diff --git a/docs/src/main/asciidoc/security-oidc-auth0-tutorial.adoc b/docs/src/main/asciidoc/security-oidc-auth0-tutorial.adoc index e20d1c1fc6e6f..c70b91f7d3320 100644 --- a/docs/src/main/asciidoc/security-oidc-auth0-tutorial.adoc +++ b/docs/src/main/asciidoc/security-oidc-auth0-tutorial.adoc @@ -94,7 +94,7 @@ public class GreetingResource { ---- <1> The injected `JsonWebToken` (JWT) token has an `@IdToken` qualifier. `IdToken` represents the user authentication part of the OIDC authorization code flow mechanism. -<2> `io.quarkus.security.Authenticated` annotation is added to the `hello()` method requiring that only authenticated users can access it. +<2> The `io.quarkus.security.Authenticated` annotation is added to the `hello()` method, which means that only authenticated users can access it. Note that the access token acquited during the authorization code flow, alongside the ID token, is not used directly by the endpoint but is only used to access downstream services on behalf of the currently authenticated user. We will talk about using the access tokens later in this tutorial.