diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md
index 6f09e904e..7133939a1 100644
--- a/packages/coding-agent/CHANGELOG.md
+++ b/packages/coding-agent/CHANGELOG.md
@@ -15,6 +15,7 @@
 
 ### Fixed
 
+- Fixed compaction, branch summaries, and bug-report summaries in SDK sessions passing the stored OAuth token back to the model runtime as an explicit API key. Provider auth that treats explicit keys differently from stored OAuth now sees the OAuth login, as normal prompts do ([#11520](https://github.com/earendil-works/pi/issues/11520))
 - Fixed a redundant system prompt update (tools, rules) when an extension set the same active tools in a different order, for example a reversed `pi.setActiveTools()` list. Tools that stay active now keep their order and newly activated tools are appended ([#11495](https://github.com/earendil-works/pi/issues/11495))
 - Fixed `pi.exec()` crashing pi with `RangeError: Invalid string length` when a command printed more output than fits in a string. The default output cap is the smaller of 256 MiB and the runtime string limit; past the cap, the command is terminated and the result has `truncated: true` and a nonzero exit code ([#11360](https://github.com/earendil-works/pi/issues/11360))
 - Fixed `pi.exec()` never returning when a command ignored SIGTERM after a timeout or abort. pi now sends SIGKILL 5 seconds later, as intended
diff --git a/packages/coding-agent/src/core/agent-session.ts b/packages/coding-agent/src/core/agent-session.ts
index c1529f019..dbe36c365 100644
--- a/packages/coding-agent/src/core/agent-session.ts
+++ b/packages/coding-agent/src/core/agent-session.ts
@@ -29,6 +29,7 @@ import {
 	type BeforeToolCallResult,
 	type PrepareNextTurnContext,
 	runToolCall,
+	type StreamFn,
 	type ThinkingLevel,
 } from "@earendil-works/pi-agent-core";
 import { contentText, getCurrentSystemMessage, getCurrentTools, retryDelayMs } from "@earendil-works/pi-ai";
@@ -158,6 +159,18 @@ import {
 	type VirtualModelStateData,
 } from "./virtual-models.ts";
 
+/**
+ * Stream functions that resolve auth through a given ModelRuntime themselves, such as the one
+ * createAgentSession installs. Summaries sent through them must not pass pre-resolved credentials:
+ * the runtime would take them as an explicit API key instead of the stored OAuth login (#11520).
+ */
+const runtimeStreamFunctions = new WeakMap<StreamFn, ModelRuntime>();
+
+/** Mark `streamFn` as resolving auth through `modelRuntime` on its own. */
+export function markRuntimeStreamFunction(streamFn: StreamFn, modelRuntime: ModelRuntime): void {
+	runtimeStreamFunctions.set(streamFn, modelRuntime);
+}
+
 // ============================================================================
 // Skill Block Parsing
 // ============================================================================
@@ -590,6 +603,9 @@ export class AgentSession {
 		if (this.agent.streamFunction === streamSimple) {
 			return { ...(await this._getRequiredRequestAuth(model, signal)), thinkingLevel };
 		}
+		if (runtimeStreamFunctions.get(this.agent.streamFunction) === this._modelRuntime) {
+			return { model, thinkingLevel };
+		}
 
 		try {
 			const result = await this._modelRuntime.getAuth(model, { signal });
diff --git a/packages/coding-agent/src/core/sdk.ts b/packages/coding-agent/src/core/sdk.ts
index 0bf874fff..dbab1d1d9 100644
--- a/packages/coding-agent/src/core/sdk.ts
+++ b/packages/coding-agent/src/core/sdk.ts
@@ -4,7 +4,7 @@ import type { ModelsSimpleStreamOptions } from "@earendil-works/pi-ai";
 import { clampThinkingLevel, type Message, type Model, streamSimple } from "@earendil-works/pi-ai/compat";
 import { getAgentDir } from "../config.ts";
 import { resolvePath } from "../utils/paths.ts";
-import { AgentSession } from "./agent-session.ts";
+import { AgentSession, markRuntimeStreamFunction } from "./agent-session.ts";
 import { formatNoModelsAvailableMessage } from "./auth-guidance.ts";
 import { CacheWarmer } from "./cache-warmer.ts";
 import { getClientIdentity } from "./client-identity.ts";
@@ -436,6 +436,8 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 		thinkingBudgets: settingsManager.getThinkingBudgets(),
 		maxRetryDelayMs: settingsManager.getProviderRetrySettings().maxRetryDelayMs,
 	});
+	// This stream resolves auth through modelRuntime, so summaries must not pre-resolve it (#11520).
+	markRuntimeStreamFunction(agent.streamFunction, modelRuntime);
 
 	// Restore missing settings metadata for older sessions.
 	if (hasExistingSession) {
diff --git a/packages/coding-agent/test/suite/regressions/11520-sdk-summary-oauth-auth.test.ts b/packages/coding-agent/test/suite/regressions/11520-sdk-summary-oauth-auth.test.ts
new file mode 100644
index 000000000..02639a701
--- /dev/null
+++ b/packages/coding-agent/test/suite/regressions/11520-sdk-summary-oauth-auth.test.ts
@@ -0,0 +1,122 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+	type Api,
+	createAssistantMessageEventStream,
+	type Model,
+	type SimpleStreamOptions,
+} from "@earendil-works/pi-ai";
+import { afterEach, describe, expect, it } from "vitest";
+import { AuthStorage } from "../../../src/core/auth-storage.ts";
+import { ModelRuntime } from "../../../src/core/model-runtime.ts";
+import { createAgentSession } from "../../../src/core/sdk.ts";
+import { SessionManager } from "../../../src/core/session-manager.ts";
+import { SettingsManager } from "../../../src/core/settings-manager.ts";
+import { assistantMsg, createTestResourceLoader, userMsg } from "../../utilities.ts";
+
+// Issue #11520: summaries in SDK sessions passed the resolved OAuth token back to the
+// ModelRuntime as an explicit API key, so provider auth took the API-key override branch.
+describe("issue #11520 SDK summary OAuth auth", () => {
+	const tempDirs: string[] = [];
+
+	afterEach(() => {
+		while (tempDirs.length > 0) rmSync(tempDirs.pop()!, { recursive: true, force: true });
+	});
+
+	it("lets the runtime resolve stored OAuth for branch summaries", async () => {
+		const cwd = mkdtempSync(join(tmpdir(), "pi-11520-"));
+		tempDirs.push(cwd);
+		const credentials = AuthStorage.inMemory({
+			"oauth-only-provider": {
+				type: "oauth",
+				access: "oauth-access",
+				refresh: "refresh",
+				expires: Date.now() + 3_600_000,
+			},
+		});
+		const modelRuntime = await ModelRuntime.create({ credentials, modelsPath: null, allowModelNetwork: false });
+		const model: Model<Api> = {
+			id: "oauth-model",
+			name: "OAuth Model",
+			api: "openai-completions",
+			provider: "oauth-only-provider",
+			baseUrl: "https://example.test/v1",
+			reasoning: false,
+			input: ["text"],
+			cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+			contextWindow: 128000,
+			maxTokens: 4096,
+		};
+		const requests: SimpleStreamOptions[] = [];
+		modelRuntime.registerProvider(model.provider, {
+			name: "OAuth Only",
+			baseUrl: model.baseUrl,
+			api: model.api,
+			// With an API key method as well, an explicit key would bypass the stored OAuth login.
+			apiKey: "UNUSED_ENV_KEY",
+			oauth: {
+				name: "Subscription",
+				login: async () => ({ access: "oauth-access", refresh: "refresh", expires: Date.now() + 60_000 }),
+				refreshToken: async (credential) => credential,
+				getApiKey: (credential) => credential.access,
+			},
+			models: [model],
+			streamSimple: (requestModel, _context, options) => {
+				requests.push(options ?? {});
+				const stream = createAssistantMessageEventStream();
+				stream.end({
+					role: "assistant",
+					content: [{ type: "text", text: "branch summary text" }],
+					api: requestModel.api,
+					provider: requestModel.provider,
+					model: requestModel.id,
+					usage: {
+						input: 1,
+						output: 1,
+						cacheRead: 0,
+						cacheWrite: 0,
+						totalTokens: 2,
+						cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 },
+					},
+					stopReason: "stop",
+					timestamp: Date.now(),
+				});
+				return stream;
+			},
+		});
+		const authOverrides: Array<string | undefined> = [];
+		const getAuth = modelRuntime.getAuth.bind(modelRuntime);
+		modelRuntime.getAuth = (async (...args: Parameters<ModelRuntime["getAuth"]>) => {
+			authOverrides.push(args[1]?.apiKey);
+			return getAuth(...args);
+		}) as ModelRuntime["getAuth"];
+
+		const sessionManager = SessionManager.inMemory(cwd);
+		const { session } = await createAgentSession({
+			cwd,
+			agentDir: cwd,
+			model,
+			modelRuntime,
+			settingsManager: SettingsManager.inMemory(),
+			sessionManager,
+			resourceLoader: createTestResourceLoader(),
+		});
+		try {
+			const targetId = sessionManager.appendMessage(userMsg("first branch"));
+			sessionManager.appendMessage(assistantMsg("first reply"));
+			sessionManager.appendMessage(userMsg("abandoned branch work"));
+			sessionManager.appendMessage(assistantMsg("abandoned reply"));
+
+			const result = await session.navigateTree(targetId, { summarize: true });
+
+			expect(result.summaryEntry?.summary).toContain("branch summary text");
+			expect(requests).toHaveLength(1);
+			expect(requests[0].apiKey).toBe("oauth-access");
+			expect(authOverrides.length).toBeGreaterThan(0);
+			expect(authOverrides.every((apiKey) => apiKey === undefined)).toBe(true);
+		} finally {
+			session.dispose();
+		}
+	});
+});