diff --git a/fern/.docs-snapshots.yml b/fern/.docs-snapshots.yml
index 549883454..5027e586c 100644
--- a/fern/.docs-snapshots.yml
+++ b/fern/.docs-snapshots.yml
@@ -1,8 +1,8 @@
 snapshots:
   dev:
-    source-ref: ea265a2f9a86e6fc1911041fec4b5fdcefd674dd
-    source-sha: ea265a2f9a86e6fc1911041fec4b5fdcefd674dd
-    version: 0.1.6.dev6
+    source-ref: 915a5d1553bdd48c15a85f7fa3266f0c695cbba1
+    source-sha: 915a5d1553bdd48c15a85f7fa3266f0c695cbba1
+    version: 0.1.6.dev8
   latest:
     source-ref: bdb956f2cd65a635f1294fccf1d138d263bf650f
     source-sha: bdb956f2cd65a635f1294fccf1d138d263bf650f
diff --git a/fern/pages-dev/observability/logging.mdx b/fern/pages-dev/observability/logging.mdx
index ce7cab1ee..d7f068dca 100644
--- a/fern/pages-dev/observability/logging.mdx
+++ b/fern/pages-dev/observability/logging.mdx
@@ -60,7 +60,7 @@ OpenShell maps sandbox events to these OCSF classes:
 | `SSH:` | SSH Activity | 4007 | SSH handshakes, authentication, channel operations |
 | `PROC:` | Process Activity | 1007 | Process start, exit, timeout, signal failures |
 | `FINDING:` | Detection Finding | 2004 | Security findings (nonce replay, proxy bypass, unsafe policy) |
-| `AUTH:` | Authentication | 3002 | Gateway authentication failures |
+| `AUTH:` | Authentication | 3002 | Gateway authentication failures and credential logons |
 | `API:` | API Activity | 6003 | Inference calls, gateway authorization denials |
 | `CONFIG:` | Device Config State Change | 5019 | Policy load/reload, Landlock, TLS setup, provider and settings changes |
 | `LIFECYCLE:` | Application Lifecycle | 6002 | Sandbox supervisor start, SSH server ready |
@@ -115,6 +115,12 @@ A gateway request rejected because it presented no credential:
 OCSF AUTH:LOGON [LOW] DENIED unknown [op:/openshell.v1.OpenShell/ListSandboxes reason:missing_credential]
 ```
 
+The first request a gateway replica accepts with a user's OIDC token:
+
+```text
+OCSF AUTH:LOGON [INFO] ALLOWED user:8d2f6b1c-3e4a-4f5b-9c7d-0a1b2c3d4e5f from 203.0.113.7:51234 [protocol:OpenID op:/openshell.v1.OpenShell/ListSandboxes]
+```
+
 A sandbox credential used to read another sandbox's configuration:
 
 ```text
diff --git a/fern/pages-dev/observability/ocsf-json-export.mdx b/fern/pages-dev/observability/ocsf-json-export.mdx
index 593ed88e8..583f41bfb 100644
--- a/fern/pages-dev/observability/ocsf-json-export.mdx
+++ b/fern/pages-dev/observability/ocsf-json-export.mdx
@@ -37,6 +37,8 @@ The gateway emits an Authentication (`class_uid: 3002`) event when it rejects a
 
 `src_endpoint` holds the address of the connection's immediate peer, which is the proxy or load balancer when one fronts the gateway, or the name `edge-tunnel` for requests carried over the WebSocket tunnel. `metadata.correlation_uid` holds the request's `x-request-id` when it is a UUID. The gateway generates one when the client sends none and returns it in the response. A client-supplied ID is recorded as sent, so it identifies the request, not the client.
 
+The gateway also emits an Informational Authentication event with `status: Success` the first time a replica accepts a credential, such as a bearer token or client certificate. Later requests with the same credential emit nothing, so supervisor polling does not repeat the event. A refreshed token or renewed certificate is a new credential and logs on again, as does a credential still in use an hour later. Each replica records its own logons, and a replica tracking more than 16,384 credentials forgets the oldest early. `user` identifies the principal the same way `actor.user` does for authorization denials, described below. The `src_endpoint` and `metadata.correlation_uid` come from the request that logged on. Requests admitted by `auth.allow_unauthenticated_users`, or by a gateway with no authentication configured, emit no success event. To select only rejected requests, filter Authentication events on `status_id: 2` (Failure) rather than on `class_uid` alone.
+
 These events never include presented credentials, other request headers, or verification error text.
 
 The gateway emits an API Activity (`class_uid: 6003`) event with Medium severity when its method, role, scope, sandbox, workspace, or operator checks refuse an authenticated caller. `actor.user` identifies the principal: its `type` is `User`, `Admin` for an mTLS operator, `Sandbox`, or `Gateway Peer`, and `uid` is the subject, sandbox ID, or gateway replica ID. `api.operation` names the gRPC method, and `resources` names the sandbox or workspace that was refused, when one applies, by `uid` for a sandbox ID or by `name` otherwise. `status_detail` holds the reason category: