diff --git a/open-sse/config/providers/registry/kilo-gateway/index.ts b/open-sse/config/providers/registry/kilo-gateway/index.ts
index 783f812864..67b57f1fa7 100644
--- a/open-sse/config/providers/registry/kilo-gateway/index.ts
+++ b/open-sse/config/providers/registry/kilo-gateway/index.ts
@@ -1,5 +1,10 @@
 import type { RegistryEntry } from "../../shared.ts";
 
+/**
+ * The key is genuinely optional: probed live 2026-08-11 with no Authorization
+ * header, /chat/completions still answered 200 (kilo-auto/free routed to
+ * stepfun/step-3.7-flash) — so authType stays "optional", matching ovhcloud.
+ */
 export const kilo_gatewayProvider: RegistryEntry = {
   id: "kilo-gateway",
   alias: "kg",
@@ -7,7 +12,7 @@ export const kilo_gatewayProvider: RegistryEntry = {
   executor: "default",
   baseUrl: "https://api.kilo.ai/api/gateway/chat/completions",
   modelsUrl: "https://api.kilo.ai/api/gateway/models",
-  authType: "apikey",
+  authType: "optional",
   authHeader: "bearer",
   models: [
     { id: "kilo-auto/frontier", name: "Kilo Auto Frontier" },
diff --git a/tests/unit/provider-credential-requirement.test.ts b/tests/unit/provider-credential-requirement.test.ts
index 5931842732..531b982fc0 100644
--- a/tests/unit/provider-credential-requirement.test.ts
+++ b/tests/unit/provider-credential-requirement.test.ts
@@ -18,6 +18,8 @@ test("classifies each credential model from the real registries", () => {
   assert.equal(getCredentialRequirement("kilocode"), "optional");
   // Verified live 2026-07-20: answers with no Authorization header, 403s on a bad key.
   assert.equal(getCredentialRequirement("ovhcloud"), "optional");
+  // Verified live 2026-08-11: HTTP 200 with no Authorization header (#10068).
+  assert.equal(getCredentialRequirement("kilo-gateway"), "optional");
   // OAuth: nothing to paste, but the user still signs in.
   assert.equal(getCredentialRequirement("agy"), "oauth");
   // Ordinary key-gated provider.