diff --git a/src/auth/types.rs b/src/auth/types.rs
index f99358c1..59c2678c 100644
--- a/src/auth/types.rs
+++ b/src/auth/types.rs
@@ -65,6 +65,7 @@ pub fn read_only_scopes() -> Vec<&'static str> {
         "built_in_features",
         "data_scanner_read",
         "dbm_read",
+        "ddsql_editor_read",
         "error_tracking_read",
         "events_read",
         "feature_flag_config_read",
@@ -165,6 +166,8 @@ pub fn default_scopes() -> Vec<&'static str> {
         "data_scanner_read",
         // Data Streams
         "data_streams_monitoring_capture_messages",
+        // DDSQL Editor
+        "ddsql_editor_read",
         // Database Monitoring
         // built_in_features is required on US1/EU1 while the DBM team migrates to dbm_read.
         // Both are requested so the command works on all sites during the transition.
diff --git a/src/main.rs b/src/main.rs
index 8e7e01b6..b38ec327 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -1145,8 +1145,7 @@ enum Commands {
     ///   pup ddsql schema columns --table-id public.aws.ec2_instance
     ///
     /// AUTHENTICATION:
-    ///   Query commands support OAuth2 (via 'pup auth login') or API key + Application key.
-    ///   Discovery commands (`spec`, `schema ...`) currently require DD_API_KEY + DD_APP_KEY.
+    ///   All ddsql commands support OAuth2 (via 'pup auth login') or API key + Application key.
     #[command(verbatim_doc_comment)]
     Ddsql {
         #[command(subcommand)]
diff --git a/src/raw_client.rs b/src/raw_client.rs
index f09b19b0..75957f7e 100644
--- a/src/raw_client.rs
+++ b/src/raw_client.rs
@@ -151,19 +151,6 @@ static OAUTH_EXCLUDED_ENDPOINTS: &[EndpointRequirement] = &[
         path: "/api/unstable/fleet/",
         method: "GET",
     },
-    // DDSQL editor tools (3)
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/ddsql-docs",
-        method: "GET",
-    },
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/table-names",
-        method: "GET",
-    },
-    EndpointRequirement {
-        path: "/api/unstable/ddsql-editor/tools/table-data",
-        method: "POST",
-    },
     // Profiling (4)
     // No OAuth scope is declared for Continuous Profiler endpoints; force API-key auth.
     EndpointRequirement {
@@ -725,6 +712,26 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn test_no_fallback_for_ddsql_editor_tools() {
+        // DDSQL editor tools now accept OAuth server-side (DAL-960); removing
+        // them from OAUTH_EXCLUDED_ENDPOINTS means `pup ddsql spec`/`schema
+        // tables`/`schema columns` should send the OAuth bearer instead of
+        // forcing API-key fallback.
+        assert!(!requires_api_key_fallback(
+            "GET",
+            "/api/unstable/ddsql-editor/tools/ddsql-docs"
+        ));
+        assert!(!requires_api_key_fallback(
+            "GET",
+            "/api/unstable/ddsql-editor/tools/table-names"
+        ));
+        assert!(!requires_api_key_fallback(
+            "POST",
+            "/api/unstable/ddsql-editor/tools/table-data"
+        ));
+    }
+
     #[tokio::test]
     async fn test_raw_get_obs_pipelines_uses_oauth_bearer() {
         let _lock = lock_env().await;
@@ -862,22 +869,6 @@ mod tests {
         ));
     }
 
-    #[test]
-    fn test_requires_api_key_fallback_ddsql_editor_tools() {
-        assert!(requires_api_key_fallback(
-            "GET",
-            "/api/unstable/ddsql-editor/tools/ddsql-docs"
-        ));
-        assert!(requires_api_key_fallback(
-            "GET",
-            "/api/unstable/ddsql-editor/tools/table-names"
-        ));
-        assert!(requires_api_key_fallback(
-            "POST",
-            "/api/unstable/ddsql-editor/tools/table-data"
-        ));
-    }
-
     #[test]
     fn test_no_fallback_for_error_tracking() {
         assert!(!requires_api_key_fallback(