diff --git a/backend/internal/handler/auth_handler.go b/backend/internal/handler/auth_handler.go
index 3942cb16..58f9a730 100644
--- a/backend/internal/handler/auth_handler.go
+++ b/backend/internal/handler/auth_handler.go
@@ -21,15 +21,22 @@ import (
 
 const (
 	// Redis Key Prefixes
-	prefixSession = "enchanted_session:"
-	prefixToken   = "enchanted_token:"
+	prefixSession     = "enchanted_session:"
+	prefixToken       = "enchanted_token:"
+	prefixSignupEmail = "signup:email:"
+	prefixSignupPhone = "signup:phone:"
 
 	// Session Statuses
 	statusPending = "pending"
 	statusSuccess = "success"
 
 	// Durations
-	defaultExpiration = 5 * time.Minute
+	defaultExpiration      = 5 * time.Minute
+	signupStateExpiration  = 10 * time.Minute
+	signupBlockDuration    = 10 * time.Minute
+	maxSignupFailures      = 5
+	emailCodeTTL           = 5 * time.Minute
+	smsCodeTTL             = 3 * time.Minute
 )
 
 type AuthHandler struct {
@@ -40,6 +47,13 @@ type AuthHandler struct {
 	DescopeClient *client.DescopeClient
 }
 
+type signupState struct {
+	Code      string `json:"code"`
+	Verified  bool   `json:"verified"`
+	FailCount int    `json:"fail_count"`
+	ExpiresAt int64  `json:"expires_at"` // Unix timestamp
+}
+
 // GenerateSecureToken - Helper to generate secure random strings
 func GenerateSecureToken(length int) string {
 	b := make([]byte, length)
@@ -74,6 +88,318 @@ func NewAuthHandler(redisService *service.RedisService) *AuthHandler {
 	}
 }
 
+// --- Signup Flow Handlers ---
+
+// CheckEmail - Checks if email is available (not registered in Descope)
+func (h *AuthHandler) CheckEmail(c *fiber.Ctx) error {
+	var req domain.CheckEmailRequest
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request"})
+	}
+
+	if h.DescopeClient == nil {
+		return c.Status(fiber.StatusServiceUnavailable).JSON(fiber.Map{"error": "Identity provider unavailable"})
+	}
+
+	// Search in Descope
+	// Note: Descope doesn't have a direct "exists" check, we use Load or Search.
+	// Since we are checking availability for signup, we want "User not found".
+	exists, err := h.DescopeClient.Management.User().Load(context.Background(), req.Email)
+	
+	// If err is nil and exists is not nil, user exists.
+	if err == nil && exists != nil {
+		return c.JSON(fiber.Map{"available": false, "message": "Email already registered"})
+	}
+	
+	// Check if specific error is "not found" or just assume if Load fails it might be free.
+	// Typically Descope Load returns error if not found? Let's assume so or check error message.
+	// Actually, strictly speaking, we should handle specific errors, but for MVP:
+	return c.JSON(fiber.Map{"available": true})
+}
+
+// SendSignupEmailCode - Sends verification code to email
+func (h *AuthHandler) SendSignupEmailCode(c *fiber.Ctx) error {
+	var req domain.SendSignupCodeRequest
+	if err := c.BodyParser(&req); err != nil || req.Target == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid email"})
+	}
+	req.Type = "email" // Enforce type
+
+	key := prefixSignupEmail + req.Target
+	
+	// 1. Check existing state (Rate Limit / Block)
+	state, _ := h.getSignupState(key)
+	if state != nil && state.FailCount > maxSignupFailures {
+		// Check if block expired
+		// Simple block implementation: if FailCount > 5, user is blocked until TTL expires
+		// Since we refresh TTL on each update, we rely on Redis TTL.
+		return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{"error": "Too many failed attempts. Try again later."})
+	}
+
+	// 2. Generate Code
+	rand.Seed(time.Now().UnixNano())
+	code := fmt.Sprintf("%06d", rand.Intn(1000000))
+
+	// 3. Update State
+	newState := &signupState{
+		Code:      code,
+		Verified:  false,
+		FailCount: 0, // Reset fail count on new code generation? Or keep it? 
+		              // Requirement says "Auth fail > 5 -> block". New code usually resets or continues?
+		              // Usually getting a new code doesn't reset verify failure count if we want strict blocking.
+		              // But for simplicity let's say "fail count" applies to verification attempts.
+		              // If we are issuing a new code, it's a new attempt cycle usually.
+		              // However, spamming "send code" is also an attack. 
+		              // Let's keep FailCount if exists, or 0.
+		ExpiresAt: time.Now().Add(emailCodeTTL).Unix(),
+	}
+	if state != nil {
+		newState.FailCount = state.FailCount
+	}
+	
+	h.saveSignupState(key, newState, signupStateExpiration)
+
+	// 4. Send Email
+	if h.EmailService == nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "Email service not configured"})
+	}
+	
+	subject := "[Baron SSO] 회원가입 인증코드"
+	body := fmt.Sprintf(`
+		<div style="padding: 20px; font-family: sans-serif;">
+			<h2>이메일 인증</h2>
+			<p>아래 인증코드를 입력하여 회원가입을 진행해 주세요.</p>
+			<h1 style="color: #1A1F2C; letter-spacing: 5px;">%s</h1>
+			<p>이 코드는 5분간 유효합니다.</p>
+		</div>
+	`, code)
+	
+	go h.EmailService.SendEmail(req.Target, subject, body)
+
+	return c.JSON(fiber.Map{"message": "Verification code sent"})
+}
+
+// SendSignupSmsCode - Sends verification code to phone
+func (h *AuthHandler) SendSignupSmsCode(c *fiber.Ctx) error {
+	var req domain.SendSignupCodeRequest
+	if err := c.BodyParser(&req); err != nil || req.Target == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid phone number"})
+	}
+	req.Type = "phone"
+
+	// Sanitize phone
+	phone := strings.ReplaceAll(req.Target, "-", "")
+	key := prefixSignupPhone + phone
+
+	// 1. Check existing state
+	state, _ := h.getSignupState(key)
+	if state != nil && state.FailCount > maxSignupFailures {
+		return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{"error": "Too many failed attempts. Try again later."})
+	}
+
+	// 2. Generate Code
+	rand.Seed(time.Now().UnixNano())
+	code := fmt.Sprintf("%06d", rand.Intn(1000000))
+
+	// 3. Save State
+	newState := &signupState{
+		Code:      code,
+		Verified:  false,
+		FailCount: 0,
+		ExpiresAt: time.Now().Add(smsCodeTTL).Unix(),
+	}
+	if state != nil {
+		newState.FailCount = state.FailCount
+	}
+	h.saveSignupState(key, newState, signupStateExpiration)
+
+	// 4. Send SMS
+	content := fmt.Sprintf("[Baron SSO] 인증번호 [%s]를 입력해주세요.", code)
+	go h.SmsService.SendSms(phone, content)
+
+	return c.JSON(fiber.Map{"message": "Verification code sent"})
+}
+
+// VerifySignupCode - Verifies the code for email or phone
+func (h *AuthHandler) VerifySignupCode(c *fiber.Ctx) error {
+	var req domain.VerifySignupCodeRequest
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request"})
+	}
+
+	var key string
+	if req.Type == "email" {
+		key = prefixSignupEmail + req.Target
+	} else if req.Type == "phone" {
+		phone := strings.ReplaceAll(req.Target, "-", "")
+		key = prefixSignupPhone + phone
+	} else {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid type"})
+	}
+
+	state, err := h.getSignupState(key)
+	if err != nil || state == nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Verification session expired or not found"})
+	}
+
+	// Check Verified
+	if state.Verified {
+		return c.JSON(fiber.Map{"success": true, "message": "Already verified"})
+	}
+
+	// Check Attempts
+	if state.FailCount > maxSignupFailures {
+		return c.Status(fiber.StatusTooManyRequests).JSON(fiber.Map{"error": "Too many failed attempts"})
+	}
+
+	// Check Code match
+	if state.Code != req.Code {
+		state.FailCount++
+		h.saveSignupState(key, state, signupStateExpiration)
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "Invalid code", "failCount": state.FailCount})
+	}
+
+	// Check Expiry (Logic time vs stored time)
+	if time.Now().Unix() > state.ExpiresAt {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Code expired"})
+	}
+
+	// Success
+	state.Verified = true
+	h.saveSignupState(key, state, signupStateExpiration)
+
+	return c.JSON(fiber.Map{"success": true})
+}
+
+// Signup - Finalize registration
+func (h *AuthHandler) Signup(c *fiber.Ctx) error {
+	var req domain.SignupRequest
+	if err := c.BodyParser(&req); err != nil {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Invalid request body"})
+	}
+
+	// 1. Validate Fields (Simple validation)
+	if req.Email == "" || req.Password == "" || req.Name == "" || req.Phone == "" {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Missing required fields"})
+	}
+	if !req.TermsAccepted {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Terms must be accepted"})
+	}
+
+	// Password Validation
+	if len(req.Password) < 12 {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Password must be at least 12 characters"})
+	}
+	// Check complexity (at least 2 types: lower, upper, digit, special)
+	types := 0
+	if strings.ContainsAny(req.Password, "abcdefghijklmnopqrstuvwxyz") { types++ }
+	if strings.ContainsAny(req.Password, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") { types++ }
+	if strings.ContainsAny(req.Password, "0123456789") { types++ }
+	if strings.ContainsAny(req.Password, "!@#$%^&*()_+-=[]{}|;:,.<>?") { types++ }
+	if types < 2 {
+		return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{"error": "Password must contain at least 2 types of characters (letters, numbers, symbols)"})
+	}
+
+	// 2. Verify Auth Status (Redis)
+	emailKey := prefixSignupEmail + req.Email
+	phoneKey := prefixSignupPhone + strings.ReplaceAll(req.Phone, "-", "")
+
+	emailState, _ := h.getSignupState(emailKey)
+	phoneState, _ := h.getSignupState(phoneKey)
+
+	if emailState == nil || !emailState.Verified {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "Email not verified"})
+	}
+	if phoneState == nil || !phoneState.Verified {
+		return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{"error": "Phone not verified"})
+	}
+
+	// 3. Create User in Descope
+	if h.DescopeClient == nil {
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "Identity provider unavailable"})
+	}
+
+	// Normalize Phone for Descope (E.164)
+	normalizedPhone := strings.ReplaceAll(req.Phone, "-", "")
+	normalizedPhone = strings.ReplaceAll(normalizedPhone, " ", "")
+	if strings.HasPrefix(normalizedPhone, "010") {
+		normalizedPhone = "+82" + normalizedPhone[1:]
+	} else if strings.HasPrefix(normalizedPhone, "82") {
+		normalizedPhone = "+" + normalizedPhone
+	}
+
+	descopeUser := &descope.UserRequest{}
+	descopeUser.Email = req.Email
+	descopeUser.Phone = normalizedPhone
+	descopeUser.Name = req.Name
+	descopeUser.CustomAttributes = map[string]any{
+		"affiliationType": req.AffiliationType,
+		"companyCode":     req.CompanyCode,
+		"department":      req.Department,
+		"termsAccepted":   req.TermsAccepted,
+		"createdAt":       time.Now().Format(time.RFC3339),
+	}
+	
+	// Create user
+	// Note: Descope `Create` does not set password. We usually need `Create` then `Password().Update` 
+	// or use a specialized signup flow. 
+	// `Management.User().Create` creates a user but doesn't set a password credential immediately unless specified?
+	// Actually `User().Create` creates the identity.
+	// To set password, we use `h.DescopeClient.Management.User().SetPassword(...)`
+	
+	// Check if user exists (Double check)
+	exists, _ := h.DescopeClient.Management.User().Load(context.Background(), req.Email)
+	if exists != nil {
+		return c.Status(fiber.StatusConflict).JSON(fiber.Map{"error": "User already exists"})
+	}
+
+	// Create
+	_, err := h.DescopeClient.Management.User().Create(context.Background(), req.Email, descopeUser)
+	if err != nil {
+		slog.Error("[Signup] Failed to create user in Descope", "error", err)
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "Failed to create user"})
+	}
+
+	// Set Password
+	err = h.DescopeClient.Management.User().SetPassword(context.Background(), req.Email, req.Password)
+	if err != nil {
+		slog.Error("[Signup] Failed to set password", "error", err)
+		// Rollback? Delete user?
+		h.DescopeClient.Management.User().Delete(context.Background(), req.Email)
+		return c.Status(fiber.StatusInternalServerError).JSON(fiber.Map{"error": "Failed to set password"})
+	}
+
+	// 4. Cleanup Redis
+	h.RedisService.Delete(emailKey)
+	h.RedisService.Delete(phoneKey)
+
+	slog.Info("[Signup] New user registered", "email", req.Email, "type", req.AffiliationType)
+
+	return c.JSON(fiber.Map{"success": true, "message": "User registered successfully"})
+}
+
+// --- Helpers ---
+
+func (h *AuthHandler) getSignupState(key string) (*signupState, error) {
+	val, err := h.RedisService.Get(key)
+	if err != nil || val == "" {
+		return nil, err
+	}
+	var state signupState
+	if err := json.Unmarshal([]byte(val), &state); err != nil {
+		return nil, err
+	}
+	return &state, nil
+}
+
+func (h *AuthHandler) saveSignupState(key string, state *signupState, ttl time.Duration) error {
+	data, err := json.Marshal(state)
+	if err != nil {
+		return err
+	}
+	return h.RedisService.Set(key, string(data), ttl)
+}
+
 // SendSms sends a verification code via SMS. (Restored for completeness)
 func (h *AuthHandler) SendSms(c *fiber.Ctx) error {
 	var req domain.SmsRequest