diff --git a/README.md b/README.md
index bd1e9db..12c3af1 100644
--- a/README.md
+++ b/README.md
@@ -36,6 +36,23 @@ On first install Codex kicks off the OAuth 2.1 + PKCE flow against the MCP serve
 
 The MCP server implements **Dynamic Client Registration (RFC 7591)**, so Codex's ephemeral `http://localhost:<port>` callback registers itself on the fly — no manual whitelisting in the AS required. Restricted to `@oracle.com` identities.
 
+## Re-authentication
+
+If a tool call fails with `Auth required`, the OAuth access token has expired and Codex did not refresh it automatically. Re-authenticate without uninstalling:
+
+```bash
+codex mcp login oci-deal-accelerator
+```
+
+Opens the browser, re-authenticates with Oracle SSO, tools are available again. If that fails, force a clean slate first:
+
+```bash
+codex mcp logout oci-deal-accelerator
+codex mcp login oci-deal-accelerator
+```
+
+As a last resort, uninstall the plugin from `/plugins` and reinstall — the `authentication: "ON_INSTALL"` policy triggers a fresh OAuth flow on install.
+
 ## Repo layout
 
 ```