diff --git a/src/client.types.ts b/src/client.types.ts
index 611f81b..4ba49e5 100644
--- a/src/client.types.ts
+++ b/src/client.types.ts
@@ -144,9 +144,7 @@ export interface Base44Client {
     functions: FunctionsModule;
     /** {@link IntegrationsModule | Integrations module} with elevated permissions. */
     integrations: IntegrationsModule;
-    /** {@link SsoModule | SSO module} for generating SSO tokens.
-     * @internal
-     */
+    /** {@link SsoModule | SSO module} for generating SSO tokens. */
     sso: SsoModule;
     /** Cleanup function to disconnect WebSocket connections. */
     cleanup: () => void;
diff --git a/src/modules/sso.types.ts b/src/modules/sso.types.ts
index 023bfb4..25bad79 100644
--- a/src/modules/sso.types.ts
+++ b/src/modules/sso.types.ts
@@ -1,6 +1,5 @@
 /**
  * Response from SSO access token endpoint.
- * @internal
  */
 export interface SsoAccessTokenResponse {
   access_token: string;
@@ -14,47 +13,54 @@ export interface SsoAccessTokenResponse {
  * services.
  *
  * This module is only available to use with a client in service role authentication mode, which means it can only be used in backend environments.
- *
- * @internal
- *
- * @example
- * ```typescript
- * // Access SSO module with service role
- * const response = await base44.asServiceRole.sso.getAccessToken('user_123');
- * console.log(response.data.access_token);
- * ```
  */
 export interface SsoModule {
   /**
-   * Gets SSO access token for a specific user.
+   * Gets an SSO access token for the user who made the current request.
    *
-   * Retrieves a Single Sign-On access token that can be used to authenticate
-   * a user with external services or systems.
+   * Use this token to authenticate the user with external systems or services.
+   * This only works for that same user. Create the client with
+   * {@link createClientFromRequest} so it acts on behalf of the request's user,
+   * then pass that user's ID as `userid`. If `userid` is any other user, the
+   * call fails. An expired token is refreshed automatically when a refresh token
+   * is available.
    *
-   * @param userid - The user ID to get the access token for.
+   * @param userid - The ID of the user who made the current request, such as the
+   * `id` returned by {@link AuthModule | base44.auth.me()}.
    * @returns Promise resolving to the SSO access token response.
    *
    * @example
    * ```typescript
-   * // Get SSO access token for a user
-   * const response = await base44.asServiceRole.sso.getAccessToken('user_123');
-   * console.log(response.access_token);
+   * // Get the user's SSO access token to call an external system
+   * import { createClientFromRequest } from 'npm:@base44/sdk';
+   *
+   * Deno.serve(async (req) => {
+   *   const base44 = createClientFromRequest(req);
+   *   const user = await base44.auth.me();
+   *   const { access_token } = await base44.asServiceRole.sso.getAccessToken(user.id);
+   *
+   *   return Response.json({ access_token });
+   * });
    * ```
    */
   getAccessToken(userid: string): Promise<SsoAccessTokenResponse>;
 
   /**
-   * Gets the stored SSO OIDC ID token for the current app user.
+   * Gets the stored SSO OIDC ID token for the user who made the current request.
    *
-   * The service-role client must include an on-behalf-of token for the same
-   * user specified by `userid`. This method returns the stored token as-is and
-   * does not refresh it.
+   * This only works for that same user, not for arbitrary users. Create the
+   * client with {@link createClientFromRequest} so it acts on behalf of the
+   * request's user, then pass that user's ID as `userid`. If `userid` is any
+   * other user, the call fails. The stored token is returned as-is and is never
+   * refreshed, so the call fails if the token has already expired.
    *
-   * @param userid - The current app user's ID.
+   * @param userid - The ID of the user who made the current request, such as the
+   * `id` returned by {@link AuthModule | base44.auth.me()}.
    * @returns Promise resolving to the raw ID-token string.
    *
    * @example
    * ```typescript
+   * // Get the user's ID token to read identity claims such as email
    * import { createClientFromRequest } from 'npm:@base44/sdk';
    *
    * Deno.serve(async (req) => {