diff --git a/README.md b/README.md
index 71fc711..c8d98a7 100644
--- a/README.md
+++ b/README.md
@@ -97,6 +97,34 @@ RUST_LOG=info ./target/release/zerogravity --headless
 zg start
 ```
 
+## Authentication
+
+The proxy needs an OAuth token:
+
+1. **Env var**: `ZEROGRAVITY_TOKEN=ya29.xxx`
+2. **Token file**: `~/.config/zerogravity-token`
+3. **Runtime**: `curl -X POST http://localhost:8741/v1/token -d '{"token":"ya29.xxx"}'`
+
+<details>
+<summary>How to get the token</summary>
+
+1. Open Antigravity → **Help** > **Toggle Developer Tools**
+2. Go to the **Network** tab
+3. Send any prompt
+4. Find a request to `generativelanguage.googleapis.com` or `SendUserCascadeMessage`
+5. Right-click → **Copy as cURL**
+6. Paste the cURL into any LLM with this prompt:
+
+```
+Extract the OAuth token (starts with ya29.) from this cURL command and give me just the token, nothing else:
+
+<paste cURL here>
+```
+
+> **Note:** OAuth tokens expire after ~1 hour. If Antigravity is installed on the same machine, the proxy reads `state.vscdb` which contains a refresh token — auto-refresh works automatically even without Antigravity running. If you provide a bare `ya29.xxx` token via env/file/runtime, there's no refresh token, so you'll need to update it manually when it expires.
+
+</details>
+
 ## Setup
 
 ### Linux
@@ -167,27 +195,6 @@ schtasks /run /tn "ZeroGravity Proxy"
 | `GET`      | `/v1/quota`                       | LS quota and rate limits              |
 | `GET`      | `/health`                         | Health check                          |
 
-## Authentication
-
-The proxy needs an OAuth token:
-
-1. **Env var**: `ZEROGRAVITY_TOKEN=ya29.xxx`
-2. **Token file**: `~/.config/zerogravity-token`
-3. **Runtime**: `curl -X POST http://localhost:8741/v1/token -d '{"token":"ya29.xxx"}'`
-
-<details>
-<summary>How to get the token</summary>
-
-1. Open Antigravity → **Help** > **Toggle Developer Tools**
-2. Go to the **Network** tab
-3. Send any prompt
-4. Find a request to `generativelanguage.googleapis.com` or `SendUserCascadeMessage`
-5. Copy the `ya29.xxx...` token from the `Authorization` header or protobuf payload
-
-> **Note:** OAuth tokens expire after ~1 hour. If Antigravity is installed on the same machine, the proxy reads `state.vscdb` which contains a refresh token — auto-refresh works automatically even without Antigravity running. If you provide a bare `ya29.xxx` token via env/file/runtime, there's no refresh token, so you'll need to update it manually when it expires.
-
-</details>
-
 ## `zg` Commands
 
 | Command         | Description                    |