diff --git a/dev/oauth_example.gleam b/dev/oauth_example.gleam
index 2088c09..e5dfbc8 100644
--- a/dev/oauth_example.gleam
+++ b/dev/oauth_example.gleam
@@ -78,6 +78,8 @@ pub fn main() -> Nil {
   // signing and verification. Every request we send from now will include a signed
   // DPoP proof and the authorisation server will verify it using provided verification
   // key. 
+  //
+  // It is a strict requirement that ES256 is used for DPoP proofs.
   let sign_key = ywt.generate_key(algorithm.es256)
   let verify_key = verify_key.derived(sign_key)
 
@@ -160,6 +162,17 @@ pub fn main() -> Nil {
   Nil
 }
 
+/// Because of the "sans-io" nature of this library, we can't provide or abstract
+/// this function for you. It handles two crucial things and I'd expect applications
+/// to implement or copy something like this themselves:
+/// 
+/// 1. It signs the DPoP proof for the request using the provided signing key.
+/// This can't be abstracted as key signing on the JavaScript target is async and
+/// therefor wrapped in a `Promise`.
+/// 
+/// 2. It handles the nonce rotation and retry logic that is an expected part of
+/// DPoP request handling.
+/// 
 fn send_with_retry(
   builder: DpopRequest(String),
   session: Option(Session(Verified)),