From 51ea71571c2db261788a1bf9ed8e89d39afc664a Mon Sep 17 00:00:00 2001
From: yuanhe <yuanhe@minimaxi.com>
Date: Mon, 1 Jun 2026 18:33:47 +0800
Subject: [PATCH] bump version to v1.0.16

---
 README.md    | 15 +++++++++++----
 package.json |  2 +-
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/README.md b/README.md
index 92ccce1d..d47dc09f 100644
--- a/README.md
+++ b/README.md
@@ -144,10 +144,17 @@ mmx auth logout
 ```
 
 `mmx auth status` is the canonical way to verify active authentication.
-Both OAuth and API-key credentials live in `~/.mmx/config.json` (the two are
-mutually exclusive — logging in with one method clears the other). API keys
-can also be passed per command via `--api-key`. With an API key, the region
-is auto-detected by probing both Global and CN.
+
+**OAuth** uses the [Device Authorization Grant (RFC 8628)](https://tools.ietf.org/html/rfc8628) with PKCE —
+the CLI opens your browser, you enter a code, and `access_token` + `refresh_token`
+are saved to `~/.mmx/config.json`. Tokens refresh automatically (5-min buffer);
+manual refresh via `mmx auth refresh`.
+
+**API key** auth auto-detects the correct region by probing both Global and CN.
+Useful for CI/CD (`mmx auth login --api-key sk-xxxxx`), or pass per-command via `--api-key`.
+
+OAuth and API key are mutually exclusive — logging in with one clears the other.
+Credential priority: `--api-key` flag > OAuth (config) > `api_key` (config).
 
 ### `mmx config` · `mmx quota`
 
diff --git a/package.json b/package.json
index 6de2fa76..3a0bbd7f 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "mmx-cli",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "CLI for the MiniMax AI Platform",
   "type": "module",
   "engines": {