diff --git a/docs/auth/google/gcp-iap-auth.md b/docs/auth/google/gcp-iap-auth.md
index f9a78bbc71..ce08f87865 100644
--- a/docs/auth/google/gcp-iap-auth.md
+++ b/docs/auth/google/gcp-iap-auth.md
@@ -29,7 +29,10 @@ auth:
       jwtHeader: x-custom-header # Optional: Only if you are using a custom header for the IAP JWT
 ```
 
-You can find the project number and service ID in the Google Cloud Console.
+The full `audience` value can be obtained by visiting your [Identity-Aware Proxy Google Cloud console](https://console.cloud.google.com/security/iap), selecting your project, finding your Backend Service to proxy, clicking the 3 vertical dots then "Get JWT Audience Code", and copying from the resulting popup, which will look similar to the following:
+
+<img width="444" alt="Screenshot 2023-02-02 at 10 58 10 AM" src="https://user-images.githubusercontent.com/4237425/216376626-88a0fb85-654b-4e94-ab07-8dd59764b1b8.png">
+
 
 This config section must be in place for the provider to load at all. Now let's
 add the provider itself.