diff --git a/sandboxes/llm_local/README.md b/sandboxes/llm_local/README.md
index 6882e3e..4cd1309 100644
--- a/sandboxes/llm_local/README.md
+++ b/sandboxes/llm_local/README.md
@@ -224,6 +224,27 @@ Run `make help` to see all commands:
 
 ## Testing the Mock API
 
+### Authentication
+
+Every `/v1/*` route needs this header:
+
+```
+Authorization: Bearer sk-mock-key
+```
+
+`/health` does not. The key is public by design: `make up` prints it, the clients hardcode it, and
+it is listed below under Notes.
+
+Point an OpenAI-compatible client at `http://localhost:8000/v1` with `sk-mock-key` as its API key.
+
+What a request without a good header gets back:
+
+| Header sent | Response |
+|---|---|
+| none | `401 Missing Authorization header` |
+| `Basic sk-mock-key` | `401 Invalid authentication scheme` |
+| `Bearer something-else` | `401 Invalid API key` |
+
 ### Health Check
 ```bash
 curl http://localhost:8000/health