diff --git a/Phase-6.md b/Phase-6.md
index 4e5eab0..67f2b7b 100644
--- a/Phase-6.md
+++ b/Phase-6.md
@@ -1,6 +1,6 @@
 # Phase 6: Security, Permissions & Polish
 
-Phase 6 adds roles & permissions, push notifications, and WebAuthn passkey scaffolding.
+Phase 6 adds roles & permissions, push notifications, WebAuthn passkeys, and REST API documentation.
 
 ## Features Implemented
 
@@ -25,31 +25,28 @@ Phase 6 adds roles & permissions, push notifications, and WebAuthn passkey scaff
 | Push subscription CRUD | ✅ | Subscribe/unsubscribe endpoints |
 | Push sender | ✅ | SendPush function for mentioned users |
 | Push subscription table | ✅ | DB storage for push subscriptions |
-| Frontend push store | ✅ | Already built in Phase 3 |
+| Frontend push store | ✅ | Subscribe/unsubscribe with VAPID key fetch |
+| Settings UI toggle | ✅ | [ENABLE PUSH] / [DISABLE PUSH] in UserSettings |
+| Service worker | ✅ | Handles push events and notification clicks |
 
 ### WebAuthn Passkeys
 
 | Feature | Status | Description |
 |---------|--------|-------------|
-| WebAuthn scaffolding | ✅ | Registration and login endpoints (begin/finish) |
+| Backend scaffolding | ✅ | Registration and login endpoints (begin/finish) |
 | Credential storage | ✅ | webauthn_credentials table |
-| Frontend | ⏳ | Needs browser WebAuthn API integration |
+| Frontend register | ✅ | [REGISTER PASSKEY] button in UserSettings |
+| Frontend login | ✅ | [SIGN IN WITH PASSKEY] button on LoginForm |
+| Backend completion | ⏳ | Begin/finish flow needs full implementation |
 
-## Permission Constants
+### REST API Documentation
 
-| Permission | Bit | Value |
-|-----------|-----|-------|
-| VIEW_CHANNEL | 0 | 1 |
-| SEND_MESSAGES | 1 | 2 |
-| MANAGE_MESSAGES | 2 | 4 |
-| KICK_MEMBERS | 3 | 8 |
-| BAN_MEMBERS | 4 | 16 |
-| MANAGE_SERVER | 5 | 32 |
-| MANAGE_CHANNELS | 6 | 64 |
-| ADMINISTRATOR | 7 | 128 |
-| CONNECT_VOICE | 8 | 256 |
-| SPEAK_VOICE | 9 | 512 |
-| SHARE_SCREEN | 10 | 1024 |
+| Feature | Status | Description |
+|---------|--------|-------------|
+| Swagger annotations | ✅ | @title, @version, @host, @BasePath on main.go |
+| Swagger UI | ✅ | Served at `/docs` endpoint |
+| Generated spec | ✅ | `docs/swagger.json`, `docs/swagger.yaml` |
+| Makefile target | ✅ | `make docs` to regenerate |
 
 ## API Endpoints
 
@@ -65,7 +62,6 @@ GET /api/v1/servers/{serverID}/roles
 
 # Update role
 PATCH /api/v1/servers/{serverID}/roles/{roleID}
-{ "name": "New Name", "permissions": 127 }
 
 # Delete role
 DELETE /api/v1/servers/{serverID}/roles/{roleID}
@@ -90,8 +86,47 @@ POST /api/v1/push/unsubscribe
 { "endpoint": "..." }
 ```
 
+### WebAuthn
+
+```bash
+# Begin passkey registration
+POST /api/v1/auth/webauthn/register/begin
+
+# Finish passkey registration
+POST /api/v1/auth/webauthn/register/finish
+
+# Begin passkey login
+POST /api/v1/auth/webauthn/login/begin
+
+# Finish passkey login
+POST /api/v1/auth/webauthn/login/finish
+```
+
+### Swagger UI
+
+Access the interactive API documentation at:
+```
+http://localhost:8080/docs
+```
+
+## Permission Constants
+
+| Permission | Bit | Value |
+|-----------|-----|-------|
+| VIEW_CHANNEL | 0 | 1 |
+| SEND_MESSAGES | 1 | 2 |
+| MANAGE_MESSAGES | 2 | 4 |
+| KICK_MEMBERS | 3 | 8 |
+| BAN_MEMBERS | 4 | 16 |
+| MANAGE_SERVER | 5 | 32 |
+| MANAGE_CHANNELS | 6 | 64 |
+| ADMINISTRATOR | 7 | 128 |
+| CONNECT_VOICE | 8 | 256 |
+| SPEAK_VOICE | 9 | 512 |
+| SHARE_SCREEN | 10 | 1024 |
+
 ## What's Next
 
-- REST API documentation (OpenAPI/Swagger)
-- WebAuthn frontend integration
-- Push notification frontend integration (needs VAPID keys)
+- Complete WebAuthn backend (full begin/finish flow)
+- Add swaggo annotations to individual handlers for detailed API docs
+- Push notification mention parsing and dispatch
diff --git a/Roadmap.md b/Roadmap.md
index 54e8bea..3c3903a 100644
--- a/Roadmap.md
+++ b/Roadmap.md
@@ -30,8 +30,8 @@
 ## Phase 3: Polish & PWA — ✅ DONE
 
 - [x] PWA manifest + service worker
-- [ ] Web Push notifications (VAPID) — frontend ready, backend keys needed
-- [ ] WebAuthn / passkeys — deferred
+- [x] Push notifications (frontend + backend)
+- [ ] WebAuthn / passkeys — frontend done, backend completion pending
 - [x] Mobile-responsive layout (bottom nav, swipe gestures)
 - [x] Message reactions (emoji picker, counts)
 - [x] Message replies/threads
@@ -51,7 +51,7 @@
 - [x] Incoming webhook endpoint
 - [x] Example bot: moderation (auto-delete, kick, ban commands)
 - [x] Example bot: welcome messages on member join
-- [ ] REST API documentation (OpenAPI/Swagger) — future
+- [x] REST API documentation (Swagger UI at /docs)
 
 ## Phase 5: TUI Client — ✅ DONE
 
@@ -76,7 +76,9 @@
 - [x] Default @everyone role
 - [x] Frontend role manager UI
 - [x] Push notification backend (VAPID)
+- [x] Push notification frontend (subscribe toggle)
 - [x] WebAuthn passkey scaffolding
-- [ ] REST API documentation (OpenAPI/Swagger) — future
-- [ ] WebAuthn frontend integration — future
-- [ ] Push notification frontend integration — needs VAPID keys
+- [x] WebAuthn frontend (register/login buttons)
+- [x] REST API documentation (Swagger UI at /docs)
+- [ ] WebAuthn backend completion (begin/finish flow)
+- [ ] Push notification mention parsing and dispatch