From 039e90283554d214b4ae9d3884b48d31709a61f9 Mon Sep 17 00:00:00 2001
From: Raylan LIN <linrion101@gmail.com>
Date: Sun, 12 Apr 2026 00:01:57 +0800
Subject: [PATCH 1/2] docs: fix misleading auth file references (#80)

- SKILL.md: clarify that API key auth persists to config.json,
  OAuth persists to credentials.json
- docs/cli-design.md: rewrite auth section to explain that
  credentials.json is not required when using API key auth
---
 docs/cli-design.md | 12 ++++++++----
 skill/SKILL.md     |  7 +++++--
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/docs/cli-design.md b/docs/cli-design.md
index 420a09f..473b909 100644
--- a/docs/cli-design.md
+++ b/docs/cli-design.md
@@ -52,10 +52,14 @@ mmx
 ## Authentication
 
 Credential resolution order:
-1. `--api-key` flag
-2. `$MINIMAX_API_KEY` env var
-3. `~/.mmx/credentials.json` (OAuth)
-4. `api_key` in `~/.mmx/config.yaml`
+1. `--api-key` flag (highest priority)
+2. `~/.mmx/credentials.json` (OAuth token — only created by `mmx auth login` without `--api-key`)
+3. `fileApiKey` in `~/.mmx/config.json` (persisted API key)
+4. `$MINIMAX_API_KEY` env var
+
+If none are found, the CLI returns `No credentials found`. The CLI can be fully authenticated
+using any single method — `~/.mmx/credentials.json` is **not required** if you use an API key
+instead.
 
 ## Configuration
 
diff --git a/skill/SKILL.md b/skill/SKILL.md
index 7f64e6a..b48c06d 100644
--- a/skill/SKILL.md
+++ b/skill/SKILL.md
@@ -13,10 +13,13 @@ Use `mmx` to generate text, images, video, speech, music, and perform web search
 # Install
 npm install -g mmx-cli
 
-# Auth (persisted to ~/.mmx/credentials.json)
+# Auth — API key (persisted to ~/.mmx/config.json)
 mmx auth login --api-key sk-xxxxx
 
-# Or pass per-call
+# Auth — OAuth (persisted to ~/.mmx/credentials.json)
+mmx auth login
+
+# Or pass per-call (no file needed)
 mmx text chat --api-key sk-xxxxx --message "Hello"
 ```
 

From be963d191a3637bdd381d03dc5cfbf1bc9e1fec9 Mon Sep 17 00:00:00 2001
From: Raylan LIN <linrion101@gmail.com>
Date: Sun, 12 Apr 2026 00:07:10 +0800
Subject: [PATCH 2/2] docs: fix credential resolution order (#80)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove incorrect claim that $MINIMAX_API_KEY is part of the resolver
chain. The env var is checked by ensureApiKey() in main.ts before
command execution, and persisted to config.json — it is not directly
resolved by resolveCredential().
---
 docs/cli-design.md | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/docs/cli-design.md b/docs/cli-design.md
index 473b909..a281ab7 100644
--- a/docs/cli-design.md
+++ b/docs/cli-design.md
@@ -54,12 +54,10 @@ mmx
 Credential resolution order:
 1. `--api-key` flag (highest priority)
 2. `~/.mmx/credentials.json` (OAuth token — only created by `mmx auth login` without `--api-key`)
-3. `fileApiKey` in `~/.mmx/config.json` (persisted API key)
-4. `$MINIMAX_API_KEY` env var
+3. `fileApiKey` in `~/.mmx/config.json` (persisted API key from a previous `mmx auth login --api-key`)
 
-If none are found, the CLI returns `No credentials found`. The CLI can be fully authenticated
-using any single method — `~/.mmx/credentials.json` is **not required** if you use an API key
-instead.
+If none are found, the CLI returns `No credentials found`. The `~/.mmx/credentials.json` file
+is **not required** when using API key auth — it is only created during OAuth login.
 
 ## Configuration