diff --git a/cmd/kosli/createApiKey.go b/cmd/kosli/createApiKey.go
index 04c3f032b..a7f30cc6f 100644
--- a/cmd/kosli/createApiKey.go
+++ b/cmd/kosli/createApiKey.go
@@ -14,7 +14,10 @@ const createApiKeyShortDesc = `Create an API key for a service account.`
 
 const createApiKeyLongDesc = createApiKeyShortDesc + `
 
-The key value is only returned once, at creation time, so make sure to store it securely.`
+The key value is only returned once, at creation time, so make sure to store it securely.
+
+Every API key expires. Without ^--expires-at^ the key is given the maximum allowed
+lifetime, and an ^--expires-at^ beyond that maximum is capped to it.`
 
 const createApiKeyExample = `
 # create an API key for a service account:
@@ -67,7 +70,7 @@ func newCreateApiKeyCmd(out io.Writer) *cobra.Command {
 
 	cmd.Flags().StringVarP(&o.serviceAccount, "service-account", "s", "", serviceAccountNameFlag)
 	cmd.Flags().StringVarP(&o.payload.Description, "description", "d", "", apiKeyDescriptionFlag)
-	cmd.Flags().StringVarP(&o.expiresAt, "expires-at", "e", "", apiKeyExpiresAtFlag)
+	cmd.Flags().StringVarP(&o.expiresAt, "expires-at", "e", "", createApiKeyExpiresAtFlag)
 	cmd.Flags().StringVarP(&o.output, "output", "o", "table", outputFlag)
 	addDryRunFlag(cmd)
 
diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go
index ba8d37c78..9eda56102 100644
--- a/cmd/kosli/root.go
+++ b/cmd/kosli/root.go
@@ -154,8 +154,9 @@ Paths the list already matches stay excluded whatever is later added there, so k
 	serviceAccountPrivilegeFlag     = "The privilege granted to the service account. One of: [" + validServiceAccountPrivilegesList + "]."
 	serviceAccountAssumeYesFlag     = "[optional] Skip the confirmation prompt and delete the service account without asking. (alias: --yes)"
 	apiKeyDescriptionFlag           = "A description for the API key."
-	apiKeyExpiresAtFlag             = "[optional] When the API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Defaults to no expiry."
-	apiKeyGracePeriodHoursFlag      = "[optional] How many hours the old API key remains valid after rotation, to allow time to update dependent systems. Defaults to the server-side value when not set."
+	createApiKeyExpiresAtFlag       = "[optional] When the API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Keys always expire: when not set, the key gets the maximum allowed lifetime, which also caps later dates."
+	rotateApiKeyExpiresAtFlag       = "[optional] When the new API key expires. Accepts an epoch timestamp or a date like '2026-06-04', '2026-06-04 15:04:05', or an RFC3339 timestamp. Defaults to the rotated key's current expiry, and is capped by the maximum allowed key lifetime."
+	apiKeyGracePeriodHoursFlag      = "[optional] How many hours the old API key remains valid after rotation, to allow time to update dependent systems. Defaults to the standard grace period when not set."
 	apiKeyAssumeYesFlag             = "[optional] Skip the confirmation prompt and delete the API key without asking. (alias: --yes)"
 	environmentNameFlag             = "The environment name."
 	pageNumberFlag                  = "[defaulted] The page number of a response."
diff --git a/cmd/kosli/rotateApiKey.go b/cmd/kosli/rotateApiKey.go
index dd4bb7af2..18697fe66 100644
--- a/cmd/kosli/rotateApiKey.go
+++ b/cmd/kosli/rotateApiKey.go
@@ -17,9 +17,9 @@ const rotateApiKeyShortDesc = `Rotate one or more API keys for a service account
 const rotateApiKeyLongDesc = rotateApiKeyShortDesc + `
 
 A new API key is generated immediately. The old key remains valid for a grace period to
-allow time to update dependent systems; the length of that grace period is server-managed
-unless overridden with ^--grace-period-hours^. The new key value is only returned once, so
-make sure to store it securely.`
+allow time to update dependent systems; that grace period has a standard length unless
+overridden with ^--grace-period-hours^. The new key value is only returned once, so make
+sure to store it securely.`
 
 const rotateApiKeyExample = `
 # rotate an API key for a service account:
@@ -78,7 +78,7 @@ func newRotateApiKeyCmd(out io.Writer) *cobra.Command {
 	}
 
 	cmd.Flags().StringVarP(&o.serviceAccount, "service-account", "s", "", serviceAccountNameFlag)
-	cmd.Flags().StringVarP(&o.expiresAt, "expires-at", "e", "", apiKeyExpiresAtFlag)
+	cmd.Flags().StringVarP(&o.expiresAt, "expires-at", "e", "", rotateApiKeyExpiresAtFlag)
 	cmd.Flags().IntVarP(&o.gracePeriodHours, "grace-period-hours", "g", 0, apiKeyGracePeriodHoursFlag)
 	cmd.Flags().StringVarP(&o.output, "output", "o", "table", outputFlag)
 	addDryRunFlag(cmd)