Use Keycloak OAuth for a2amcp login

README.md

@@ -45,7 +45,7 @@ Restart the client after adding or removing agents.
 ## Commands
 
 ```bash
-a2amcp login              # save control-plane credentials
+a2amcp login              # sign in through Keycloak and save OAuth tokens
 a2amcp whoami             # show current account
 a2amcp agents             # list agents visible to your account
 a2amcp add <name>         # expose one agent through this gateway
@@ -57,6 +57,15 @@ a2amcp logout             # clear local credentials
 
 Running `a2amcp` with no command starts the MCP gateway over stdio.
 
+`a2amcp login` uses Keycloak Authorization Code + PKCE. It starts a local
+loopback callback server, opens the browser, exchanges the code for a Keycloak
+access token, and stores the token in `~/.a2a/credentials.json`. For headless
+machines, pass an existing Keycloak access token:
+
+```bash
+a2amcp login --token "$KEYCLOAK_ACCESS_TOKEN"
+```
+
 ## Hosted OAuth Connectors
 
 ChatGPT and Claude-style hosted connectors should not run this stdio gateway.