docs: clarify Claude CLI auth mode

docs/gateway/authentication.md

@@ -67,6 +67,10 @@ clawdbot doctor
 This should create (or refresh) an auth profile like `anthropic:claude-cli` in
 the agent auth store.
 
+Clawdbot config sets `auth.profiles["anthropic:claude-cli"].mode` to `"oauth"` so
+the profile accepts both OAuth and setup-token credentials. Older configs that
+used `"token"` are auto-migrated on load.
+
 If you see an Anthropic error like:
 
 ```

docs/gateway/configuration.md

@@ -306,6 +306,10 @@ rotation order used for failover.
 }
 ```
 
+Note: `anthropic:claude-cli` should use `mode: "oauth"` even when the stored
+credential is a setup-token. Clawdbot auto-migrates older configs that used
+`mode: "token"`.
+
 ### `agents.list[].identity`
 
 Optional per-agent identity used for defaults and UX. This is written by the macOS onboarding assistant.

docs/providers/anthropic.md

@@ -59,4 +59,7 @@ clawdbot onboard --auth-choice claude-cli
 ## Notes
 
 - The wizard can run `claude setup-token` on the gateway host and store the token.
+- Clawdbot writes `auth.profiles["anthropic:claude-cli"].mode` as `"oauth"` so the profile
+  accepts both OAuth and setup-token credentials. Older configs using `"token"` are
+  auto-migrated on load.
 - Auth details + reuse rules are in [/concepts/oauth](/concepts/oauth).

docs/start/faq.md

@@ -239,6 +239,10 @@ It also warns if your configured model is unknown or missing auth.
 
 The wizard can run `claude setup-token` on the gateway host (or you run it yourself), then stores the token as an auth profile for the **anthropic** provider. That profile is used for model calls the same way an API key or OAuth profile would be. If you already ran `claude setup-token`, pick **Anthropic token (paste setup-token)** and paste it. More detail: [OAuth](/concepts/oauth).
 
+Clawdbot keeps `auth.profiles["anthropic:claude-cli"].mode` set to `"oauth"` so
+the profile accepts both OAuth and setup-token credentials; older `"token"` mode
+entries auto-migrate.
+
 ### Do you support Claude subscription auth (Claude Code OAuth)?
 
 Yes. Clawdbot can **reuse Claude Code CLI credentials** (OAuth) and also supports **setup-token**. If you have a Claude subscription, we recommend **setup-token** on the gateway host for the most reliable long‑running setup (requires Claude Pro/Max + the `claude` CLI). OAuth reuse is supported, but avoid logging in separately via Clawdbot and Claude Code to prevent token conflicts. See [Anthropic](/providers/anthropic) and [OAuth](/concepts/oauth).