Docs: document secrets refs runtime and migration

docs/gateway/authentication.md

@@ -14,6 +14,7 @@ use the long‑lived token created by `claude setup-token`.
 
 See [/concepts/oauth](/concepts/oauth) for the full OAuth flow and storage
 layout.
+For SecretRef-based auth (env/sops-backed refs), see [Secrets Management](/gateway/secrets).
 
 ## Recommended Anthropic setup (API key)
 
@@ -85,6 +86,11 @@ openclaw models auth paste-token --provider anthropic
 openclaw models auth paste-token --provider openrouter
 ```
 
+Auth profile refs are also supported for static credentials:
+
+- `api_key` credentials can use `keyRef: { source, id }`
+- `token` credentials can use `tokenRef: { source, id }`
+
 Automation-friendly check (exit `1` when expired/missing, `2` when expiring):
 
 ```bash