diff --git a/api/client-server/administrative_contact.yaml b/api/client-server/administrative_contact.yaml
index 9a59cb6b4..fc231b602 100644
--- a/api/client-server/administrative_contact.yaml
+++ b/api/client-server/administrative_contact.yaml
@@ -157,9 +157,10 @@ paths:
                     An optional field containing a URL where the client must
                     submit the validation token to, with identical parameters
                     to the Identity Service API's ``POST
-                    /validate/email/submitToken`` endpoint. The homeserver must
-                    send this token to the user (if applicable), who should
-                    then be prompted to provide it to the client.
+                    /validate/email/submitToken`` endpoint (without the requirement
+                    for an access token). The homeserver must send this token to the
+                    user (if applicable), who should then be prompted to provide it
+                    to the client.
 
                     If this field is not present, the client can assume that
                     verification will happen without the client's involvement
diff --git a/api/client-server/definitions/request_token_response.yaml b/api/client-server/definitions/request_token_response.yaml
index e47db8a0b..45201a204 100644
--- a/api/client-server/definitions/request_token_response.yaml
+++ b/api/client-server/definitions/request_token_response.yaml
@@ -25,9 +25,9 @@ properties:
     description: |-
       An optional field containing a URL where the client must submit the
       validation token to, with identical parameters to the Identity Service
-      API's ``POST /validate/email/submitToken`` endpoint. The homeserver must
-      send this token to the user (if applicable), who should then be
-      prompted to provide it to the client.
+      API's ``POST /validate/email/submitToken`` endpoint (without the requirement
+      for an access token). The homeserver must send this token to the user (if
+      applicable), who should then be prompted to provide it to the client.
 
       If this field is not present, the client can assume that verification
       will happen without the client's involvement provided the homeserver