diff --git a/tasks/integration/phase2/api-keys-dynamic-config.md b/tasks/integration/phase2/api-keys-dynamic-config.md
index 3ea0a5d..dc61017 100644
--- a/tasks/integration/phase2/api-keys-dynamic-config.md
+++ b/tasks/integration/phase2/api-keys-dynamic-config.md
@@ -1,7 +1,7 @@
 ---
 id: api-keys-dynamic-config
 name: Add API keys to DynamicConfig.auth and extend IdentityProvider token resolution
-status: pending
+status: completed
 depends_on: [credential-provider-trait]
 scope: narrow
 risk: low
@@ -70,4 +70,4 @@ description = "dashboard service account"
 
 ## Summary
 
-> To be filled on completion
\ No newline at end of file
+> Added ApiKeyEntry struct (prefix/hash/scopes/description/expires_at) to AuthPolicy. Extended ConfigIdentityProvider::resolve_from_token() to route alk_-prefixed tokens through SHA-256 hash verification with expiry checks. 14 new API key tests pass.
\ No newline at end of file