diff --git a/.changeset/correct-token-endpoint-tls-citation.md b/.changeset/correct-token-endpoint-tls-citation.md
new file mode 100644
index 0000000000..50dd1d3220
--- /dev/null
+++ b/.changeset/correct-token-endpoint-tls-citation.md
@@ -0,0 +1,5 @@
+---
+'@modelcontextprotocol/client': patch
+---
+
+Correct the JSDoc for insecure OAuth token endpoints. The TLS requirement comes from the MCP authorization specification's OAuth 2.1 communication-security rules, not SEP-2207, which covers OIDC-flavored refresh-token guidance. Documentation only; no runtime behavior change.
diff --git a/packages/client/src/client/auth.ts b/packages/client/src/client/auth.ts
index 4c37339297..ca002cc635 100644
--- a/packages/client/src/client/auth.ts
+++ b/packages/client/src/client/auth.ts
@@ -866,8 +866,11 @@ function isLoopbackHost(hostname: string): boolean {
 }
 
 /**
- * SEP-2207: refuse to send credentials to a non-TLS, non-loopback token endpoint.
- * Throws {@linkcode InsecureTokenEndpointError}. Loopback hosts are exempt.
+ * Refuse to send credentials to a non-TLS token endpoint. The MCP authorization
+ * specification requires authorization server endpoints to use HTTPS. Loopback
+ * hosts are exempt here for local development.
+ *
+ * @throws {@linkcode InsecureTokenEndpointError} if the endpoint is insecure.
  */
 export function assertSecureTokenEndpoint(tokenEndpoint: string | URL): URL {
     const url = new URL(String(tokenEndpoint));
diff --git a/packages/client/src/client/authErrors.ts b/packages/client/src/client/authErrors.ts
index e8925b2f86..86d9287bdd 100644
--- a/packages/client/src/client/authErrors.ts
+++ b/packages/client/src/client/authErrors.ts
@@ -132,10 +132,12 @@ export class RegistrationRejectedError extends OAuthClientFlowError {
 
 /**
  * Thrown by the token-exchange and refresh paths when the resolved token
- * endpoint is not `https:` and is not a loopback host (SEP-2207). This is a
- * configuration error — re-authorizing cannot fix it — so it intentionally does
- * **not** extend `OAuthError` and `auth()`'s refresh branch rethrows it instead
- * of falling through to a fresh `/authorize` redirect.
+ * endpoint is not `https:` and is not a loopback host. The MCP authorization
+ * specification requires authorization server endpoints to use HTTPS; loopback
+ * hosts are exempt here for local development. This is a configuration error —
+ * re-authorizing cannot fix it — so it intentionally does **not** extend
+ * `OAuthError` and `auth()`'s refresh branch rethrows it instead of falling
+ * through to a fresh `/authorize` redirect.
  */
 export class InsecureTokenEndpointError extends OAuthClientFlowError {
     static {