diff --git a/daprdocs/content/en/operations/security/api-token.md b/daprdocs/content/en/operations/security/api-token.md
index aa30b3975..2722f67a5 100644
--- a/daprdocs/content/en/operations/security/api-token.md
+++ b/daprdocs/content/en/operations/security/api-token.md
@@ -88,7 +88,11 @@ kubectl rollout restart deployment/<deployment-name> --namespace <namespace-name
 
 ## Adding API token to client API invocations
 
-Once token authentication is configured in Dapr, all clients invoking Dapr API will have to append the API token token to every request:
+Once token authentication is configured in Dapr, all clients invoking Dapr API need to append the `dapr-api-token` token to every request. 
+
+> **Note:** The Dapr SDKs read the [DAPR_API_TOKEN]({{< ref environment >}}) environment variable and set it for you by default.
+
+<img src="/images/tokens-auth.png" width=800 style="padding-bottom:15px;">
 
 ### HTTP
 
diff --git a/daprdocs/content/en/operations/security/app-api-token.md b/daprdocs/content/en/operations/security/app-api-token.md
index 401e561e6..9a9264ed2 100644
--- a/daprdocs/content/en/operations/security/app-api-token.md
+++ b/daprdocs/content/en/operations/security/app-api-token.md
@@ -89,14 +89,16 @@ kubectl rollout restart deployment/<deployment-name> --namespace <namespace-name
 
 ## Authenticating requests from Dapr
 
-Once app token authentication is configured using the environment variable or Kubernetes secret `app-api-token`, the Dapr sidecar always includes the HTTP header/gRPC metadata `dapr-api-token: <token>` in the calls to the app. From the app side, ensure you are authenticating using the `dapr-api-token` value, even though you set `app-api-token` to enable API authentication.
+Once app token authentication is configured using the environment variable or Kubernetes secret `app-api-token`, the Dapr sidecar always includes the HTTP header/gRPC metadata `dapr-api-token: <token>` in the calls to the app. From the app side, ensure you are authenticating using the `dapr-api-token` value which uses the `app-api-token` you set to authenticate requests from Dapr.
+
+<img src="/images/tokens-auth.png" width=800 style="padding-bottom:15px;">
 
 ### HTTP
 
 In your code, look for the HTTP header `dapr-api-token` in incoming requests:
 
 ```text
-a-api-token: <token>
+dapr-api-token: <token>
 ```
 
 ### gRPC
diff --git a/daprdocs/static/images/tokens-auth.png b/daprdocs/static/images/tokens-auth.png
new file mode 100644
index 000000000..0eb566d7c
Binary files /dev/null and b/daprdocs/static/images/tokens-auth.png differ