diff --git a/docs/cli/index.md b/docs/cli/index.md
index 9dff50831..d53131670 100644
--- a/docs/cli/index.md
+++ b/docs/cli/index.md
@@ -468,6 +468,13 @@ Common RPCs:
 
 See [/concepts/models](/concepts/models) for fallback behavior and scanning strategy.
 
+Preferred Anthropic auth (CLI token, not API key):
+
+```bash
+claude setup-token
+clawdbot models status
+```
+
 ### `models` (root)
 `clawdbot models` is an alias for `models status`.
 
diff --git a/docs/concepts/models.md b/docs/concepts/models.md
index aa8317b00..93347235a 100644
--- a/docs/concepts/models.md
+++ b/docs/concepts/models.md
@@ -111,6 +111,13 @@ JSON includes `auth.oauth` (warn window + profiles) and `auth.providers`
 (effective auth per provider).
 Use `--check` for automation (exit `1` when missing/expired, `2` when expiring).
 
+Preferred Anthropic auth is the Claude CLI setup-token (run on the gateway host):
+
+```bash
+claude setup-token
+clawdbot models status
+```
+
 ## Scanning (OpenRouter free models)
 
 `clawdbot models scan` inspects OpenRouter’s **free model catalog** and can
diff --git a/docs/gateway/authentication.md b/docs/gateway/authentication.md
index 3f1e3be5a..b4a1449fb 100644
--- a/docs/gateway/authentication.md
+++ b/docs/gateway/authentication.md
@@ -13,6 +13,22 @@ credentials**, including the 1‑year token created by `claude setup-token`.
 See [/concepts/oauth](/concepts/oauth) for the full OAuth flow and storage
 layout.
 
+## Preferred Anthropic setup (Claude CLI setup-token)
+
+For Anthropic, the **preferred** path is the Claude CLI setup-token, not an API key.
+Run it on the **gateway host**:
+
+```bash
+claude setup-token
+```
+
+Then verify and sync into Clawdbot:
+
+```bash
+clawdbot models status
+clawdbot doctor
+```
+
 ## Recommended: long‑lived Claude Code token
 
 Run this on the **gateway host** (the machine running the Gateway):