diff --git a/src/backend/database/routes/host-bulk-routes.ts b/src/backend/database/routes/host-bulk-routes.ts
index b9b0dd2eb..aa3fb77f6 100644
--- a/src/backend/database/routes/host-bulk-routes.ts
+++ b/src/backend/database/routes/host-bulk-routes.ts
@@ -183,8 +183,6 @@ export function registerHostBulkRoutes(
    *   patch:
    *     summary: Bulk update partial fields on multiple SSH hosts
    *     tags: [SSH]
-   *     security:
-   *       - bearerAuth: []
    *     requestBody:
    *       required: true
    *       content:
diff --git a/src/backend/database/routes/host.ts b/src/backend/database/routes/host.ts
index ea68f95db..ebd347dab 100644
--- a/src/backend/database/routes/host.ts
+++ b/src/backend/database/routes/host.ts
@@ -493,8 +493,6 @@ router.post(
  *     description: Creates a host owned by the user assigned to the API key. The user's encrypted data must be unlocked by an active sign-in.
  *     tags:
  *       - Host Enrollment
- *     security:
- *       - bearerAuth: []
  *     requestBody:
  *       required: true
  *       content:
diff --git a/src/backend/database/routes/rbac.ts b/src/backend/database/routes/rbac.ts
index 69b0fb9b3..33a08d0f9 100644
--- a/src/backend/database/routes/rbac.ts
+++ b/src/backend/database/routes/rbac.ts
@@ -1990,8 +1990,6 @@ router.delete(
  *     summary: Set personal authentication for a shared host protocol
  *     description: Selects one of the authenticated recipient's own credentials, or clears the selection with null. The protocol is "ssh" or one a plugin declares.
  *     tags: [RBAC]
- *     security:
- *       - bearerAuth: []
  */
 router.put(
   "/host-access/:hostId/auth/:protocol",
@@ -2047,8 +2045,6 @@ router.put(
  *   get:
  *     summary: Get the current recipient's shared-host protocol authentication override
  *     tags: [RBAC]
- *     security:
- *       - bearerAuth: []
  */
 router.get(
   "/host-access/:hostId/auth/:protocol",
diff --git a/src/backend/utils/swagger.ts b/src/backend/utils/swagger.ts
index 97f52bead..5bda6b011 100644
--- a/src/backend/utils/swagger.ts
+++ b/src/backend/utils/swagger.ts
@@ -65,6 +65,21 @@ const swaggerOptions: SwaggerJSDocOptions = {
           type: "http",
           scheme: "bearer",
           bearerFormat: "JWT",
+          description: "Session JWT sent as Authorization: Bearer <JWT>.",
+        },
+        cookieAuth: {
+          type: "apiKey",
+          in: "cookie",
+          name: "jwt",
+          description:
+            "Session JWT cookie set at sign-in. When present, it takes precedence over the Authorization header.",
+        },
+        apiKeyAuth: {
+          type: "http",
+          scheme: "bearer",
+          bearerFormat: "tmx_<api key>",
+          description:
+            "API key sent as Authorization: Bearer tmx_<api key>. Permissions follow the key owner's account; encrypted data must be unlocked separately. API keys cannot impersonate another user.",
         },
       },
       schemas: {
@@ -81,6 +96,12 @@ const swaggerOptions: SwaggerJSDocOptions = {
       {
         bearerAuth: [],
       },
+      {
+        cookieAuth: [],
+      },
+      {
+        apiKeyAuth: [],
+      },
     ],
     tags: [
       {