diff --git a/docs/providers/ollama.md b/docs/providers/ollama.md
index 86462d99a60..bb3fc9aaae4 100644
--- a/docs/providers/ollama.md
+++ b/docs/providers/ollama.md
@@ -15,11 +15,26 @@ OpenClaw integrates with Ollama's native API (`/api/chat`) for hosted cloud mode
Ollama provider config uses `baseUrl` as the canonical key. OpenClaw also accepts `baseURL` for compatibility with OpenAI SDK-style examples, but new config should prefer `baseUrl`.
-Local and LAN Ollama hosts do not need a real bearer token; OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs. Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`.
+### Auth rules
-Custom provider ids that set `api: "ollama"` use the same auth rules. For example, an `ollama-remote` provider that points at a private LAN Ollama host can use `apiKey: "ollama-local"` and sub-agents will resolve that marker through the Ollama provider hook instead of treating it as a missing credential.
+
+
+ Local and LAN Ollama hosts do not need a real bearer token. OpenClaw uses the local `ollama-local` marker only for loopback, private-network, `.local`, and bare-hostname Ollama base URLs.
+
+
+ Remote public hosts and Ollama Cloud (`https://ollama.com`) require a real credential through `OLLAMA_API_KEY`, an auth profile, or the provider's `apiKey`.
+
+
+ Custom provider ids that set `api: "ollama"` follow the same rules. For example, an `ollama-remote` provider that points at a private LAN Ollama host can use `apiKey: "ollama-local"` and sub-agents will resolve that marker through the Ollama provider hook instead of treating it as a missing credential.
+
+
+ When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared:
-When Ollama is used for memory embeddings, bearer auth is scoped to the host where it was declared. A provider-level key is sent only to that provider's Ollama host; `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host; and a pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention rather than being sent to local/self-hosted hosts by default.
+ - A provider-level key is sent only to that provider's Ollama host.
+ - `agents.*.memorySearch.remote.apiKey` is sent only to its remote embedding host.
+ - A pure `OLLAMA_API_KEY` env value is treated as the Ollama Cloud convention, not sent to local or self-hosted hosts by default.
+
+
## Getting started
@@ -485,7 +500,7 @@ For the full setup and behavior details, see [Ollama Web Search](/tools/ollama-s
ollama pull deepseek-r1:32b
```
- No additional configuration is needed -- OpenClaw marks them automatically.
+ No additional configuration is needed. OpenClaw marks them automatically.
@@ -607,7 +622,7 @@ More help: [Troubleshooting](/help/troubleshooting) and [FAQ](/help/faq).
## Related
-
+
Overview of all providers, model refs, and failover behavior.