diff --git a/en/identity-server/7.3.0/docs/references/conditional-auth/api-reference.md b/en/identity-server/7.3.0/docs/references/conditional-auth/api-reference.md
index a527e8b308..a4d49286e1 100644
--- a/en/identity-server/7.3.0/docs/references/conditional-auth/api-reference.md
+++ b/en/identity-server/7.3.0/docs/references/conditional-auth/api-reference.md
@@ -738,6 +738,9 @@ This function returns a string containing the parameter's value in a decoded Jso
     var state = getValueFromDecodedAssertion(context.request.params.request[0],"state",true);
     ```
 
+!!! note
+    This function only decodes the JWT — it does not verify the signature, issuer, audience, or expiry.
+
 ### Get unique user
 
 `getUniqueUserWithClaimValues(claimMap, context)`
diff --git a/en/identity-server/next/docs/references/conditional-auth/api-reference.md b/en/identity-server/next/docs/references/conditional-auth/api-reference.md
index 7d22748f94..0f6e0cf68d 100644
--- a/en/identity-server/next/docs/references/conditional-auth/api-reference.md
+++ b/en/identity-server/next/docs/references/conditional-auth/api-reference.md
@@ -738,6 +738,9 @@ This function returns a string containing the parameter's value in a decoded Jso
     var state = getValueFromDecodedAssertion(context.request.params.request[0],"state",true);
     ```
 
+!!! note
+    This function only decodes the JWT — it does not verify the signature, issuer, audience, or expiry.
+
 ### Get unique user
 
 `getUniqueUserWithClaimValues(claimMap, context)`
diff --git a/en/includes/references/conditional-auth/api-reference.md b/en/includes/references/conditional-auth/api-reference.md
index f9e7c16b57..274393ad78 100644
--- a/en/includes/references/conditional-auth/api-reference.md
+++ b/en/includes/references/conditional-auth/api-reference.md
@@ -793,6 +793,9 @@ This function returns a string containing the parameter's value in a decoded Jso
     var state = getValueFromDecodedAssertion(context.request.params.request[0],"state",true);
     ```
 
+!!! note
+    This function only decodes the JWT - it does not verify the signature, issuer, audience, or expiry.
+
 ### Get unique user
 
 `getUniqueUserWithClaimValues(claimMap, context)`