diff --git a/src/cli/operations/agent/generate/__tests__/schema-mapper.test.ts b/src/cli/operations/agent/generate/__tests__/schema-mapper.test.ts
index 593c9520..73d162e4 100644
--- a/src/cli/operations/agent/generate/__tests__/schema-mapper.test.ts
+++ b/src/cli/operations/agent/generate/__tests__/schema-mapper.test.ts
@@ -1,3 +1,4 @@
+import { computeManagedOAuthCredentialName } from '../../../../primitives/credential-utils.js';
 import type { GenerateConfig } from '../../../../tui/screens/generate/types.js';
 import {
   mapGenerateConfigToAgent,
@@ -190,3 +191,13 @@ describe('mapGenerateConfigToRenderConfig', () => {
     expect(result.memoryProviders[0]!.strategies).toEqual(['SEMANTIC', 'USER_PREFERENCE', 'SUMMARIZATION']);
   });
 });
+
+describe('gateway credential provider name mapping', () => {
+  it('computeManagedOAuthCredentialName produces the correct suffix', () => {
+    // Regression test: the managed credential name must use '-oauth' suffix.
+    // GatewayPrimitive creates it, schema-mapper looks it up, AddGatewayScreen displays it.
+    // All three now use computeManagedOAuthCredentialName to stay in sync.
+    expect(computeManagedOAuthCredentialName('my-gateway')).toBe('my-gateway-oauth');
+    expect(computeManagedOAuthCredentialName('test')).toBe('test-oauth');
+  });
+});
diff --git a/src/cli/operations/agent/generate/schema-mapper.ts b/src/cli/operations/agent/generate/schema-mapper.ts
index 9cda6000..0b90c71c 100644
--- a/src/cli/operations/agent/generate/schema-mapper.ts
+++ b/src/cli/operations/agent/generate/schema-mapper.ts
@@ -11,7 +11,10 @@ import type {
 } from '../../../../schema';
 import { DEFAULT_STRATEGY_NAMESPACES } from '../../../../schema';
 import { GatewayPrimitive } from '../../../primitives/GatewayPrimitive';
-import { computeDefaultCredentialEnvVarName } from '../../../primitives/credential-utils';
+import {
+  computeDefaultCredentialEnvVarName,
+  computeManagedOAuthCredentialName,
+} from '../../../primitives/credential-utils';
 import type {
   AgentRenderConfig,
   GatewayProviderRenderConfig,
@@ -199,7 +202,7 @@ async function mapGatewaysToGatewayProviders(): Promise<GatewayProviderRenderCon
 
       if (gateway.authorizerType === 'CUSTOM_JWT' && gateway.authorizerConfiguration?.customJwtAuthorizer) {
         const jwtConfig = gateway.authorizerConfiguration.customJwtAuthorizer;
-        const credName = `${gateway.name}-agent-oauth`;
+        const credName = computeManagedOAuthCredentialName(gateway.name);
         const credential = project.credentials.find(c => c.name === credName);
 
         if (credential) {
diff --git a/src/cli/primitives/GatewayPrimitive.ts b/src/cli/primitives/GatewayPrimitive.ts
index 1ef75ab0..313fa6c0 100644
--- a/src/cli/primitives/GatewayPrimitive.ts
+++ b/src/cli/primitives/GatewayPrimitive.ts
@@ -8,7 +8,7 @@ import type { RemovalPreview, RemovalResult, SchemaChange } from '../operations/
 import type { AddGatewayConfig } from '../tui/screens/mcp/types';
 import { BasePrimitive } from './BasePrimitive';
 import { SOURCE_CODE_NOTE } from './constants';
-import { computeDefaultCredentialEnvVarName } from './credential-utils';
+import { computeDefaultCredentialEnvVarName, computeManagedOAuthCredentialName } from './credential-utils';
 import type { AddResult, AddScreenComponent, RemovableResource } from './types';
 import type { Command } from '@commander-js/extra-typings';
 
@@ -379,7 +379,7 @@ export class GatewayPrimitive extends BasePrimitive<AddGatewayOptions, Removable
     gatewayName: string,
     jwtConfig: NonNullable<AddGatewayConfig['jwtConfig']>
   ): Promise<void> {
-    const credentialName = `${gatewayName}-oauth`;
+    const credentialName = computeManagedOAuthCredentialName(gatewayName);
     const project = await this.readProjectSpec();
 
     // Skip if credential already exists
diff --git a/src/cli/primitives/credential-utils.ts b/src/cli/primitives/credential-utils.ts
index 5b639a50..8c1df16e 100644
--- a/src/cli/primitives/credential-utils.ts
+++ b/src/cli/primitives/credential-utils.ts
@@ -6,3 +6,12 @@
 export function computeDefaultCredentialEnvVarName(credentialName: string): string {
   return `AGENTCORE_CREDENTIAL_${credentialName.replace(/-/g, '_').toUpperCase()}`;
 }
+
+/**
+ * Compute the managed OAuth credential name for a gateway.
+ * Used when creating the credential (GatewayPrimitive) and when
+ * looking it up for code generation (schema-mapper).
+ */
+export function computeManagedOAuthCredentialName(gatewayName: string): string {
+  return `${gatewayName}-oauth`;
+}
diff --git a/src/cli/tui/screens/mcp/AddGatewayScreen.tsx b/src/cli/tui/screens/mcp/AddGatewayScreen.tsx
index 4560214e..b6ccf7e4 100644
--- a/src/cli/tui/screens/mcp/AddGatewayScreen.tsx
+++ b/src/cli/tui/screens/mcp/AddGatewayScreen.tsx
@@ -1,5 +1,6 @@
 import type { GatewayAuthorizerType } from '../../../../schema';
 import { GatewayNameSchema } from '../../../../schema';
+import { computeManagedOAuthCredentialName } from '../../../primitives/credential-utils';
 import {
   ConfirmReview,
   Panel,
@@ -272,7 +273,7 @@ export function AddGatewayScreen({ onComplete, onExit, existingGateways, unassig
                       ? [{ label: 'Allowed Scopes', value: wizard.config.jwtConfig.allowedScopes.join(', ') }]
                       : []),
                     ...(wizard.config.jwtConfig.agentClientId
-                      ? [{ label: 'Agent Credential', value: `${wizard.config.name}-agent-oauth` }]
+                      ? [{ label: 'Agent Credential', value: computeManagedOAuthCredentialName(wizard.config.name) }]
                       : []),
                   ]
                 : []),