diff --git a/weed-shell.md b/weed-shell.md
index 6a04e60..6b79550 100644
--- a/weed-shell.md
+++ b/weed-shell.md
@@ -282,10 +282,14 @@ Supported actions: Read, Write, List, Tagging, Admin.
 > s3.serviceaccount.create -user alice -description "CI pipeline" -actions Read,List
 > s3.serviceaccount.create -user alice -expiry 24h
 > s3.serviceaccount.list -user alice
-> s3.serviceaccount.show -id sa-xxxxx
-> s3.serviceaccount.delete -id sa-xxxxx
+> s3.serviceaccount.show -id sa:alice:<uuid>
+> s3.serviceaccount.delete -id sa:alice:<uuid>
 ```
 
+Service account IDs use the form `sa:<parent-user>:<uuid>` (e.g.
+`sa:alice:123e4567e89b12d3a456426614174000`). Copy the ID printed by
+`s3.serviceaccount.create` or `s3.serviceaccount.list`.
+
 Actions are validated (Read, Write, List, Tagging, Admin).
 Use `-expiry` for time-limited credentials (must be positive; 0 = no expiration).