diff --git a/ai-edge/basic-auth.mdx b/ai-edge/basic-auth.mdx
new file mode 100644
index 0000000..b3770d5
--- /dev/null
+++ b/ai-edge/basic-auth.mdx
@@ -0,0 +1,299 @@
+---
+title: "HTTP Basic Authentication with Datum"
+description: "Configure HTTP Basic Authentication for applications behind a Datum gateway using datumctl and Envoy Gateway SecurityPolicy."
+---
+
+This guide describes how to configure **HTTP Basic Authentication** for applications running behind a **Datum gateway** using `datumctl`. The configuration uses **Envoy Gateway `SecurityPolicy`** resources and applies to **Windows, macOS, and Linux**.
+
+---
+
+## Overview
+
+HTTP Basic Authentication protects an application by requiring a username and password before requests are forwarded to the origin.
+
+At a high level, this setup:
+
+1. Generates credentials in **htpasswd (SHA)** format
+2. Stores credentials in a **Kubernetes Secret**
+3. Labels the Secret so it is synced to edge clusters
+4. Attaches a **SecurityPolicy** to an `HTTPRoute`
+5. Verifies authentication behavior
+
+---
+
+## Prerequisites
+
+- `datumctl` installed and authenticated
+- A valid **Project**
+- Existing:
+  - `Gateway`
+  - `HTTPRoute`
+- Permission to create:
+  - `Secret`
+  - `SecurityPolicy`
+
+Verify access:
+
+```bash
+datumctl get gateway
+datumctl get httproute
+```
+
+---
+
+## Critical Requirement: Secret Syncing
+
+Secrets and ConfigMaps referenced by gateway configurations are **not automatically synced** to edge clusters.
+
+To make a Secret available to edge gateways, it **must** include the following label:
+
+```yaml
+networking.datumapis.com/gateway-sync: "true"
+```
+
+### Why This Matters
+
+- Without this label, the gateway receives the policy but **not the Secret**
+- Envoy fails to load the Basic Auth credentials
+- All requests return **HTTP 500** instead of a login prompt
+
+This requirement exists to prevent accidental replication of unrelated secrets.
+
+---
+
+## Configuration Steps
+
+### Step 1: Set Variables
+
+#### Windows (PowerShell)
+
+```powershell
+$project   = "your-project-id"
+$namespace = "default"
+$route     = "your-route-name"
+$username  = "demo"
+$password  = "ChangeMe123!"
+```
+
+#### macOS / Linux
+
+```bash
+project="your-project-id"
+namespace="default"
+route="your-route-name"
+username="demo"
+password="ChangeMe123!"
+```
+
+---
+
+### Step 2: Generate htpasswd Entry (SHA)
+
+Envoy Gateway currently supports **SHA-based htpasswd entries only**.
+
+Other formats (bcrypt, APR1) are **not supported** and will cause failures.
+
+#### Windows (PowerShell)
+
+```powershell
+$bytes = [Text.Encoding]::UTF8.GetBytes($password)
+$sha1  = [System.Security.Cryptography.SHA1]::Create().ComputeHash($bytes)
+$hash  = [Convert]::ToBase64String($sha1)
+
+$htpasswd = "${username}:{SHA}${hash}`n"
+$b64 = [Convert]::ToBase64String(
+  [Text.Encoding]::UTF8.GetBytes($htpasswd)
+)
+```
+
+#### macOS / Linux
+
+```bash
+hash=$(printf "%s" "$password" | shasum | awk '{print $1}' | xxd -r -p | base64)
+htpasswd="${username}:{SHA}${hash}\n"
+b64=$(printf "%s" "$htpasswd" | base64)
+```
+
+---
+
+### Step 3: Create the Secret
+
+The Secret must:
+
+- Use the key `.htpasswd`
+- Exist in the same namespace as the `SecurityPolicy`
+- Include the **gateway-sync** label
+
+#### Windows (PowerShell)
+
+```powershell
+@"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-basic-auth
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  .htpasswd: $b64
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-basic-auth
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  .htpasswd: $b64
+EOF
+```
+
+---
+
+### Step 4: Attach Basic Auth Using a SecurityPolicy
+
+Attach the policy to the **HTTPRoute**. This is the most reliable attachment point.
+
+#### Windows (PowerShell)
+
+```powershell
+@"
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  basicAuth:
+    users:
+      kind: Secret
+      name: ${route}-basic-auth
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-basic-auth
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  basicAuth:
+    users:
+      kind: Secret
+      name: ${route}-basic-auth
+EOF
+```
+
+---
+
+## Verification
+
+### Unauthenticated Request
+
+```bash
+curl -I https://your-app.example.com
+```
+
+Expected response:
+
+```
+HTTP/1.1 401 Unauthorized
+WWW-Authenticate: Basic
+```
+
+Browsers will display a login prompt.
+
+---
+
+### Authenticated Request
+
+```bash
+curl -I -u demo:ChangeMe123! https://your-app.example.com
+```
+
+Expected response:
+
+```
+HTTP/1.1 200 OK
+```
+
+---
+
+## Cleanup / Disable Basic Auth
+
+### Windows (PowerShell)
+
+```powershell
+datumctl delete securitypolicy ${route}-basic-auth `
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-basic-auth `
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+### macOS / Linux
+
+```bash
+datumctl delete securitypolicy ${route}-basic-auth \
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-basic-auth \
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+---
+
+## Troubleshooting
+
+### Common Failure Modes
+
+| Symptom | Root Cause | Resolution |
+|---------|------------|------------|
+| HTTP 500 on all requests | Secret not synced to edge | Add `gateway-sync` label |
+| 500 even with credentials | Secret missing at edge | Re-apply Secret with label |
+| No login prompt | Policy not attached | Verify `targetRefs` |
+| Works after deleting policy | Invalid Secret reference | Fix Secret and label |
+
+### Useful Debug Commands
+
+```bash
+datumctl get secret --project $project --namespace $namespace
+datumctl get securitypolicy --project $project --namespace $namespace
+datumctl get httproute --project $project --namespace $namespace
+```
+
+---
+
+## Best Practices
+
+- Use Basic Auth for development, demos, and staging environments
+- Rotate credentials regularly
+- Store credentials securely using CI secrets or a secret manager
+- Use JWT, OIDC, or SSO for production authentication
+
+---
+
+## Summary
+
+- HTTP Basic Auth is configured using **Envoy Gateway `SecurityPolicy`**
+- Secrets **must be explicitly synced** to edge clusters using the `gateway-sync` label
+- `{SHA}` htpasswd format is required — bcrypt and APR1 are not supported
+- Attaching policies to `HTTPRoute` is the most reliable approach
diff --git a/ai-edge/oidc-auth0.mdx b/ai-edge/oidc-auth0.mdx
new file mode 100644
index 0000000..840aa9c
--- /dev/null
+++ b/ai-edge/oidc-auth0.mdx
@@ -0,0 +1,375 @@
+---
+title: "Individual User Authentication and Authorization with Auth0"
+description: "Configure per-user authentication and email-based authorization using Auth0 and Google social login for applications behind a Datum gateway."
+---
+
+This guide describes how to configure **individual user authentication and authorization** for applications running behind a **Datum gateway** using `datumctl`. Auth0 handles Google social login and enforces an email-based allow-list — unauthorized users are blocked before a token is ever issued. The configuration uses **Envoy Gateway `SecurityPolicy`** resources and applies to **Windows, macOS, and Linux**.
+
+---
+
+## How It Works
+
+```
+Browser          Envoy Gateway         Auth0                  Google          Your App
+  │                    │                  │                      │                │
+  │── GET /app ────────▶│                  │                      │                │
+  │                    │ no session        │                      │                │
+  │◀── 302 → Auth0 ────│                  │                      │                │
+  │                    │                  │                      │                │
+  │── Auth0 login ─────────────────────────▶│                      │                │
+  │                    │                  │── Google login ───────▶│                │
+  │◀── Google login ──────────────────────────────────────────────│                │
+  │── callback ────────────────────────────▶│                      │                │
+  │                    │                  │ check allow-list       │                │
+  │                    │                  │ ✔ user is allowed      │                │
+  │                    │◀── ID token ─────│                      │                │
+  │                    │ validate JWT:     │                      │                │
+  │                    │  ✔ signature      │                      │                │
+  │                    │  ✔ issuer/aud     │                      │                │
+  │                    │  ✔ expiry         │                      │                │
+  │◀── session cookie ─│                  │                      │                │
+  │── GET /app ────────▶│                  │                      │                │
+  │                    │──────────────────────────────────────────────── 200 OK ───▶│
+```
+
+**Authentication** (who are you): Auth0 handles Google social login.  
+**Authorization** (are you allowed): Auth0 checks the user against your allow-list before issuing a token. Unauthorized users never get a token — Envoy never sees them.
+
+---
+
+## Prerequisites
+
+- `datumctl` installed and authenticated
+- A valid Datum **Project**
+- An existing **HTTPProxy** in the Datum UI (this provides the Gateway and HTTPRoute automatically)
+- An **Auth0 account** (free tier is sufficient)
+- A **Google Cloud** project for the social connection
+
+> **Note:** The HTTPProxy name is the name of the auto-generated HTTPRoute that the SecurityPolicy will target. Find it with:
+> ```bash
+> datumctl get httproute --project <project-id> --namespace default
+> ```
+
+---
+
+## Part 1: Auth0 Setup
+
+### Step 1: Create an Auth0 Tenant
+
+1. Sign up at [auth0.com](https://auth0.com) and create a tenant
+2. Note your **tenant domain** — it looks like `dev-xxxxxxxx.us.auth0.com`
+
+---
+
+### Step 2: Create an Application
+
+1. In the Auth0 dashboard go to **Applications** → **Applications** → **Create Application**
+2. Name it (e.g., `datum-gateway-app`)
+3. Select **Regular Web Applications**
+4. Click **Create**
+5. On the **Settings** tab, note your **Client ID** and **Client Secret**
+6. Under **Allowed Callback URLs** add:
+   ```
+   https://<your-app-hostname>/oauth2/callback
+   ```
+7. Under **Allowed Logout URLs** add:
+   ```
+   https://<your-app-hostname>
+   ```
+8. Click **Save Changes**
+
+---
+
+### Step 3: Enable Google Social Login
+
+1. Go to **Authentication** → **Social** → **Create Connection**
+2. Select **Google / Gmail**
+3. Enter your **Google OAuth Client ID** and **Client Secret**
+   (from [Google Cloud Console](https://console.cloud.google.com) → APIs & Services → Credentials)
+4. Enable the connection for your application under the **Applications** tab of the connection
+5. In **Google Cloud Console**, add Auth0's callback URL to your OAuth client's **Authorized redirect URIs**:
+   ```
+   https://<your-auth0-domain>/login/callback
+   ```
+   This is required so Google can redirect back to Auth0 after login. Without it, Google returns `Error 400: redirect_uri_mismatch`.
+
+> **Note:** If you do not have Google OAuth credentials yet, Auth0 provides a built-in dev key for testing. Go to the Google connection settings and leave Client ID/Secret blank — Auth0 will use its own dev credentials. Create dedicated Google OAuth credentials before moving to production.
+
+---
+
+### Step 4: Create an Access Control Action
+
+This is where individual user access is enforced. Auth0 runs this code during login — users not in the list are denied before a token is ever issued.
+
+1. Go to **Actions** → **Library** → **Build Custom**
+2. Name it `enforce-email-allowlist`
+3. Select **Login / Post Login** trigger
+4. Replace the default code with:
+
+```javascript
+exports.onExecutePostLogin = async (event, api) => {
+  const allowedEmails = [
+    "alice@example.com",
+    "bob@datum.net",
+  ];
+
+  if (!allowedEmails.includes(event.user.email)) {
+    api.access.deny("Access denied: you are not authorized to use this application.");
+  }
+};
+```
+
+5. Click **Deploy**
+6. Go to **Actions** → **Triggers** → **post-login**
+7. Drag your `enforce-email-allowlist` action from the right sidebar into the flow between **Start** and **Complete**
+8. Click **Apply**
+
+To add or remove a user: edit the `allowedEmails` array and click **Deploy**. No gateway config changes required.
+
+---
+
+## Part 2: Datum Gateway Configuration
+
+The Datum HTTPProxy already manages the Gateway and HTTPRoute. You only need to create a **Secret** (to store the Auth0 client secret) and a **SecurityPolicy** (to attach OIDC to the route).
+
+### Step 1: Set Variables
+
+#### Windows (PowerShell)
+
+```powershell
+$project      = "your-project-id"
+$namespace    = "default"
+$route        = "your-httpproxy-name"
+$hostname     = "your-app.example.com"
+$auth0Domain  = "dev-xxxxxxxx.us.auth0.com"
+$clientID     = "your-auth0-client-id"
+$clientSecret = "your-auth0-client-secret"
+```
+
+#### macOS / Linux
+
+```bash
+project="your-project-id"
+namespace="default"
+route="your-httpproxy-name"
+hostname="your-app.example.com"
+auth0Domain="dev-xxxxxxxx.us.auth0.com"
+clientID="your-auth0-client-id"
+clientSecret="your-auth0-client-secret"
+```
+
+---
+
+### Step 2: Create the Auth0 Client Secret
+
+The Secret must include the `gateway-sync` label or the edge proxy will not receive it and all requests will return HTTP 500.
+
+#### Windows (PowerShell)
+
+```powershell
+$b64Secret = [Convert]::ToBase64String(
+  [Text.Encoding]::UTF8.GetBytes($clientSecret)
+)
+
+@"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-oidc-secret
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  client-secret: $b64Secret
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+b64Secret=$(printf "%s" "$clientSecret" | base64)
+
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-oidc-secret
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  client-secret: $b64Secret
+EOF
+```
+
+---
+
+### Step 3: Apply the SecurityPolicy
+
+This attaches OIDC authentication to the existing HTTPProxy route.
+
+> **Warning:** Use only the `oidc` block — do not add a `jwt` block, as it conflicts with the OIDC filter and causes HTTP 500.
+
+#### Windows (PowerShell)
+
+```powershell
+@"
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-oidc
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  oidc:
+    provider:
+      issuer: "https://${auth0Domain}"
+    clientID: "$clientID"
+    clientSecret:
+      name: ${route}-oidc-secret
+    redirectURL: "https://${hostname}/oauth2/callback"
+    scopes:
+      - openid
+      - email
+      - profile
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-oidc
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  oidc:
+    provider:
+      issuer: "https://${auth0Domain}"
+    clientID: "$clientID"
+    clientSecret:
+      name: ${route}-oidc-secret
+    redirectURL: "https://${hostname}/oauth2/callback"
+    scopes:
+      - openid
+      - email
+      - profile
+EOF
+```
+
+Allow 60 seconds for the policy to propagate to the edge before testing.
+
+---
+
+## Verification
+
+### Unauthenticated Request — Redirects to Auth0
+
+```bash
+curl -I https://your-app.example.com
+```
+
+Expected:
+
+```
+HTTP/1.1 302 Found
+Location: https://dev-xxxxxxxx.us.auth0.com/authorize?...
+```
+
+### Browser Flow — Allowed User
+
+1. Open `https://your-app.example.com` in a browser
+2. You are redirected to Auth0 → Google login
+3. Sign in with an email in the allow-list
+4. You are redirected back and the app loads — `HTTP 200`
+
+### Browser Flow — Denied User
+
+1. Sign in with an email **not** in the allow-list
+2. Auth0 displays: `Access denied: you are not authorized to use this application.`
+3. No token is issued — Envoy is never reached
+
+---
+
+## Managing Access
+
+All access control is managed in the Auth0 dashboard — no gateway config changes needed.
+
+**Add a user:**
+1. Go to **Actions** → **Library** → `enforce-email-allowlist`
+2. Add the email to `allowedEmails`
+3. Click **Deploy**
+
+**Remove a user:**
+1. Remove the email from `allowedEmails`
+2. Click **Deploy**
+3. Optionally revoke any active sessions: **User Management** → find user → **Invalidate Sessions**
+
+---
+
+## Cleanup
+
+### Windows (PowerShell)
+
+```powershell
+datumctl delete securitypolicy ${route}-oidc `
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-oidc-secret `
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+### macOS / Linux
+
+```bash
+datumctl delete securitypolicy ${route}-oidc \
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-oidc-secret \
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+---
+
+## Troubleshooting
+
+| Symptom | Root Cause | Resolution |
+|---------|------------|------------|
+| HTTP 200 instead of redirect | SecurityPolicy not yet propagated | Wait 60 seconds; verify with `datumctl get securitypolicy` |
+| HTTP 500 on all requests (immediate) | `jwt` block present in SecurityPolicy | Remove `jwt` block — use `oidc` block only |
+| HTTP 500 on all requests (immediate) | WAF (`TrafficProtectionPolicy`) blocking OIDC | Remove the `TrafficProtectionPolicy` targeting the Gateway |
+| HTTP 500 on all requests | Secret missing `gateway-sync` label | Verify label is present; re-apply Secret if needed |
+| Auth0 error: `callback URL mismatch` | App hostname not in Auth0 Allowed Callback URLs | Add `https://<hostname>/oauth2/callback` in Auth0 Application Settings |
+| Google error 400: `redirect_uri_mismatch` | Auth0 callback not in Google OAuth client | Add `https://<auth0Domain>/login/callback` to Google Cloud Console Authorized redirect URIs |
+| Redirect loop | `redirectURL` mismatch | Ensure it matches **Allowed Callback URLs** in Auth0 exactly |
+| User sees "Access denied" at Auth0 | Not in allow-list | Add email to the Action and redeploy |
+| User bypasses allow-list | Action not in Login flow | Verify action is added under **Actions** → **Triggers** → **post-login** |
+
+### Useful Debug Commands
+
+```bash
+datumctl get securitypolicy --project $project --namespace $namespace
+datumctl get secret --project $project --namespace $namespace
+datumctl get httproute --project $project --namespace $namespace
+datumctl get trafficprotectionpolicy --project $project --namespace $namespace
+```
+
+---
+
+## Summary
+
+| Concern | Where it lives |
+|---------|----------------|
+| Google social login | Auth0 social connection |
+| Who is allowed | Auth0 Action (`enforce-email-allowlist`) |
+| Token issuance | Auth0 — denied users never get a token |
+| Token validation | Envoy OIDC block (handled automatically) |
+| Session management | Envoy OIDC block (cookie) |
+| App changes required | None |
diff --git a/ai-edge/oidc-google.mdx b/ai-edge/oidc-google.mdx
new file mode 100644
index 0000000..5a3013f
--- /dev/null
+++ b/ai-edge/oidc-google.mdx
@@ -0,0 +1,316 @@
+---
+title: "OAuth 2.0 / OIDC Authentication with Google and Datum"
+description: "Configure OIDC authentication using Google OAuth 2.0 for applications behind a Datum gateway using datumctl and Envoy Gateway SecurityPolicy."
+---
+
+This guide describes how to configure **OAuth 2.0 / OIDC Authentication** for applications running behind a **Datum gateway** using `datumctl`. The configuration uses **Envoy Gateway `SecurityPolicy`** resources and applies to **Windows, macOS, and Linux**.
+
+---
+
+## Overview
+
+OIDC authentication protects an application by requiring users to sign in with their Google account before requests are forwarded to the origin. Envoy Gateway handles the OAuth 2.0 flow transparently — users are redirected to Google, authenticate, and are redirected back without any changes to your application.
+
+At a high level, this setup:
+
+1. Creates a **Google OAuth 2.0 Client** in Google Cloud Console
+2. Stores the client secret in a **Kubernetes Secret**
+3. Labels the Secret so it is synced to edge clusters
+4. Attaches a **SecurityPolicy** with OIDC config to an `HTTPRoute`
+5. Verifies authentication behavior
+
+---
+
+## Prerequisites
+
+- `datumctl` installed and authenticated
+- A valid **Project**
+- A **Google Cloud** account with a project
+- Existing:
+  - `Gateway`
+  - `HTTPRoute`
+- Permission to create:
+  - `Secret`
+  - `SecurityPolicy`
+
+Verify access:
+
+```bash
+datumctl get gateway
+datumctl get httproute
+```
+
+---
+
+## Critical Requirement: Secret Syncing
+
+Secrets and ConfigMaps referenced by gateway configurations are **not automatically synced** to edge clusters.
+
+To make a Secret available to edge gateways, it **must** include the following label:
+
+```yaml
+networking.datumapis.com/gateway-sync: "true"
+```
+
+### Why This Matters
+
+- Without this label, the gateway receives the policy but **not the Secret**
+- Envoy fails to load the OAuth client credentials
+- All requests return **HTTP 500** instead of redirecting to Google
+
+This requirement exists to prevent accidental replication of unrelated secrets.
+
+---
+
+## Configuration Steps
+
+### Step 1: Create Google OAuth 2.0 Credentials
+
+1. Go to [Google Cloud Console](https://console.cloud.google.com) → **APIs & Services** → **Credentials**
+2. Click **Create Credentials** → **OAuth 2.0 Client ID**
+3. Set **Application type** to **Web application**
+4. Under **Authorized redirect URIs**, add:
+   ```
+   https://<your-app-hostname>/oauth2/callback
+   ```
+   Replace `<your-app-hostname>` with the public hostname of your `HTTPRoute`.
+5. Click **Create** and copy the **Client ID** and **Client Secret**
+
+> **Note:** The redirect URI must exactly match the value you will configure in the `SecurityPolicy`. Any mismatch causes Google to reject the OAuth flow.
+
+---
+
+### Step 2: Set Variables
+
+#### Windows (PowerShell)
+
+```powershell
+$project      = "your-project-id"
+$namespace    = "default"
+$route        = "your-route-name"
+$hostname     = "your-app.example.com"
+$clientID     = "your-client-id.apps.googleusercontent.com"
+$clientSecret = "your-client-secret"
+```
+
+#### macOS / Linux
+
+```bash
+project="your-project-id"
+namespace="default"
+route="your-route-name"
+hostname="your-app.example.com"
+clientID="your-client-id.apps.googleusercontent.com"
+clientSecret="your-client-secret"
+```
+
+---
+
+### Step 3: Create the Client Secret
+
+The Secret must:
+
+- Use the key `client-secret`
+- Exist in the same namespace as the `SecurityPolicy`
+- Include the **gateway-sync** label
+
+#### Windows (PowerShell)
+
+```powershell
+$b64Secret = [Convert]::ToBase64String(
+  [Text.Encoding]::UTF8.GetBytes($clientSecret)
+)
+
+@"
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-oidc-secret
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  client-secret: $b64Secret
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+b64Secret=$(printf "%s" "$clientSecret" | base64)
+
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: v1
+kind: Secret
+metadata:
+  name: ${route}-oidc-secret
+  labels:
+    networking.datumapis.com/gateway-sync: "true"
+type: Opaque
+data:
+  client-secret: $b64Secret
+EOF
+```
+
+---
+
+### Step 4: Attach OIDC Auth Using a SecurityPolicy
+
+Attach the policy to the **HTTPRoute**. This is the most reliable attachment point.
+
+#### Windows (PowerShell)
+
+```powershell
+@"
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-oidc
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "$clientID"
+    clientSecret:
+      name: ${route}-oidc-secret
+    redirectURL: "https://${hostname}/oauth2/callback"
+    scopes:
+      - openid
+      - email
+      - profile
+"@ | datumctl apply --project $project --namespace $namespace -f -
+```
+
+#### macOS / Linux
+
+```bash
+cat <<EOF | datumctl apply --project $project --namespace $namespace -f -
+apiVersion: gateway.envoyproxy.io/v1alpha1
+kind: SecurityPolicy
+metadata:
+  name: ${route}-oidc
+spec:
+  targetRefs:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      name: $route
+  oidc:
+    provider:
+      issuer: "https://accounts.google.com"
+    clientID: "$clientID"
+    clientSecret:
+      name: ${route}-oidc-secret
+    redirectURL: "https://${hostname}/oauth2/callback"
+    scopes:
+      - openid
+      - email
+      - profile
+EOF
+```
+
+---
+
+## Verification
+
+### Unauthenticated Request
+
+```bash
+curl -I https://your-app.example.com
+```
+
+Expected response:
+
+```
+HTTP/1.1 302 Found
+Location: https://accounts.google.com/o/oauth2/v2/auth?...
+```
+
+Browsers will redirect automatically to the Google sign-in page.
+
+---
+
+### Authenticated Session
+
+After completing the Google sign-in flow, subsequent requests will be forwarded to your origin with a session cookie managed by Envoy.
+
+```bash
+curl -I https://your-app.example.com
+```
+
+Expected response after authentication:
+
+```
+HTTP/1.1 200 OK
+```
+
+---
+
+## Cleanup / Disable OIDC Auth
+
+### Windows (PowerShell)
+
+```powershell
+datumctl delete securitypolicy ${route}-oidc `
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-oidc-secret `
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+### macOS / Linux
+
+```bash
+datumctl delete securitypolicy ${route}-oidc \
+  --project $project --namespace $namespace --ignore-not-found
+
+datumctl delete secret ${route}-oidc-secret \
+  --project $project --namespace $namespace --ignore-not-found
+```
+
+---
+
+## Troubleshooting
+
+### Common Failure Modes
+
+| Symptom | Root Cause | Resolution |
+|---------|------------|------------|
+| HTTP 500 on all requests | Secret not synced to edge | Add `gateway-sync` label |
+| Redirect loop | Redirect URI mismatch | Ensure `redirectURL` matches Google Console exactly |
+| `redirect_uri_mismatch` from Google | URI not registered | Add URI to Google Cloud Credentials |
+| HTTP 401 after login | Scopes insufficient | Verify `openid` scope is included |
+| Works after deleting policy | Invalid Secret reference | Fix Secret name and `gateway-sync` label |
+
+---
+
+### Useful Debug Commands
+
+```bash
+datumctl get secret --project $project --namespace $namespace
+datumctl get securitypolicy --project $project --namespace $namespace
+datumctl get httproute --project $project --namespace $namespace
+```
+
+---
+
+## Best Practices
+
+- Register **separate OAuth clients** for each environment (dev, staging, prod)
+- Restrict **authorized redirect URIs** to known hostnames only
+- Limit **OAuth scopes** to the minimum required (`openid`, `email`)
+- Rotate the **client secret** periodically and re-apply the Secret
+- Use OIDC for production — Basic Auth is suited for development and demos
+
+---
+
+## Summary
+
+- Google OAuth is configured using **Envoy Gateway `SecurityPolicy`** with an `oidc` block
+- The client secret is stored as a Kubernetes Secret with key **`client-secret`**
+- Secrets **must be explicitly synced** to edge clusters using the `networking.datumapis.com/gateway-sync: "true"` label
+- The **`redirectURL`** in the policy must exactly match the URI registered in Google Cloud Console
+- Attaching policies to `HTTPRoute` is the most reliable approach
diff --git a/docs.json b/docs.json
index 2882be2..0c22e4f 100644
--- a/docs.json
+++ b/docs.json
@@ -80,7 +80,10 @@
           {
             "group": "AI Edge",
             "pages": [
-              "ai-edge/overview"
+              "ai-edge/overview",
+              "ai-edge/basic-auth",
+              "ai-edge/oidc-google",
+              "ai-edge/oidc-auth0"
             ]
           },
           {