diff --git a/doc/src/sgml/client-auth.sgml b/doc/src/sgml/client-auth.sgml
index e4e65f8feb1..873ddd8f068 100644
--- a/doc/src/sgml/client-auth.sgml
+++ b/doc/src/sgml/client-auth.sgml
@@ -652,7 +652,9 @@ include_dir         <replaceable>directory</replaceable>
         <listitem>
          <para>
           Authorize and optionally authenticate using a third-party OAuth 2.0
-          identity provider. See <xref linkend="auth-oauth"/> for details.
+          identity provider.  Since the bearer token is sent in clear text over
+          the network, this should not be used on untrusted networks.  See
+          <xref linkend="auth-oauth"/> for details.
          </para>
         </listitem>
        </varlistentry>
@@ -2341,7 +2343,9 @@ host ... ldap ldapbasedn="dc=example,dc=net"
     <ulink url="https://datatracker.ietf.org/doc/html/rfc6750">RFC 6750</ulink>,
     which are a type of access token used with OAuth 2.0 where the token is an
     opaque string.  The format of the access token is implementation specific
-    and is chosen by each authorization server.
+    and is chosen by each authorization server.  The bearer token is sent
+    in clear-text, and is vulnerable to network sniffing.  For this reason
+    OAuth should only be used over SSL connections.
    </para>
 
    <para>
diff --git a/doc/src/sgml/protocol.sgml b/doc/src/sgml/protocol.sgml
index 84af9372ebe..541673eb282 100644
--- a/doc/src/sgml/protocol.sgml
+++ b/doc/src/sgml/protocol.sgml
@@ -2084,6 +2084,16 @@ SELCT 1/0;<!-- this typo is intentional -->
     server.
    </para>
 
+   <note>
+    <para>
+     The bearer token is sent across the connection, as part of the client
+     initial response, and grants access to the database like a clear-text
+     password. On an unencrypted connection it can be captured by network
+     sniffing. For this reason <literal>OAUTHBEARER</literal> should only be
+     used over SSL connections.
+    </para>
+   </note>
+
    <para>
     <literal>OAUTHBEARER</literal> does not support channel binding, and there
     is no "OAUTHBEARER-PLUS" mechanism. This mechanism does not make use of