diff --git a/src/bggpipe/templates/pages/review.html b/src/bggpipe/templates/pages/review.html
index 5f366f2..45ead99 100644
--- a/src/bggpipe/templates/pages/review.html
+++ b/src/bggpipe/templates/pages/review.html
@@ -157,9 +157,15 @@ function render() {
         <div>${s.summary.rejected}<span>rejected</span></div>
       </div>
       ${waiting
-        ? `<p class="waiting">${waiting} titles are extracted but not yet matched
-             to BGG — they're waiting on the API token.</p>
-           <p class="next">When it arrives, run <b>resolve</b> from the <a href="/">pipeline</a>.</p>`
+        ? s.summary.token_present
+          ? `<p class="waiting">${waiting} title(s) are extracted but not yet matched
+               to BGG.</p>
+             <p class="next">Run <b>resolve</b> from the <a href="/">pipeline</a> to match them.</p>`
+          : `<p class="waiting">${waiting} title(s) are extracted but not yet matched
+               to BGG — they're waiting on your API token
+               (<a href="https://boardgamegeek.com/applications" target="_blank"
+                   rel="noopener">boardgamegeek.com/applications</a>).</p>
+             <p class="next">When it arrives, run <b>resolve</b> from the <a href="/">pipeline</a>.</p>`
         : `<p class="next">Next: run <b>diff</b> from the <a href="/">pipeline</a>, then check the <a href="/queue">queue</a>.</p>`}
     </div>`;
   }
diff --git a/src/bggpipe/webreview.py b/src/bggpipe/webreview.py
index adb276a..bf76509 100644
--- a/src/bggpipe/webreview.py
+++ b/src/bggpipe/webreview.py
@@ -701,6 +701,9 @@ def create_app(
                 "total": len(session.rows),
                 "extracted": len(session.titles),
                 "unresolved": unresolved_count,
+                # presence only, never the value: the done-card's advice
+                # differs between "run resolve" and "get a token first"
+                "token_present": bool(os.environ.get("BGG_API_TOKEN")),
             },
         }
 
diff --git a/tests/test_webreview.py b/tests/test_webreview.py
index ee8506b..c667d64 100644
--- a/tests/test_webreview.py
+++ b/tests/test_webreview.py
@@ -1429,3 +1429,17 @@ def test_readding_a_removed_hand_added_title_rescinds_the_removal(tmp_path):
     assert web.post("/api/add-title", json=add).status_code == 200
     titles = json.loads(cfg.titles_path.read_text())
     assert any(t["title_raw"] == "Homebrew Quest" for t in titles)
+
+
+def test_review_summary_reports_token_presence_not_value(tmp_path, monkeypatch):
+    """The done-card's advice differs between "run resolve" and "get a
+    token": the payload carries presence as a boolean, never the value."""
+    monkeypatch.setenv("BGG_API_TOKEN", "secret-token-value")
+    web, _ = make_client(tmp_path)
+    body = web.get("/api/state")
+    assert body.json()["summary"]["token_present"] is True
+    assert "secret-token-value" not in body.text
+
+    monkeypatch.delenv("BGG_API_TOKEN")
+    web2, _ = make_client(tmp_path / "tokenless")
+    assert web2.get("/api/state").json()["summary"]["token_present"] is False