Clarify credential id is required for ip allowlist update

Author: seand52

main/docs/secure/call-apis-on-users-behalf/token-vault/privileged-worker-token-exchange-with-token-vault.mdx

@@ -64,11 +64,20 @@ Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>
 Content-Type: application/json
 {
   "token_vault_privileged_access": {
-    "credentials": [{"id": "<YOUR CREDENTIAL ID>"}]
+    "credentials": [{"id": "<YOUR_CREDENTIAL_ID>"}]
   }
 }
 ```
 
+If you need to look up the credential id, retrieve it with a GET request:
+
+```bash lines
+GET https://{yourDomain}.auth0.com/api/v2/clients/{yourClientId}
+Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>
+```
+
+The `token_vault_privileged_access.credentials[].id` field in the response contains the credential ID.
+
 ### Configure IP allowlist
 
 To restrict which IP addresses may make Privileged Worker exchange requests, configure an `ip_allowlist` on your client. This binds the client credential to known server egress IPs, so a leaked credential cannot be used from an arbitrary IP address. Both IPv4 and IPv6 addresses and CIDR ranges are supported, with a maximum of 10 entries.
@@ -79,7 +88,8 @@ Authorization: Bearer <YOUR_MANAGEMENT_API_ACCESS_TOKEN>
 Content-Type: application/json
 {
   "token_vault_privileged_access": {
-    "ip_allowlist": ["<YOUR_SERVER_IP_ADDRESS>", "<YOUR_CIDR_RANGE>"]
+    "credentials": [{"id": "<YOUR_CREDENTIAL_ID>"}],
+    "ip_allowlist": ["<YOUR_SERVER_IP_ADDRESS>"]
   }
 }
 ```