diff --git a/public/admin/config.yml b/public/admin/config.yml
index 39eddb5..810c193 100644
--- a/public/admin/config.yml
+++ b/public/admin/config.yml
@@ -11,6 +11,11 @@ backend:
   base_url: http://localhost:3000
   api_root: http://localhost:3000/api/v1
   app_id: cf1c44ac-ebe6-4a97-bf2f-f7f26ef1126c
+  # OAuth only — hides the "access token" sign-in option (documented
+  # auth_methods). The "Work with Local Repository" button needs no config:
+  # it renders only on localhost (source-verified), so it vanishes once the
+  # portal is served from a real domain.
+  auth_methods: [oauth]
 
 # CTAO branding on the sign-in screen and browser tab (documented Sveltia
 # options: app_title replaces the "Sveltia CMS" label; logo.src is the