docs: update

QUICKSTART.md

@@ -141,10 +141,9 @@ sentinelguard gateway --provider kimi --port 8080
 
 `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, `GEMINI_API_KEY`, and
 `MOONSHOT_API_KEY` are upstream provider keys. `SENTINELGUARD_GATEWAY_API_KEY`
-is a client-facing token you generate for apps and IDEs that call the
-SentinelGuard gateway. You do not get it from an LLM provider; generate it
-locally with `sentinelguard token`, then use the same `sgw_...` value in your
-app or IDE API-key field.
+is the gateway client token created by the team running SentinelGuard. Generate
+it locally with `sentinelguard token`, then use the same `sgw_...` value in
+your app or IDE API-key field.
 Package-mode library usage does not need this gateway token.
 
 Point OpenAI-compatible apps or IDEs to:

README.md

@@ -205,11 +205,10 @@ sentinelguard gateway \
 ```
 
 `OPENAI_API_KEY` is the upstream provider key. `SENTINELGUARD_GATEWAY_API_KEY`
-is a client-facing token generated by you for apps, SDKs, and IDEs that call
-SentinelGuard at `http://localhost:8080/v1`.
-You do not get this value from OpenAI, Anthropic, Google, or a SentinelGuard
-cloud account. It is a random local secret for your own gateway; generate it
-with `sentinelguard token` or `sentinelguard token --env`.
+is the gateway client token created by the team running SentinelGuard. Apps,
+SDKs, and IDEs use it when calling SentinelGuard at `http://localhost:8080/v1`.
+This token is separate from upstream provider API keys; generate it with
+`sentinelguard token` or `sentinelguard token --env`.
 Generate it once, then use the same `sgw_...` value in the gateway environment
 and in your app or IDE API-key field. If you run `sentinelguard token` again,
 it creates a different token.

docs/gateway.md

@@ -15,14 +15,12 @@ Application or IDE
 The example below uses two different keys:
 
 - `OPENAI_API_KEY` is the upstream provider key used by SentinelGuard to call OpenAI.
-- `SENTINELGUARD_GATEWAY_API_KEY` is a client-facing token that you generate. Your
-  apps, IDEs, and SDKs use this token when calling SentinelGuard at
-  `http://localhost:8080/v1`.
+- `SENTINELGUARD_GATEWAY_API_KEY` is the gateway client token created by the
+  team running SentinelGuard. Apps, IDEs, and SDKs use this token when calling
+  SentinelGuard at `http://localhost:8080/v1`.
 
-You do not get `SENTINELGUARD_GATEWAY_API_KEY` from OpenAI, Anthropic, Google,
-or a SentinelGuard cloud account. It is a random local secret for your own
-SentinelGuard gateway. Generate it once, then use the same value in both
-places:
+This token is separate from upstream provider API keys. Generate it once for
+your gateway, then use the same value in both places:
 
 - The SentinelGuard gateway environment, as `SENTINELGUARD_GATEWAY_API_KEY`.
 - Your app, SDK, or IDE API-key field when its base URL points to

docs/getting-started.md

@@ -67,9 +67,9 @@ Gateway mode usually has two kinds of keys:
 - An upstream provider key, such as `OPENAI_API_KEY`, `ANTHROPIC_API_KEY`,
   `GEMINI_API_KEY`, or `MOONSHOT_API_KEY`. SentinelGuard uses this to call the
   model provider.
-- `SENTINELGUARD_GATEWAY_API_KEY`, a client-facing token that you generate.
-  Applications and IDEs use this token when they call SentinelGuard at
-  `http://localhost:8080/v1`.
+- `SENTINELGUARD_GATEWAY_API_KEY`, the gateway client token created by the
+  team running SentinelGuard. Applications and IDEs use this token when they
+  call SentinelGuard at `http://localhost:8080/v1`.
 
 For local testing, generate the gateway token locally:
 
@@ -83,11 +83,10 @@ Or set it in your shell directly:
 export SENTINELGUARD_GATEWAY_API_KEY="$(sentinelguard token)"
 ```
 
-You do not get this value from an LLM provider or a SentinelGuard cloud
-account. It is a random local secret for your own gateway.
-Generate it once, then use the same `sgw_...` value in the SentinelGuard
-gateway environment and in your app or IDE API-key field. If you run
-`sentinelguard token` again, it creates a different token.
+This token is separate from upstream provider API keys. Generate it once, then
+use the same `sgw_...` value in the SentinelGuard gateway environment and in
+your app or IDE API-key field. If you run `sentinelguard token` again, it
+creates a different token.
 
 Package-mode library usage does not need `SENTINELGUARD_GATEWAY_API_KEY`.
 Gateway mode uses it to protect the local or shared proxy endpoint, so clients

sentinelguard/cli/bootstrap.py

@@ -398,9 +398,9 @@ def _readme(profile: str) -> str:
         ```
 
         `OPENAI_API_KEY` is the upstream provider key. The
-        `SENTINELGUARD_GATEWAY_API_KEY` value is a client-facing token that you
-        generate for apps and IDEs calling SentinelGuard. Use the same `sgw_...`
-        value in the gateway environment and in each app or IDE API-key field.
+        `SENTINELGUARD_GATEWAY_API_KEY` value is the gateway client token
+        created by the team running SentinelGuard. Use the same `sgw_...` value
+        in the gateway environment and in each app or IDE API-key field.
         Keep the real upstream provider key only on the SentinelGuard gateway.
 
         ## Run With Docker Compose