diff --git a/content/rancher/v2.x/en/user-settings/api-keys/_index.md b/content/rancher/v2.x/en/user-settings/api-keys/_index.md
index 6dbee301376..c83e9b70a44 100644
--- a/content/rancher/v2.x/en/user-settings/api-keys/_index.md
+++ b/content/rancher/v2.x/en/user-settings/api-keys/_index.md
@@ -25,9 +25,11 @@ API Keys are composed of four components:
 
 2. Click **Add Key**.
 
-3. **Optional:** Enter a description for the API key and select an expiration period. We recommend setting an expiration date.
+3. **Optional:** Enter a description for the API key and select an expiration period or a scope. We recommend setting an expiration date.
 
     The API key won't be valid after expiration. Shorter expiration periods are more secure.
+    
+    A scope will limit the API key so that it will only work against the Kubernetes API of the specified cluster. If the cluster is configured with an Authroized Cluster Endpoint, you will be able to use a scoped token directly against the cluster's API without proxying through the Rancher server. See [Authorized Cluster Endpoints]({{< baseurl >}}/v2.x/en/cluster-provisioning/rke-clusters/options/#authorized-cluster-endpoint) for more information.
 
 4. Click **Create**.