diff --git a/docs/reference/api-tokens.md b/docs/reference/api-tokens.md
index d587def..6d4af65 100644
--- a/docs/reference/api-tokens.md
+++ b/docs/reference/api-tokens.md
@@ -9,8 +9,10 @@ needs something it can hold onto instead — an API token.
 
 ## Creating one
 
-Settings → **Access** → API tokens. Give it a name, a role (owner, admin or
-member) and one or more scopes, and optionally an expiry. The value is shown
+**API Keys**, in the Access group of the sidebar. The page is reachable at
+every role: any member may create and revoke their own keys, and owner and
+admin additionally see every key in the instance. Give it a name, a role
+(owner, admin or member) and one or more scopes, and optionally an expiry. The value is shown
 once, in full, immediately after creation:
 
 ```
@@ -54,7 +56,7 @@ independent of its owner.
 ## Expiry
 
 An expiry is optional on a token you create. An instance can set a
-**maximum token lifetime** (Settings → Access) that caps how far out a new
+**maximum key lifetime** (Settings → Integrations) that caps how far out a new
 token's expiry may be set; when that cap is in place, a token with no expiry
 at all is refused, so there is no way to route around the policy by leaving
 the field blank.