@@ -35,6 +35,13 @@ remote-management:
 # Authentication directory (supports ~ for home directory)
 auth-dir: "~/.cli-proxy-api"
 
+# Controls background refresh behavior for OAuth / auth-file credentials.
+# Set on-startup: false to avoid an immediate refresh pass on every process start.
+# Set batch-size to limit how many due credentials are refreshed in one scheduler pass.
+# oauth-refresh:
+#   on-startup: false
+#   batch-size: 2
+
 # API keys for authentication
 api-keys:
   - "your-api-key-1"
 
@@ -28,6 +28,9 @@ type SDKConfig struct {
 	// Default is false (disabled).
 	PassthroughHeaders bool `yaml:"passthrough-headers" json:"passthrough-headers"`
 
+	// OAuthRefresh controls background refresh behavior for OAuth / auth-file credentials.
+	OAuthRefresh OAuthRefreshConfig `yaml:"oauth-refresh" json:"oauth-refresh"`
+
 	// Streaming configures server-side streaming behavior (keep-alives and safe bootstrap retries).
 	Streaming StreamingConfig `yaml:"streaming" json:"streaming"`
 
@@ -36,6 +39,17 @@ type SDKConfig struct {
 	NonStreamKeepAliveInterval int `yaml:"nonstream-keepalive-interval,omitempty" json:"nonstream-keepalive-interval,omitempty"`
 }
 
+// OAuthRefreshConfig controls background refresh scheduling for OAuth/file-backed auths.
+type OAuthRefreshConfig struct {
+	// OnStartup controls whether the auto-refresh loop immediately checks credentials when the service starts.
+	// Nil preserves the legacy default (enabled).
+	OnStartup *bool `yaml:"on-startup,omitempty" json:"on-startup,omitempty"`
+
+	// BatchSize limits how many due credentials may be refreshed in one scheduler pass.
+	// <= 0 preserves the legacy behavior (no per-pass cap).
+	BatchSize int `yaml:"batch-size,omitempty" json:"batch-size,omitempty"`
+}
+
 // StreamingConfig holds server streaming behavior configuration.
 type StreamingConfig struct {
 	// KeepAliveSeconds controls how often the server emits SSE heartbeats (": keep-alive\n\n").
 
@@ -162,8 +162,9 @@ type Manager struct {
 	rtProvider RoundTripperProvider
 
 	// Auto refresh state
-	refreshCancel    context.CancelFunc
-	refreshSemaphore chan struct{}
+	refreshCancel      context.CancelFunc
+	refreshSemaphore   chan struct{}
+	refreshBatchCursor int
 }
 
 // NewManager constructs a manager with optional custom selector and hook.
@@ -355,6 +356,33 @@ func (m *Manager) SetConfig(cfg *internalconfig.Config) {
 	m.rebuildAPIKeyModelAliasFromRuntimeConfig()
 }
 
+func (m *Manager) oauthRefreshConfig() internalconfig.OAuthRefreshConfig {
+	if m == nil {
+		return internalconfig.OAuthRefreshConfig{}
+	}
+	cfg, _ := m.runtimeConfig.Load().(*internalconfig.Config)
+	if cfg == nil {
+		return internalconfig.OAuthRefreshConfig{}
+	}
+	return cfg.OAuthRefresh
+}
+
+func (m *Manager) refreshOnStartupEnabled() bool {
+	cfg := m.oauthRefreshConfig()
+	if cfg.OnStartup == nil {
+		return true
+	}
+	return *cfg.OnStartup
+}
+
+func (m *Manager) refreshBatchSize() int {
+	cfg := m.oauthRefreshConfig()
+	if cfg.BatchSize <= 0 {
+		return 0
+	}
+	return cfg.BatchSize
+}
+
 func (m *Manager) lookupAPIKeyUpstreamModel(authID, requestedModel string) string {
 	if m == nil {
 		return ""
@@ -2879,7 +2907,9 @@ func (m *Manager) StartAutoRefresh(parent context.Context, interval time.Duratio
 	go func() {
 		ticker := time.NewTicker(interval)
 		defer ticker.Stop()
-		m.checkRefreshes(ctx)
+		if m.refreshOnStartupEnabled() {
+			m.checkRefreshes(ctx)
+		}
 		for {
 			select {
 			case <-ctx.Done():
@@ -2903,22 +2933,57 @@ func (m *Manager) checkRefreshes(ctx context.Context) {
 	// log.Debugf("checking refreshes")
 	now := time.Now()
 	snapshot := m.snapshotAuths()
+	dueIDs := make([]string, 0, len(snapshot))
 	for _, a := range snapshot {
 		typ, _ := a.AccountInfo()
 		if typ != "api_key" {
 			if !m.shouldRefresh(a, now) {
 				continue
 			}
-			log.Debugf("checking refresh for %s, %s, %s", a.Provider, a.ID, typ)
-
-			if exec := m.executorFor(a.Provider); exec == nil {
-				continue
-			}
-			if !m.markRefreshPending(a.ID, now) {
-				continue
-			}
-			go m.refreshAuthWithLimit(ctx, a.ID)
+			dueIDs = append(dueIDs, a.ID)
+		}
+	}
+	if len(dueIDs) == 0 {
+		m.mu.Lock()
+		m.refreshBatchCursor = 0
+		m.mu.Unlock()
+		return
+	}
+	sort.Strings(dueIDs)
+	limit := m.refreshBatchSize()
+	selectedIDs := dueIDs
+	if limit > 0 && len(dueIDs) > limit {
+		m.mu.Lock()
+		start := 0
+		if len(dueIDs) > 0 {
+			start = m.refreshBatchCursor % len(dueIDs)
+		}
+		selectedIDs = make([]string, 0, limit)
+		for i := 0; i < limit; i++ {
+			idx := (start + i) % len(dueIDs)
+			selectedIDs = append(selectedIDs, dueIDs[idx])
+		}
+		m.refreshBatchCursor = (start + limit) % len(dueIDs)
+		m.mu.Unlock()
+	} else {
+		m.mu.Lock()
+		m.refreshBatchCursor = 0
+		m.mu.Unlock()
+	}
+	for _, id := range selectedIDs {
+		auth, ok := m.GetByID(id)
+		if !ok || auth == nil {
+			continue
+		}
+		typ, _ := auth.AccountInfo()
+		log.Debugf("checking refresh for %s, %s, %s", auth.Provider, auth.ID, typ)
+		if exec := m.executorFor(auth.Provider); exec == nil {
+			continue
+		}
+		if !m.markRefreshPending(auth.ID, now) {
+			continue
 		}
+		go m.refreshAuthWithLimit(ctx, auth.ID)
 	}
 }
 
 
@@ -0,0 +1,168 @@
+package auth
+
+import (
+	"context"
+	"net/http"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	internalconfig "github.com/router-for-me/CLIProxyAPI/v6/internal/config"
+	cliproxyexecutor "github.com/router-for-me/CLIProxyAPI/v6/sdk/cliproxy/executor"
+)
+
+type autoRefreshTestExecutor struct {
+	provider string
+	mu       sync.Mutex
+	ids      []string
+}
+
+func (e *autoRefreshTestExecutor) Identifier() string { return e.provider }
+
+func (e *autoRefreshTestExecutor) Execute(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error) {
+	return cliproxyexecutor.Response{}, nil
+}
+
+func (e *autoRefreshTestExecutor) ExecuteStream(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (*cliproxyexecutor.StreamResult, error) {
+	return nil, nil
+}
+
+func (e *autoRefreshTestExecutor) Refresh(ctx context.Context, auth *Auth) (*Auth, error) {
+	e.mu.Lock()
+	e.ids = append(e.ids, auth.ID)
+	e.mu.Unlock()
+	return auth, nil
+}
+
+func (e *autoRefreshTestExecutor) CountTokens(ctx context.Context, auth *Auth, req cliproxyexecutor.Request, opts cliproxyexecutor.Options) (cliproxyexecutor.Response, error) {
+	return cliproxyexecutor.Response{}, nil
+}
+
+func (e *autoRefreshTestExecutor) HttpRequest(ctx context.Context, auth *Auth, req *http.Request) (*http.Response, error) {
+	return nil, nil
+}
+
+func (e *autoRefreshTestExecutor) refreshedIDs() []string {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	out := make([]string, len(e.ids))
+	copy(out, e.ids)
+	return out
+}
+
+func TestManager_StartAutoRefresh_ImmediateByDefault(t *testing.T) {
+	manager := NewManager(nil, &RoundRobinSelector{}, nil)
+	executor := &autoRefreshTestExecutor{provider: "test"}
+	manager.RegisterExecutor(executor)
+	manager.SetConfig(&internalconfig.Config{})
+
+	auth := &Auth{
+		ID:       "startup-default",
+		Provider: "test",
+		Metadata: map[string]any{"refresh_interval_seconds": 3600},
+	}
+	if _, err := manager.Register(context.Background(), auth); err != nil {
+		t.Fatalf("register auth: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	manager.StartAutoRefresh(ctx, time.Hour)
+	t.Cleanup(manager.StopAutoRefresh)
+
+	waitForRefreshCalls(t, executor, 1, time.Second)
+}
+
+func TestManager_StartAutoRefresh_CanSkipStartupCheck(t *testing.T) {
+	manager := NewManager(nil, &RoundRobinSelector{}, nil)
+	executor := &autoRefreshTestExecutor{provider: "test"}
+	manager.RegisterExecutor(executor)
+
+	disabled := false
+	manager.SetConfig(&internalconfig.Config{
+		SDKConfig: internalconfig.SDKConfig{
+			OAuthRefresh: internalconfig.OAuthRefreshConfig{
+				OnStartup: &disabled,
+			},
+		},
+	})
+
+	auth := &Auth{
+		ID:       "startup-disabled",
+		Provider: "test",
+		Metadata: map[string]any{"refresh_interval_seconds": 3600},
+	}
+	if _, err := manager.Register(context.Background(), auth); err != nil {
+		t.Fatalf("register auth: %v", err)
+	}
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	manager.StartAutoRefresh(ctx, time.Hour)
+	t.Cleanup(manager.StopAutoRefresh)
+
+	time.Sleep(100 * time.Millisecond)
+	if got := len(executor.refreshedIDs()); got != 0 {
+		t.Fatalf("startup refresh calls = %d, want 0", got)
+	}
+}
+
+func TestManager_CheckRefreshes_HonorsBatchSize(t *testing.T) {
+	manager := NewManager(nil, &RoundRobinSelector{}, nil)
+	executor := &autoRefreshTestExecutor{provider: "test"}
+	manager.RegisterExecutor(executor)
+	manager.SetConfig(&internalconfig.Config{
+		SDKConfig: internalconfig.SDKConfig{
+			OAuthRefresh: internalconfig.OAuthRefreshConfig{
+				BatchSize: 2,
+			},
+		},
+	})
+
+	ctx := context.Background()
+	for i := 0; i < 5; i++ {
+		auth := &Auth{
+			ID:       "batch-auth-" + strconv.Itoa(i),
+			Provider: "test",
+			Metadata: map[string]any{"refresh_interval_seconds": 3600},
+		}
+		if _, err := manager.Register(ctx, auth); err != nil {
+			t.Fatalf("register auth %d: %v", i, err)
+		}
+	}
+
+	manager.checkRefreshes(ctx)
+	waitForRefreshCalls(t, executor, 2, time.Second)
+
+	manager.checkRefreshes(ctx)
+	waitForRefreshCalls(t, executor, 4, time.Second)
+
+	manager.checkRefreshes(ctx)
+	waitForRefreshCalls(t, executor, 5, time.Second)
+
+	seen := make(map[string]int)
+	for _, id := range executor.refreshedIDs() {
+		seen[id]++
+	}
+	if len(seen) != 5 {
+		t.Fatalf("refreshed unique auths = %d, want 5; got=%v", len(seen), seen)
+	}
+	for id, count := range seen {
+		if count != 1 {
+			t.Fatalf("auth %s refreshed %d times, want 1", id, count)
+		}
+	}
+}
+
+func waitForRefreshCalls(t *testing.T, executor *autoRefreshTestExecutor, want int, timeout time.Duration) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	for time.Now().Before(deadline) {
+		if got := len(executor.refreshedIDs()); got >= want {
+			return
+		}
+		time.Sleep(10 * time.Millisecond)
+	}
+	t.Fatalf("timed out waiting for %d refresh calls; got %d", want, len(executor.refreshedIDs()))
+}