From ce7594d0587b9a23c561cdc0197de8db0a562132 Mon Sep 17 00:00:00 2001
From: shamoon <4887959+shamoon@users.noreply.github.com>
Date: Sat, 13 Jun 2026 08:12:32 -0700
Subject: [PATCH] Documentation: tweak auth docs

---
 README.md                  | 2 +-
 docs/installation/index.md | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/README.md b/README.md
index 88d20b0ec..1648a0887 100644
--- a/README.md
+++ b/README.md
@@ -66,7 +66,7 @@ For configuration options, examples and more, [please check out the homepage doc
 Please note that when using features such as widgets, Homepage can access personal information (for example from your home automation system). To keep your information private, if Homepage is reachable from any untrusted network, it:
 
 1. **must** sit behind a reverse proxy (and/or VPN) that enforces authentication, TLS, and strictly validates Host headers.
-2. An optional built-in OIDC login flow is available (opt-in) offering a simple “authenticated or not” guard.
+2. An optional built-in OIDC login flow or simple password login is available (opt-in) offering a simple “authenticated or not” guard.
 
 ## With Docker
 
diff --git a/docs/installation/index.md b/docs/installation/index.md
index d31f540c4..0f1f70e53 100644
--- a/docs/installation/index.md
+++ b/docs/installation/index.md
@@ -60,4 +60,4 @@ For OIDC login (overrides password login):
 - `HOMEPAGE_EXTERNAL_URL` (external URL to your Homepage instance; used for callbacks)
 - Optional: `HOMEPAGE_OIDC_NAME` (display name), `HOMEPAGE_OIDC_SCOPE` (defaults to `openid email profile`)
 
-All app pages and `/api` routes will require a signed-in session. Static assets remain public. Homepage still does not implement per-user dashboards or roles; authentication is a simple gate only.
+All app pages and `/api` routes will require a signed-in session. Static assets remain public.