diff --git a/docs/admin/service-accounts-admin.md b/docs/admin/service-accounts-admin.md
index 0c7b495a10..3fa6ef492f 100644
--- a/docs/admin/service-accounts-admin.md
+++ b/docs/admin/service-accounts-admin.md
@@ -64,6 +64,11 @@ TokenController runs as part of controller-manager. It acts asynchronously. It:
 - observes secret addition, and ensures the referenced ServiceAccount exists, and adds a token to the secret if needed
 - observes secret deletion and removes a reference from the corresponding ServiceAccount if needed
 
+You must pass a service account private key file to the token controller in the controller-manager by using
+the `--service-account-private-key-file` option. The private key will be used to sign generated service account tokens.
+Similarly, you must pass the corresponding public key to the kube-apiserver using the `--service-account-key-file`
+option. The public key will be used to verify the tokens during authentication.
+
 #### To create additional API tokens
 
 A controller loop ensures a secret with an API token exists for each service