[docs-scanner] Contradictory OAuth authentication instructions for Claude Code

[github-actions]

Files:

• content/manuals/ai/sandboxes/security/credentials.md
• content/manuals/ai/sandboxes/agents/claude-code.md

Issue

The documentation provides contradictory instructions for how to initiate OAuth authentication with Claude Code.

From credentials.md (Best practices section):

For Claude Code and Codex, OAuth is another secure option: the flow runs on the host, so the token is never exposed inside the sandbox. For Claude Code, use /login inside the agent.

From claude-code.md (Authentication section):

Claude subscription: If no API key is set, Claude Code prompts you to authenticate interactively using OAuth. The proxy handles the OAuth flow, so credentials aren't stored inside the sandbox.

Why this matters

A reader trying to set up OAuth authentication for Claude Code receives conflicting guidance:

• credentials.md instructs them to use the /login command inside the agent
• claude-code.md says Claude Code "prompts you to authenticate interactively" (implying it happens automatically without a specific command)

This creates confusion about whether users need to manually trigger OAuth with /login or whether it happens automatically when no API key is present.

Suggested fix

Verify the correct authentication flow and make both pages consistent. If /login is the correct command:

In claude-code.md, change:

Claude subscription: If no API key is set, Claude Code prompts you to authenticate interactively using OAuth.

To:

Claude subscription: If no API key is set, use the /login command inside Claude Code to authenticate via OAuth.

Or if automatic prompting is correct, update credentials.md to remove the /login instruction and align with the automatic flow described in claude-code.md.

---

Found by nightly documentation quality scanner