diff --git a/server/cmd/main.go b/server/cmd/main.go
index 8d5a573..6976b21 100644
--- a/server/cmd/main.go
+++ b/server/cmd/main.go
@@ -29,24 +29,32 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
-//	@title						Vantage API
-//	@version					1.0
-//	@description				The Vantage control plane REST API. Authenticate with a browser session cookie, or with an API token created under Settings → API tokens.
-//	@BasePath					/api
-//
+//	@title			Vantage API
+//	@version		1.0
+//	@description	The Vantage control plane REST API. Authenticate with a browser session cookie, or with an API token created under Settings → API tokens.
+//	@BasePath		/api
+
+// Each @securityDefinitions.apikey block below is deliberately its own
+// comment group, separated by a real blank line rather than a bare "//": Go's
+// parser only splits ast.CommentGroups on an actual blank line, and
+// swag v2.0.0-rc5's parseSecAttributesV3 resolves a scheme's map key by
+// scanning from the start of whatever comment group it was handed — so three
+// stacked blocks sharing one group all collapse onto the first block's name.
+// Three groups means three independent scans, each finding its own name.
+
 //	@securityDefinitions.apikey	cookieAuth
-//	@in							cookie
-//	@name						km_session
-//
+//	@in								cookie
+//	@name							km_session
+
 //	@securityDefinitions.apikey	bearerAuth
-//	@in							header
-//	@name						Authorization
-//	@description				An API token, sent as "Bearer vt_…". Scoped and optionally expiring.
-//
+//	@in								header
+//	@name							Authorization
+//	@description					An API token, sent as "Bearer vt_…". Scoped and optionally expiring.
+
 //	@securityDefinitions.apikey	esoAuth
-//	@in							header
-//	@name						Authorization
-//	@description				The External Secrets read token, rotated under Settings. It reaches /api/secrets/{group}/values and nothing else. It is a different credential from an API token, and the two must never be substituted for one another.
+//	@in								header
+//	@name							Authorization
+//	@description					The External Secrets read token, rotated under Settings. It reaches /api/secrets/{group}/values and nothing else. It is a different credential from an API token, and the two must never be substituted for one another.
 func main() {
 	mongoURI := getEnv("MONGO_URI", "mongodb://localhost:27017")
 
diff --git a/server/internal/api/docs/openapi.json b/server/internal/api/docs/openapi.json
index 8de7249..94a528b 100644
--- a/server/internal/api/docs/openapi.json
+++ b/server/internal/api/docs/openapi.json
@@ -2002,7 +2002,18 @@
             }
         },
         "securitySchemes": {
+            "bearerAuth": {
+                "description": "An API token, sent as \"Bearer vt_…\". Scoped and optionally expiring.",
+                "in": "header",
+                "name": "Authorization",
+                "type": "apiKey"
+            },
             "cookieAuth": {
+                "in": "cookie",
+                "name": "km_session",
+                "type": "apiKey"
+            },
+            "esoAuth": {
                 "description": "The External Secrets read token, rotated under Settings. It reaches /api/secrets/{group}/values and nothing else. It is a different credential from an API token, and the two must never be substituted for one another.",
                 "in": "header",
                 "name": "Authorization",