diff --git a/cmd/pad/cmd_auth.go b/cmd/pad/cmd_auth.go
index 3050adc7..a4475375 100644
--- a/cmd/pad/cmd_auth.go
+++ b/cmd/pad/cmd_auth.go
@@ -691,11 +691,16 @@ func saveCredentials(cfg *config.Config, resp *cli.LoginResponse) error {
 }
 
 func printSetupRequiredHint(cfg *config.Config) {
-	fmt.Println("This Pad instance has not been initialized yet.")
 	switch cfg.Mode {
-	case config.ModeRemote, config.ModeCloud:
+	case config.ModeCloud:
+		fmt.Println("You're configured in Cloud mode but don't have an account on Pad Cloud yet.")
+		fmt.Printf("  Sign up at %s/register, then run 'pad auth login'.\n", config.CloudBaseURL)
+		fmt.Println("  Or switch to a local server with 'pad auth configure --mode local'.")
+	case config.ModeRemote:
+		fmt.Println("This Pad instance has not been initialized yet.")
 		fmt.Println("Run 'pad auth setup' on the machine or container running the Pad server, then try again.")
 	default:
+		fmt.Println("This Pad instance has not been initialized yet.")
 		fmt.Println("Run 'pad auth setup' to create the first admin account, then try again.")
 	}
 }
diff --git a/cmd/pad/init.go b/cmd/pad/init.go
index bdc9ba4e..44219d32 100644
--- a/cmd/pad/init.go
+++ b/cmd/pad/init.go
@@ -198,6 +198,9 @@ Examples:
 					// --cli-prompt requires a TTY there too. Use --email/--name/
 					// --password to bootstrap a remote instance non-interactively.
 					printSetupRequiredHint(cfg)
+					if cfg.Mode == config.ModeCloud {
+						return fmt.Errorf("Pad Cloud account required")
+					}
 					return fmt.Errorf("this Pad instance has not been initialized yet")
 				} else if !canPromptForConfig() {
 					printSetupRequiredHint(cfg)
diff --git a/internal/cli/client.go b/internal/cli/client.go
index 7c935b6b..729f6887 100644
--- a/internal/cli/client.go
+++ b/internal/cli/client.go
@@ -1612,6 +1612,9 @@ func parseErrorBody(status int, body []byte) error {
 		Error APIError `json:"error"`
 	}
 	if err := json.Unmarshal(body, &errResp); err == nil && errResp.Error.Message != "" {
+		if errResp.Error.Code == "csrf_error" {
+			errResp.Error.Message = "Session authentication error. Run 'pad auth login' to re-authenticate."
+		}
 		return &errResp.Error
 	}
 	return fmt.Errorf("API error: %d %s", status, string(body))