diff --git a/SPEC.md b/SPEC.md
index 4c8d660..025423d 100644
--- a/SPEC.md
+++ b/SPEC.md
@@ -27,9 +27,12 @@ Content-Type: application/x-www-form-urlencoded
 **Response (Erfolg):**
 
 ```json
-{ "r": { "r": <SessionObject> } }
+{ "a00": { "r": { "r": <SessionObject> }, "cn": "log2in" } }
 ```
 
+`SessionObject` enthält u.a. `tokenCsrf` und `webApiUrl`.
+`tokenCsrf` ist die Session-ID – identisch zur `JSESSIONID` im Cookie.
+
 **Response (Fehler):**
 
 ```json
@@ -38,7 +41,7 @@ Content-Type: application/x-www-form-urlencoded
 ```
 
 Der Server setzt nach erfolgreichem Login ein Session-Cookie:
-Set-Cookie: JSESSIONID=<session-id>
+Set-Cookie: JSESSIONID=<session-id> (= tokenCsrf)
 
 ### Folgecalls (nach Login)
 
diff --git a/pyproject.toml b/pyproject.toml
index 0dcb1fe..d2811b5 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "mcp-familywall"
-version = "0.1.4"
+version = "0.1.5"
 description = "MCP server for Family Wall — read your family's lists and tasks via Claude"
 readme = "README.md"
 requires-python = ">=3.12"
diff --git a/src/mcp_familywall/__init__.py b/src/mcp_familywall/__init__.py
index bbab024..1276d02 100644
--- a/src/mcp_familywall/__init__.py
+++ b/src/mcp_familywall/__init__.py
@@ -1 +1 @@
-__version__ = "0.1.4"
+__version__ = "0.1.5"
diff --git a/src/mcp_familywall/fw_client.py b/src/mcp_familywall/fw_client.py
index bdb6655..89e791f 100644
--- a/src/mcp_familywall/fw_client.py
+++ b/src/mcp_familywall/fw_client.py
@@ -100,24 +100,21 @@ class FamilyWallClient:
 
         if "ex" in body or "un" in body:
             error_data = body.get("ex", body.get("un"))
-            print(
-                f"[LOGIN ERROR] status={response.status_code} body={body}",
-                file=sys.stderr,
-            )
+            _debug_log("LOGIN ERROR", f"status={response.status_code} body={body}")
             msg = f"Login failed: {error_data}"
             raise FamilyWallError(msg, response_data=body)
 
-        if "r" not in body:
-            print(
-                f"[LOGIN ERROR] status={response.status_code} body={body}",
-                file=sys.stderr,
-            )
-            raise FamilyWallError("Login failed: unexpected response format", response_data=body)
+        # Response structure: {"a00": {"r": {"r": {"tokenCsrf": "...", ...}}}}
+        try:
+            session_id: str = body["a00"]["r"]["r"]["tokenCsrf"]
+        except (KeyError, TypeError) as exc:
+            _debug_log("LOGIN ERROR", f"status={response.status_code} body={body}")
+            raise FamilyWallError(
+                "Login failed: unexpected response format", response_data=body
+            ) from exc
 
-        # Extract JSESSIONID from the Set-Cookie header
-        session_id = response.cookies.get("JSESSIONID")
         if not session_id:
-            raise FamilyWallError("Login succeeded but no JSESSIONID cookie returned.")
+            raise FamilyWallError("Login succeeded but tokenCsrf is empty.")
 
         self._session_id = session_id
         logger.debug("Logged in; session acquired")