yep

README.md

@@ -32,17 +32,20 @@ In this mode, protected routes always authenticate as:
 OIDC variables are not required when `DEV_MODE=true`.
 
 ## Auth flow
-API and protected pages require `Authorization: Bearer <access_token>` when `DEV_MODE=false`.
-
-For quick local testing, set in browser console:
-```js
-localStorage.setItem("access_token", "<your_oidc_access_token>");
-```
+When `DEV_MODE=false`, login is handled directly by the app:
+- `GET /auth/login` redirects to your OIDC provider
+- `GET /auth/callback` exchanges code for access token using `OIDC_CLIENT_ID` + `OIDC_CLIENT_SECRET`
+- Access token is stored in secure HttpOnly session cookie
+- Protected routes validate that token via JWKS
+- `GET /auth/logout` clears the local session (and optionally redirects to provider logout URL)
 
 ## Key routes
 - `GET /dashboard`: upload form
 - `GET /skills`: browse listings and buy
 - `GET /my-skills`: purchased skills and copy/download access
+- `GET /auth/login`: start OIDC login
+- `GET /auth/callback`: OIDC callback
+- `GET /auth/logout`: logout
 - `POST /api/upload`: upload and list a skill
 - `POST /api/purchase`: buy a skill
 - `GET /api/my-skills`: owned purchased list