peer rev

Signed-off-by: Art Berger <art.berger@solo.io>

Author: artberger

assets/agw-docs/pages/agentgateway/llm/virtual-keys.md

@@ -62,8 +62,8 @@ Store your virtual keys in a Kubernetes ConfigMap, with one entry per user. Beca
 1. Generate a `sha256:<hex>` hash for each user's API key. The hash is computed over the exact key bytes, so do not include a trailing newline.
 
    ```sh
-   printf '%s' 'sk-alice-abc123def456' | sha256sum   # alice
-   printf '%s' 'sk-bob-xyz789uvw012' | sha256sum     # bob
+   printf '%s' 'sk-alice-abc123def456' | sha256sum | awk '{print "sha256:"$1}'   # alice
+   printf '%s' 'sk-bob-xyz789uvw012' | sha256sum | awk '{print "sha256:"$1}'     # bob
    ```
 
 2. Create a ConfigMap that stores the hash and metadata for each user. Add a label so that the authentication policy can select the ConfigMap in the next step.
@@ -147,7 +147,7 @@ EOF
 ### Configure API key authentication
 
 {{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
-Create an {{< reuse "agw-docs/snippets/policy.md" >}} that requires API key authentication for all requests to the gateway. Use `configMapSelector` to select every ConfigMap that carries the label you added in the previous step. ConfigMap sources are selected by label only, so this also selects a single ConfigMap by its label.
+Create an {{< reuse "agw-docs/snippets/policy.md" >}} that requires API key authentication for all requests to the gateway. Unlike Secrets, which you can reference directly by name, ConfigMaps can be selected only by label. Use `configMapSelector` to match every ConfigMap that carries the label you added in the previous step, whether that is a single ConfigMap or several.
 
 ```yaml,paths="virtual-keys"
 kubectl apply -f- <<EOF
@@ -780,7 +780,7 @@ Provide different budget tiers for free, standard, and premium users.
 1. Add tier metadata to each API key.
 
    {{< version exclude-if="1.3.x,1.2.x,1.1.x,1.0.x,2.2.x" >}}
-   Store the keys in a ConfigMap, using the `keyHash` of each key. Generate each hash with `printf '%s' '<key>' | sha256sum`.
+   Store the keys in a ConfigMap, using the `keyHash` of each key. Generate each hash with `printf '%s' '<key>' | sha256sum | awk '{print "sha256:"$1}'`.
 
    ```yaml
    apiVersion: v1

assets/agw-docs/pages/security/apikey-auth.md

@@ -72,7 +72,7 @@ Store your API keys in a Kubernetes ConfigMap so that you can reference them in
 2. Generate a `sha256:<hex>` hash of the API key. The hash is computed over the exact key bytes, so do not include a trailing newline.
 
    ```sh
-   printf '%s' 'N2YwMDIxZTEtNGUzNS1jNzgzLTRkYjAtYjE2YzRkZGVmNjcy' | sha256sum
+   printf '%s' 'N2YwMDIxZTEtNGUzNS1jNzgzLTRkYjAtYjE2YzRkZGVmNjcy' | sha256sum | awk '{print "sha256:"$1}'
    ```
 
 3. Create a ConfigMap to store your API key hashes. Each entry represents one valid API key, as a JSON object with a `keyHash` and optional `metadata`. Add a label so that the policy can select the ConfigMap.
@@ -160,7 +160,7 @@ Store your API keys in a Kubernetes secret so that you can reference it in an {{
    kubectl get secret apikey -n {{< reuse "agw-docs/snippets/namespace.md" >}} -oyaml
    ```
 
-4. Create an {{< reuse "agw-docs/snippets/policy.md" >}} resource that configures API key authentication for all routes that the Gateway serves and reference the `apikey` secret that you created earlier. The following example uses the `Strict` validation mode, which requires request to include a valid `Authorization` header to be authenticated successfully. For other common configuration examples, see [Other configuration examples](#other-configuration-examples).
+4. Create an {{< reuse "agw-docs/snippets/policy.md" >}} resource that configures API key authentication for all routes that the Gateway serves and reference the `apikey` secret that you created earlier. The following example uses the `Strict` validation mode, which requires requests to include a valid `Authorization` header to be authenticated successfully. For other common configuration examples, see [Other configuration examples](#other-configuration-examples).
    ```yaml
    kubectl apply -f- <<EOF
    apiVersion: {{< reuse "agw-docs/snippets/api-version.md" >}}