diff --git a/fern/products/cli-generator/authentication.mdx b/fern/products/cli-generator/authentication.mdx
index 1e8aa7649..c18e75d71 100644
--- a/fern/products/cli-generator/authentication.mdx
+++ b/fern/products/cli-generator/authentication.mdx
@@ -60,7 +60,7 @@ Declaring an `oauth` scheme under `auth-schemes` in `generators.yml` makes the C
 | Authorization code with Proof Key for Code Exchange (PKCE) | `authorization-code` | Interactive login. The CLI opens a browser and receives the callback on a loopback listener. |
 | Device code | `device-code` | Interactive login on machines without a browser, such as SSH sessions and containers. |
 
-The interactive flows are public-client only: they use PKCE rather than a client secret. They require CLI generator `0.29.0` or later.
+The interactive flows are public-client only: they use PKCE rather than a client secret. They require CLI generator `0.30.0` or later. PKCE always applies to the `authorization-code` flow, with `S256` as the only supported challenge method.
 
 ### Log in and out
 
@@ -74,6 +74,8 @@ my-cli auth logout   # remove the stored credential
 
 Tokens are stored in the OS keyring, refreshed automatically when they expire, and sent as `Authorization: Bearer <token>` on every request. Pass `--no-browser` to `auth login` to print the authorization URL instead of opening a browser, and `--with-token` to skip the flow and read a token from stdin.
 
+An API that defines its own `auth` operations keeps them. The built-in `login`, `logout`, and `status` commands are folded into the spec-defined group, so both `my-cli auth me` and `my-cli auth login` dispatch correctly. The built-in `completion` and `man` commands merge the same way. When a spec operation resolves to exactly `auth login`, `auth logout`, or `auth status`, the built-in wins; rename the operation with [`x-fern-sdk-method-name`](/learn/cli-generator/get-started/openapi-extensions#x-fern-sdk-method-name) to keep it reachable. Merging requires CLI generator `0.29.1` or later.
+
 ### Authorization code with PKCE
 
 ```yaml title="generators.yml"
diff --git a/fern/products/cli-generator/openapi-extensions.mdx b/fern/products/cli-generator/openapi-extensions.mdx
index a5d34c879..ed3f53b30 100644
--- a/fern/products/cli-generator/openapi-extensions.mdx
+++ b/fern/products/cli-generator/openapi-extensions.mdx
@@ -39,7 +39,7 @@ paths:
       x-fern-sdk-method-name: get-current-user
 ```
 
-Produces: `cli get-current-user` (or nested under a group if `x-fern-sdk-group-name` is also set).
+Produces: `cli get-current-user` (or nested under a group if `x-fern-sdk-group-name` is also set). Renaming also resolves a collision with a [built-in command](/learn/cli-generator/get-started/authentication#log-in-and-out), such as an operation that resolves to `auth login`.
 
 <Note>
 If neither extension is present, the CLI falls back to the `operationId`.