diff --git a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md
index 8e836355bbf..2eaf939b63f 100644
--- a/content/en/docs/marketplace/platform-supported-content/modules/oidc.md
+++ b/content/en/docs/marketplace/platform-supported-content/modules/oidc.md
@@ -203,6 +203,7 @@ This section provides an overview of updates for the OIDC SSO module across diff
 
 | Mendix Version | OIDC SSO Module Version | Important Migration Changes | Additional Information |
 | --- | --- | --- | --- |
+| 10.24.0 and above | 4.x.x | - | New constant (`EnableAudienceValidation`) has been introduced for the api security. Configure the required values as they are mandatory for the api security flow. |
 | 10.24.0 and above | 4.6.0 | - | New constant (`OIDC.NonceCookieSameSite`) has been introduced. |
 | 10.24.0 and above | 4.5.0 | - | New Admin UI and new constants have been introduced. |
 | | | | `Anonymous` module role has been removed. |
@@ -392,13 +393,14 @@ See the section [Optional Features](#optional) information on additional optiona
 #### API Security Configuration for Client Credential Grant {#client-credential-grant}
 
 1. Start your app, log in as an administrator, for example, *demo_administrator*, and access the Client Credential setup page.
-2. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints.
+2. If you are using version x.x.x of the module, configure the **Resource path** and **Expected audience** value. Otherwise, the API security flow fails as audience validation is enabled by default.
+3. If you have the **Automatic Configuration URL** (also known as the well-known endpoint), enter it and click **Import Configuration** to automatically fill the other endpoints.
 
     {{% alert color="info" %}}If the endpoint URL does not already end with `/.well-known/openid-configuration`, include it at the end. According to the specifications, the URL you need to enter typically ends with `/.well-known/openid-configuration`.{{% /alert %}}
 
     If you do not have an automatic configuration URL, you can fill in the other endpoints manually.
-3. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information.
-4. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing.
+4. Optionally, you can select the **Custom AccessToken Parsing** microflow if you want to use additional information from the OIDC IdP. This can be used, for example, to assign end-user roles based on information from the IdP – see [Dynamic Assignment of Userroles (Access Token Parsing)](#access-token-parsing) for more information.
+5. Click **Save**. Once you have completed these steps, the Client Credential Configuration is ready for testing.
 
 #### Microsoft Entra ID Client Configuration for APIs {#azure}
 
@@ -544,9 +546,9 @@ The following constants are mandatory when creating an OIDC SSO Client Credentia
 Example: `OIDC.Default_SAM_TokenProcessing_CustomATP`
 * **IsClientGrantOnly** (*default: false*) – allow to create Client Credential Configuration in the application
 
-{{% alert color="warning" %}}
-When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration.
-{{% /alert %}}
+    {{% alert color="warning" %}}When the `IsClientGrantOnly` constant is set to *true*, the OIDC SSO module considers the configuration as Client Credential grant configuration.
+    {{% /alert %}}
+* **EnableAudienceValidation** (Boolean) – If you are setting this as a true then make sure to set Resource path and Expected audience.
 
 ## Configuring Multi-Domain {#multi-domain}
 
@@ -789,7 +791,7 @@ You can create your own APIs within your Mendix app and secure the end point ove
 
 1. Create a REST API endpoint which needs to be secured.
 2. Use **Custom** as the [authentication method](/refguide/published-rest-service/#authentication) to secure the endpoint with an access token.
-3. Select the `OIDC.APIAuthentication` microflow which has `HTTPRequest` as the input and returns `System.User` as the output.
+3. Select the `OIDC.APIAuthentication` microflow from the **OIDC.APIAuthentication** folder of the module which has `HTTPRequest` as the input and returns `System.User` as the output.
 
 ### Using `APIAuthentication` for Client Credentials Grant
 
@@ -798,7 +800,9 @@ The client credentials grant type is used when applications request an access to
 1. Request an Access Token using `/token` endpoint.
 2. Access the Secured API Endpoint
 3. `APIAuthentication` will validate the token and extract the claims.
-4. The OIDC SSO module checks if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message.
+4. The OIDC SSO module checks 
+    * if the `sub` claim (which contains the `client-id`) is present in the access token. If it is not, the module will verify the `client_id`, `appid`, or `cid` parameters. If none of these are found, it will throw an exception message.
+    * if the `audiencevalidationenabled` is true then verify the resource path and expected audince based on the configured values.
 5. Create a new user using the client ID from the token if one does not already exist.
 
 {{% alert color="info" %}}