diff --git a/pia/cli.py b/pia/cli.py
index 40295f1..3e1474d 100644
--- a/pia/cli.py
+++ b/pia/cli.py
@@ -4,17 +4,21 @@
 -----------
 - sync: Reconcile all project authorizations from a curated file into the
   database (create/update/delete).
+  - DependencyTrack API key needs VIEW_PORTFOLIO permission
+  - Permissionless GitHub token is optional for higher rate limits
+
 - create-dt-projects: Create the DependencyTrack projects referenced by a curated
   file (provisioning only; no database access).
+  - DependencyTrack API key needs VIEW_PORTFOLIO and PORTFOLIO_MANAGEMENT permission
 
 Usage Example
 -------------
-    PIA_DATABASE_URL=postgresql://user:secret@localhost:5432/pia \
-    PIA_DEPENDENCY_TRACK_API_KEY=<API key with VIEW_PORTFOLIO permission> \
-    PIA_GITHUB_TOKEN=<optional token with public read permission for rate limit> \
+    PIA_DATABASE_URL=postgresql://<user>:<secret>@<host>:<port>/<db> \
+    PIA_DEPENDENCY_TRACK_API_KEY=<secret> \
+    PIA_GITHUB_TOKEN=<secret> \
         uv run pia sync projects.yaml --dt-url https://sbom.eclipse.org --dry-run
 
-    PIA_DEPENDENCY_TRACK_API_KEY=<API key with PORTFOLIO_MANAGEMENT permission> \
+    PIA_DEPENDENCY_TRACK_API_KEY=<secret> \
         uv run pia create-dt-projects projects.yaml --dt-url https://sbom.eclipse.org
 
 """
@@ -157,8 +161,8 @@ def create_dt_projects(file: str, dt_url: str | None) -> None:
     `pia sync` whenever a file introduces new DependencyTrack targets.
     Idempotent: existing projects are left as-is.
 
-    Requires --dt-url and PIA_DEPENDENCY_TRACK_API_KEY (with PORTFOLIO_MANAGEMENT
-    permission to create projects).
+    Requires --dt-url and PIA_DEPENDENCY_TRACK_API_KEY (with VIEW_PORTFOLIO and
+    PORTFOLIO_MANAGEMENT permission to create projects).
     """
     pf = load_projects_file(file)
     validate_projects_file(pf)
diff --git a/pia/sync.py b/pia/sync.py
index 8f3b3c3..a9dce0f 100644
--- a/pia/sync.py
+++ b/pia/sync.py
@@ -310,13 +310,13 @@ def ensure_dt_projects(
 ) -> list[tuple[str, str]]:
     """Create any missing DependencyTrack projects for the file's DT mappings.
 
-    For every product of every curated Eclipse Foundation project, ensure the root
-    and child project exist on DependencyTrack, creating whichever are missing.
-    This is the provisioning step behind ``pia create-dt-projects``: it touches
-    only DependencyTrack (no PIA database, no GitHub) and is idempotent — an
-    existing project is resolved, not recreated. Requires a DT API key with
-    PORTFOLIO_MANAGEMENT permission. Returns the ``(project, product)`` pairs it
-    ensured, for reporting.
+    For every product of every curated Eclipse Foundation project, ensure the
+    root and child project exist on DependencyTrack, creating whichever are
+    missing. This is the provisioning step behind ``pia create-dt-projects``:
+    it touches only DependencyTrack (no PIA database, no GitHub) and is
+    idempotent — an existing project is resolved, not recreated. Requires a DT
+    API key with VIEW_PORTFOLIO and PORTFOLIO_MANAGEMENT permission. Returns
+    the ``(project, product)`` pairs it ensured, for reporting.
     """
     root_cache: dict[str, dict[str, Any]] = {}
     ensured: list[tuple[str, str]] = []