diff --git a/content/configuration/auth-sso.md b/content/configuration/auth-sso.md
index 96b211a76..2b9ccf621 100644
--- a/content/configuration/auth-sso.md
+++ b/content/configuration/auth-sso.md
@@ -23,6 +23,13 @@ For each of the auth providers listed, you must provide the following configurat
 | `AUTH_<PROVIDER>_DRIVER` | Which driver to use, either `local`, `oauth2`, `openid`, `ldap`, `saml`.                                                                    |               |
 | `AUTH_<PROVIDER>_MODE`   | Whether to use `'cookie'` or `'session'` authentication mode when redirecting. Applies to the following drivers `oauth2`, `openid`, `saml`. | `session`     |
 
+::callout{icon="i-lucide-info"}
+**Data Studio login**  
+The Data Studio login page only lists `oauth2`, `openid`, and `saml` providers configured with `AUTH_<PROVIDER>_MODE=session` (the default). Providers using `cookie` mode are hidden from the login screen, because they are intended for external applications that consume refresh tokens rather than the Data Studio session cookie. The Data Studio requests `GET /auth?sessionOnly`, which excludes them. `GET /auth` without that parameter still returns them.
+
+The `/auth/login/<provider>` flow still works for `cookie` mode providers. If an SSO button is missing from the login page, confirm the provider is set to `session` mode and that your license includes SSO.
+::
+
 ::callout{icon="i-lucide-info"}
 Cookie and session configuration settings such as `REFRESH_TOKEN_COOKIE_*`, `SESSION_COOKIE_*`, and related security parameters can be found in [Security & Limits](/configuration/security-limits).
 ::