diff --git a/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs b/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs
index 7b72e1d9..d7b30047 100644
--- a/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs
+++ b/src/ZB.MOM.WW.ScadaBridge.ManagementService/DebugStreamHub.cs
@@ -11,8 +11,9 @@ namespace ZB.MOM.WW.ScadaBridge.ManagementService;
 
 /// <summary>
 /// SignalR hub for real-time debug stream subscriptions.
-/// External consumers (CLI) connect via WebSocket, authenticate with Basic Auth,
-/// and receive streaming attribute value and alarm state changes.
+/// External consumers (CLI) connect via WebSocket, authenticate through
+/// <see cref="ManagementAuthenticator"/> — a bearer JWT minted by <c>POST /auth/token</c>, or
+/// HTTP Basic (LDAP bind) — and receive streaming attribute value and alarm state changes.
 /// </summary>
 public class DebugStreamHub : Hub
 {
@@ -74,10 +75,10 @@ public class DebugStreamHub : Hub
             return;
         }
 
-        // Authenticate via the SAME shared Basic→LDAP flow as POST /management and the
-        // audit REST (arch-review R2 N1): ManagementAuthenticator applies the DisableLogin
-        // bypass, the LoginThrottle lockout check BEFORE the bind, and RecordFailure/
-        // RecordSuccess bookkeeping — so hub connection attempts can no longer be used as
+        // Authenticate via the SAME shared flow as POST /management and the audit REST
+        // (arch-review R2 N1): ManagementAuthenticator applies the DisableLogin bypass, accepts
+        // a bearer JWT (no LDAP bind) or Basic→LDAP with the LoginThrottle lockout check
+        // BEFORE the bind, and RecordFailure/RecordSuccess bookkeeping — so hub connection attempts can no longer be used as
         // an unthrottled LDAP-bind oracle, and hub failures feed the shared lockout.
         var outcome = await ManagementAuthenticator.AuthenticateAsync(httpContext);
         if (outcome.User is null)