@@ -195,7 +195,7 @@ how code accesses configuration; request fields remain separate from deployment
 | `EPP_PROVIDER_SMS_ENDPOINT` | Required for SMS delivery | Provider-approved HTTPS SMS endpoint. Guided setup writes the complete send URL from the selected regional profile. |
 | `EPP_PROVIDER_VOICE_ENDPOINT` | Required for voice delivery | Provider-approved HTTPS voice endpoint, which can differ from the SMS endpoint. Guided setup writes the complete send URL. |
 | `EPP_PROVIDER_ENDPOINT_REGION` | Guided deployment metadata | Selected `global` or `eu` route label. |
-| `EPP_PROVIDER_AUTH_MODE` | Live delivery | Must match the adapter: `apiKey` for Telesign or `oauth` for Soprano. |
+| `EPP_PROVIDER_AUTH_MODE` | Live delivery | Must match the adapter: `apiKey` for Infobip, Sinch, or Telesign; `oauth` for Soprano. Bundled adapters do not all have guided setup profiles. |
 | `EPP_PROVIDER_TENANT_ID`, `EPP_PROVIDER_SCOPE` | Soprano OAuth | Provider tenant and selected API scope. |
 | `EPP_OUTBOUND_CLIENT_ID`, `EPP_OUTBOUND_MI_CLIENT_ID` | Soprano OAuth | Existing multitenant application and outbound user-assigned managed identity used for client-assertion exchange. |
 | `EPP_PROVIDER_TIMEOUT_MS` | Optional | Decimal milliseconds. Defaults to `1500`, capped at `2500`; not an end-to-end deadline. |
@@ -252,7 +252,14 @@ Incoming `tenantId`, `channel`, `mode` and `ttlSeconds` are request data and nev
 configured provider or authentication. `channel` selects the configured SMS or voice endpoint;
 there is no deployment-level channel restriction. The legacy `EPP_PROVIDER_CHANNEL` setting is ignored.
 
-## Telesign EPP
+## Provider-specific integration details
+
+Use the [credential and deployment-support table](docs/ONBOARDING.md#provider-credential-names)
+for your selected adapter. The [Soprano OAuth and voice contract](docs/CONTRACT.md#soprano-provider-jwt)
+and [Telesign EPP contract](docs/CONTRACT.md#telesign-epp-integration) describe different API requirements,
+not a provider ranking. The wire example below illustrates Telesign's format only.
+
+### Telesign EPP
 
 The `telesign` adapter sends its JSON contract to the complete SMS or voice URL selected by the
 request channel from the configured endpoints. It does not append or infer a route.
 
@@ -298,7 +298,7 @@ Set by provisioning. **Identical names across all languages.**
 | `EPP_PROVIDER_SMS_ENDPOINT` | required SMS endpoint for the selected provider/region; complete send URL for Telesign/Soprano, base URL for Infobip/Sinch |
 | `EPP_PROVIDER_VOICE_ENDPOINT` | required voice endpoint for the selected provider/region; complete send URL for Telesign/Soprano, base URL for Infobip/Sinch; may differ from SMS |
 | `EPP_PROVIDER_ENDPOINT_REGION` | selected `global` or `eu` route label; informational at runtime |
-| `EPP_PROVIDER_AUTH_MODE` | must match the selected provider (`apiKey` for Telesign, `oauth` for Soprano) |
+| `EPP_PROVIDER_AUTH_MODE` | must match the selected adapter (`apiKey` for Infobip, Sinch, or Telesign; `oauth` for Soprano); see [guided versus adapter-only support](ONBOARDING.md#provider-credential-names) |
 | `EPP_PROVIDER_TENANT_ID` | selected provider tenant; added to the Step 1 app's allowed-tenants preview and used as the OAuth authority for Soprano |
 | `EPP_PROVIDER_SCOPE` | Soprano OAuth scope |
 | `EPP_OUTBOUND_CLIENT_ID`, `EPP_OUTBOUND_MI_CLIENT_ID` | client application and user-assigned identity used for Soprano client-assertion exchange |
 
@@ -122,15 +122,16 @@ certificate is separate again. Fix the failing path rather than replacing unrela
 ## Complete provider authentication
 
 <a id="provider-credential-names"></a>
-Guided setup currently supports **Telesign and Soprano only**. The other bundled adapters are
-developer integrations, not additional guided provider offers:
+Guided setup currently supports **Soprano and Telesign only**. The other bundled adapters are
+developer integrations, not additional guided provider offers. The table is alphabetical,
+not a recommendation order:
 
 | Provider | Credential names / mode | Deployment support |
 |---|---|---|
-| `telesign` | `telesign-api-key` and `telesign-customer-id`; Basic authentication | Guided; complete the vault steps below. |
-| `soprano` | No API-key secrets; OAuth client assertion | Guided; complete the provider-admin handoff below. |
 | `infobip` | `infobip-api-key`; `Authorization: App ...` | Adapter only; no guided profile. Validate its account/options separately. |
 | `sinch` | `sinch-api-token`; static token | Adapter only; no guided profile. Validate its account/options separately. |
+| `soprano` | No API-key secrets; OAuth client assertion | Guided; complete the [provider-admin handoff](#soprano-provider-administrator-handoff). |
+| `telesign` | `telesign-api-key` and `telesign-customer-id`; Basic authentication | Guided; complete the [vault steps](#telesign-enter-and-verify-the-two-vault-secrets). |
 
 ### Where to enter API-key credentials in Key Vault
 
 
@@ -20,8 +20,10 @@ used JavaScript; validate an equivalent .NET readiness implementation and deploy
 1. Follow [customer onboarding](../docs/ONBOARDING.md). Set `EPP_PROVIDER_NAME` to the selected
 	adapter's `Name` (`<adapter-id>` is only a placeholder).
 2. Consult the selected adapter in [Src/Providers/](Src/Providers/) for required credentials and
-	options. Store credentials in Key Vault under the provider's secret names, grant
-	the Function's managed identity *Key Vault Secrets User*, and configure the matching endpoint/options.
+	options. For API-key authentication, store credentials in Key Vault under the provider's secret names
+	and grant the Function's managed identity *Key Vault Secrets User*. For OAuth, complete the
+	[provider-administrator handoff](../docs/ONBOARDING.md#soprano-provider-administrator-handoff)
+	instead of creating API-key secrets. Configure the matching endpoints/options for either mode.
 3. Base private local settings on [../docs/local.settings.sample.json](../docs/local.settings.sample.json),
 	replacing placeholders and selecting `FUNCTIONS_WORKER_RUNTIME=dotnet-isolated`. Put settings
 	at the app root beside [host.json](host.json). Configure decryption from the
 
@@ -21,9 +21,11 @@ sample's release package. No Front Door deployment script is supplied.
 1. Follow [customer onboarding](../docs/ONBOARDING.md). Choose a bundled provider and set
    `EPP_PROVIDER_NAME` to its fixed id; `<provider-id>` is a placeholder, not a default.
 2. Consult the selected implementation in [src/functions/providers/](src/functions/providers/)
-   for required credentials and options. Store credential values under the provider's Key Vault
-   secret names, grant the Function's managed identity *Key Vault Secrets User*, and configure the
-   matching endpoint and required options. This guide does not duplicate individual API contracts.
+   for required credentials and options. For API-key authentication, store credential values under
+   the provider's Key Vault secret names and grant the Function's managed identity *Key Vault Secrets User*.
+   For OAuth, complete the [provider-administrator handoff](../docs/ONBOARDING.md#soprano-provider-administrator-handoff)
+   instead of creating API-key secrets. Configure the matching endpoints and required options for either mode.
+   This guide does not duplicate individual API contracts.
 3. Use [../docs/local.settings.sample.json](../docs/local.settings.sample.json) as a starting point,
    replacing placeholders with the selected provider's settings. Keep local settings private at
    the app root beside [host.json](host.json), with `FUNCTIONS_WORKER_RUNTIME=node`.
 
@@ -20,8 +20,10 @@ used JavaScript; validate an equivalent Python readiness implementation and depl
 1. Follow [customer onboarding](../docs/ONBOARDING.md). Set `EPP_PROVIDER_NAME` to the selected
 	provider id (`<adapter-id>` is only a placeholder).
 2. Consult the selected provider in [src/providers/](src/providers/) for required credentials and
-	options. Store credentials in Key Vault under the provider-owned secret names, grant
-	the Function's managed identity *Key Vault Secrets User*, and configure the matching endpoint/options.
+	options. For API-key authentication, store credentials in Key Vault under the provider-owned secret names
+	and grant the Function's managed identity *Key Vault Secrets User*. For OAuth, complete the
+	[provider-administrator handoff](../docs/ONBOARDING.md#soprano-provider-administrator-handoff)
+	instead of creating API-key secrets. Configure the matching endpoints/options for either mode.
 3. Base private local settings on [../docs/local.settings.sample.json](../docs/local.settings.sample.json),
 	replacing placeholders and selecting `FUNCTIONS_WORKER_RUNTIME=python`. Put settings at the
 	app root beside [host.json](host.json). Configure decryption from the
 
@@ -304,7 +304,8 @@ propagation errors are retried during capability checks/deployment. Permission f
 unsupported regions remain explicit errors. Registration is subscription-wide and isn't undone
 automatically if a later deployment step fails.
 
-Supply known values to shorten the prompts:
+Supply known values to shorten the prompts. Replace `<provider-id>` with your selected guided
+provider's ID (`soprano` or `telesign`); neither is a default or recommendation:
 
 ```powershell
 .\Setup-Epp.ps1 `
@@ -314,7 +315,7 @@ Supply known values to shorten the prompts:
     -Location westus2 `
     -Language javascript `
     -ServicePlan FC1 `
-    -Provider telesign `
+    -Provider '<provider-id>' `
     -EndpointRegion global `
     -ResourcePrefix contoso
 ```
@@ -366,8 +367,9 @@ alone never approves changes. There is no `-Stage`, `-Resume`, `-ConfigPath`, or
 
 ### Noninteractive example
 
-This is a fully specified Telesign/Global JavaScript deployment example supporting both SMS and
-voice, not a credential script. Replace the three IDs and choose a permitted region/prefix/plan before running.
+This JavaScript deployment template supports both SMS and voice; it is not a credential script.
+Replace the three application/tenant/subscription IDs and `<provider-id>` (`soprano` or `telesign`),
+and choose the approved provider route, Azure region, prefix, and plan before running.
 The preliminary user sign-ins can require MFA and consent; `-NonInteractive` does not create a
 headless service-principal deployment path. Install the Graph modules/Bicep beforehand using
 interactive setup's prerequisite prompts or your approved installation process.
@@ -387,7 +389,7 @@ Connect-MgGraph -TenantId $tenantId -ContextScope Process `
     -SubscriptionId $subscriptionId `
     -ApplicationId $applicationId `
     -Location westus2 `
-    -Provider telesign `
+    -Provider '<provider-id>' `
     -EndpointRegion global `
     -Language javascript `
     -ServicePlan FC1 `
@@ -419,8 +421,8 @@ configuration metadata, not provider credentials or private-key bytes. Keep it a
 | `source`, `packageUrl`, `sourcePackageSha256`, `packageSha256`, `language`, `servicePlan` | Source/package provenance and runtime/plan. FC1 Python's built hash can be null; source and built hashes describe different artifacts. |
 | `policyChanged` | Expected `false`: deployment has not activated policy. |
 
-For example, a healthy record can contain `"provider": "telesign"`,
-`"endpointRegion": "global"`, `"certificateRenewal": "manual"`, and `"policyChanged": false`.
+The `provider` field must match your selected provider. For example, a record for the Global route
+can contain `"endpointRegion": "global"`, `"certificateRenewal": "manual"`, and `"policyChanged": false`.
 Those fields do not prove credentials, delivery, or monitoring work. Follow
 [provider authentication](../../docs/ONBOARDING.md#complete-provider-authentication) next,
 **even if the script's completion text does not prompt for your provider**.