, but is not there")
+		log.Println("Needs token, but token is empty")
 		return nil, errors.New("Needs to login, but it was not logged in. Please, restart the application and report it if it continues happening")
 	}
 
diff --git a/pkg/vpn/openvpn.go b/pkg/vpn/openvpn.go
index 31f873836f9a343482971417e61dae59ff75f1c3..11bba69a4d5b3f8a0b7a2bf517c07813faac2346 100644
--- a/pkg/vpn/openvpn.go
+++ b/pkg/vpn/openvpn.go
@@ -16,6 +16,7 @@
 package vpn
 
 import (
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"log"
@@ -43,9 +44,23 @@ func (b *Bitmask) StartVPN(provider string) error {
 		}
 	}
 
+	if !b.CanStartVPN() {
+		return errors.New("BUG: cannot start vpn")
+	}
 	return b.startOpenVPN(proxy)
 }
 
+func (b *Bitmask) CanStartVPN() bool {
+	if !b.bonafide.NeedsCredentials() {
+		return true
+	}
+	_, err := b.getCert()
+	if err != nil {
+		return false
+	}
+	return true
+}
+
 func (b *Bitmask) startTransport() (proxy string, err error) {
 	proxy = "127.0.0.1:4430"
 	if b.shapes != nil {
@@ -150,6 +165,7 @@ func (b *Bitmask) getCert() (certPath string, err error) {
 	certPath = b.getCertPemPath()
 
 	if _, err := os.Stat(certPath); os.IsNotExist(err) {
+		log.Println("Cert does not exist in ", certPath, "...fetching")
 		cert, err := b.bonafide.GetPemCertificate()
 		if err != nil {
 			return "", err