diff --git a/includes/class-peptide-news-rest-worker.php b/includes/class-peptide-news-rest-worker.php
index 65ceac0..34f2c07 100644
--- a/includes/class-peptide-news-rest-worker.php
+++ b/includes/class-peptide-news-rest-worker.php
@@ -23,7 +23,11 @@ class Peptide_News_Rest_Worker {
 
 	/**
 	 * Check whether the incoming request is authenticated as an admin
-	 * OR bears a valid VPS worker secret token in X-Peptide-News-Token header.
+	 * OR bears a valid VPS worker secret token.
+	 *
+	 * GET requests (pending) require the token as a query parameter so
+	 * cached responses are namespaced by the secret; POST requests accept
+	 * the X-Peptide-News-Token header (or query token) or an admin session.
 	 *
 	 * @param WP_REST_Request $request
 	 * @return bool|WP_Error