diff --git a/apps/docs/content/guides/integrate/service-accounts/private-key-jwt.mdx b/apps/docs/content/guides/integrate/service-accounts/private-key-jwt.mdx
index c96245481..1e3b5d088 100644
--- a/apps/docs/content/guides/integrate/service-accounts/private-key-jwt.mdx
+++ b/apps/docs/content/guides/integrate/service-accounts/private-key-jwt.mdx
@@ -118,7 +118,7 @@ Payload:
 * `sub`: The application. Set this to the same value as `userId`.
 * `aud`: Your [Custom Domain](../../../concepts/features/custom-domain).
 * `iat`: The Unix timestamp when the JWT is created/signed (must be no older than 1 hour).
-* `exp`: The Unix timestamp when this assertion expires.
+* `exp`: The Unix timestamp when this assertion expires. The value of `exp` is strictly enforced. However, if `exp` is set to more than 1 hour in the future, `iat` will take precedence (the JWT will stop working once the `iat` timestamp is older than 1 hour).
 
 For further details, see the [JWT with private key](/apis/openidoauth/authn-methods#jwt-with-private-key) API reference.
 
@@ -165,7 +165,7 @@ With the encoded JWT from the previous step, craft a POST request to ZITADEL's t
 
 ```bash
 curl --request POST \
-  --url https:/$CUSTOM-DOMAIN/oauth/v2/token \
+  --url https://${CUSTOM_DOMAIN}/oauth/v2/token \
   --header 'Content-Type: application/x-www-form-urlencoded' \
   --data grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer \
   --data scope='openid' \
@@ -235,4 +235,4 @@ By following these steps and adhering to best practices, you can securely manage
 
 * [JWT with private key](/apis/openidoauth/authn-methods#jwt-with-private-key) API reference
 * [Accessing ZITADEL API](../zitadel-apis/access-zitadel-apis)
-* [Token introspection with private key JWT](../token-introspection/private-key-jwt)
+* [Token introspection with private key JWT](../token-introspection/private-key-jwt)
\ No newline at end of file