diff --git a/articles/fleetctl.md b/articles/fleetctl.md
index c369b8a988..918778c507 100644
--- a/articles/fleetctl.md
+++ b/articles/fleetctl.md
@@ -122,18 +122,25 @@ An API-only user does not have access to the Fleet UI. Instead, it's only purpos
 
 #### Create API-only user
 
-Before creating the API-only user, log in to fleetctl as an admin.  See [authentication](#authentication) above for details.
+To create an API-only user, navigate to **Settings > Users > Create user** and select the **API-only** option. 
 
-To create your new API-only user, use `fleetctl user create`:
+You can optionally restrict the user to a specific list of API endpoints, which narrows access without expanding permissions beyond the user's role (for example, a team admin granted access to the [Update configuration](https://fleetdm.com/docs/rest-api/rest-api#update-configuration) endpoint will still receive a `403` response, because that endpoint is restricted to global admins).
+
+You can also create an API-only user with `fleetctl`. First, log in to fleetctl as an admin (see [authentication](#authentication) above for details), then run:
 
 ```sh
-fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only
+fleetctl user create --name 'API User' --api-only
 ```
 
-You'll then receive an API token:
+`--email` and `--password` are optional when creating an API-only user. If omitted, Fleet generates an email derived from the creator's address; the user authenticates via API token only.
+
+After running the command, you'll receive an API token:
 
 ```sh
-Success! The API token for your new user is: <TOKEN>
+Successfully created new user!
+
+When you're ready to view the API token, press any key (will not be shown again):
+The API token for your new user is: <TOKEN>
 ```
 
 > If you need to retrieve this user's token again in the future, you can do so via the [log in API](https://fleetdm.com/docs/rest-api/rest-api#log-in).
@@ -143,13 +150,13 @@ Success! The API token for your new user is: <TOKEN>
 An API-only user can be given the same permissions as a regular user. The default access level is **Observer**. You can specify what level of access the new user should have using the `--global-role` flag:
 
 ```sh
-fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --global-role 'admin'
+fleetctl user create --name 'API User' --api-only --global-role 'admin'
 ```
 
 On Fleet Premium, use the `--team <team_id>:<role>` to create an API-only user on a fleet:
 
 ```sh
-fleetctl user create --name 'API User' --email 'api@example.com' --password 'temp@pass123' --api-only --team 4:gitops
+fleetctl user create --name 'API User' --api-only --team 4:gitops
 ```
 
 #### Changing permissions
diff --git a/articles/foreign-vitals-map-idp-users-to-hosts.md b/articles/foreign-vitals-map-idp-users-to-hosts.md
index e16bfa393b..746af39d88 100644
--- a/articles/foreign-vitals-map-idp-users-to-hosts.md
+++ b/articles/foreign-vitals-map-idp-users-to-hosts.md
@@ -43,7 +43,6 @@ To map users from Okta to hosts in Fleet, we'll do the following steps:
 5. For the **Authentication Mode**, select **HTTP Header**.
 6. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in Okta's **Authorization** field.
 
-> For example, `fleetctl user create --name 'SCIM User' --email 'scim@example.com' --password 'hunter2' --api-only --global-role maintainer`
 
 7. Select the **Test Connector Configuration** button. You should see a success message pop up in Okta. You can close this message.
 8. In Fleet, head to **Settings > Integrations > Identity provider (IdP)** and verify that Fleet successfully received the request from Okta.
@@ -260,7 +259,7 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
 1. From the side menu, select **Applications > Providers**, **Create**, **SCIM Provider**, and then **Next**.
 2. Add a friendly name (e.g. "Fleet SCIM provider").
 3. For the **URL**, enter `https://<your_fleet_server_url>/api/v1/fleet/scim`.
-4. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy the API token for that user. Paste your API token in the **Token** field.
+4. [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in the **Secret token** field.
 5. Select **Finish** to save provider.
 6. Now, from the side menu, select **Applications > Applications**. Then, select **Create**.
 7. Add a friendly name (e.g. "Fleet SCIM app") and slug (e.g. "fleet-scim-app").
@@ -273,7 +272,7 @@ To map users from Google Workspace to hosts in Fleet, we'll do the following ste
 IdPs generally require a Fleet SCIM URL and API token:
 
 - SCIM URL - `https://<your_fleet_server_url>/api/v1/fleet/scim`
-- API token - [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user.
+- API token - [Create a Fleet API-only user](https://fleetdm.com/guides/fleetctl#create-api-only-user) with maintainer permissions and copy API token for that user. Paste your API token in the **Secret token** field.
 
 Fleet requires the `userName`, `givenName`, and `familyName` SCIM attributes. Make sure these attributes are correctly mapped in your IdP with `userName` as the unique identifier. Fleet uses the `userName` attribute to map to IdP groups and department.