diff --git a/README.md b/README.md
index d2d474782..ec45bf597 100644
--- a/README.md
+++ b/README.md
@@ -94,10 +94,10 @@ Please note that the naming of the data models, functions and the SDK API is sub
 
 ## Authentication
 
-To authenticate to the SDK, you will need a service account. Create it in the STACKIT Portal an assign it the necessary permissions, e.g. project.owner. There are multiple ways to authenticate:
+To authenticate to the SDK, you will need a [service account](https://docs.stackit.cloud/stackit/en/service-accounts-134415819.html). Create it in the STACKIT Portal an assign it the necessary permissions, e.g. `project.owner`. There are multiple ways to authenticate:
 
-- Token flow
 - Key flow (recommended)
+- Token flow
 
 When setting up authentication, the SDK will always try to use the key flow first and search for credentials in several locations, following a specific order:
 
@@ -121,11 +121,33 @@ Check the [authentication example](examples/authentication/authentication.go) fo
 
 ### Key flow
 
-To use the key flow, you need to have a service account key and an RSA key-pair. To configure it, follow this steps:
+To use the key flow, you need to have a service account key and an RSA key-pair.
+To configure it, follow this steps:
+
+    The following instructions assume that you have created a service account and assigned it the necessary permissions, e.g. project.owner.
 
 1. In the Portal, go to `Service Account -> Service Account Keys` and create a key.
    - You can create your own RSA key-pair or have the Portal generate one for you.
-2. Save the content of the service account key and the corresponding private key by copying them or saving them in a file.
+2. Save the content of the service account key and the corresponding private key by copying them or saving them in a file. The expected format of the service account key is the following:
+   ```json
+   {
+     "id": "uuid",
+     "publicKey": "public key",
+     "createdAt": "2023-08-24T14:15:22Z",
+     "validUntil": "2023-08-24T14:15:22Z",
+     "keyType": "USER_MANAGED",
+     "keyOrigin": "USER_PROVIDED",
+     "keyAlgorithm": "RSA_2048",
+     "active": true,
+     "credentials": {
+       "kid": "string",
+       "iss": "my-sa@sa.stackit.cloud",
+       "sub": "uuid",
+       "aud": "string",
+       (optional) "privateKey": "private key when generated by the SA service"
+     }
+   }
+   ```
 3. Configure the service account key and private key for authentication in the SDK:
    - using the configuration options: `config.WithServiceAccountKey` or `config.WithServiceAccountKeyPath`, `config.WithPrivateKey` or `config.WithPrivateKeyPath`
    - setting environment variables: `STACKIT_SERVICE_ACCOUNT_KEY_PATH` and `STACKIT_PRIVATE_KEY_PATH`