Address the review comments

Author: nbayati

README.md

@@ -44,6 +44,7 @@ information, refer to [documentation](https://cloud.google.com/docs/authenticati
       * [Accessing resources from AWS](#accessing-resources-from-aws)
       * [Accessing resources from Azure](#access-resources-from-microsoft-azure)
       * [Accessing resources from an OIDC identity provider](#accessing-resources-from-an-oidc-identity-provider)
+      * [Accessing resources using X.509 certificate-sourced credentials](#accessing-resources-using-x509-certificate-sourced-credentials)
       * [Accessing resources using Executable-sourced credentials](#using-executable-sourced-credentials-with-oidc-and-saml)
       * [Accessing resources using a custom supplier for OIDC or SAML](#using-a-custom-supplier-with-oidc-and-saml)
       * [Accessing resources using a custom supplier with AWS](#using-a-custom-supplier-with-aws)
@@ -368,10 +369,11 @@ retrieve external subject tokens and exchange them for service account access to
 The configuration file can be generated by using the [gcloud CLI](https://cloud.google.com/sdk/).
 
 For OIDC providers, the Auth library can retrieve OIDC tokens from a local file 
-(file-sourced credentials), a local server (URL-sourced credentials), or a X.509 
+([file-sourced credentials](#file-sourced-credentials)), a local server 
+([URL-sourced credentials](#url-sourced-credentials)), or a X.509 
 certificate and private-key combination (X.509 certificate-sourced credentials).
 
-**File-sourced credentials**
+#### File-sourced credentials
 For file-sourced credentials, a background process needs to be continuously refreshing the file
 location with a new OIDC token prior to expiration. For tokens with one hour lifetimes, the token
 needs to be updated in the file every hour. The token can be stored directly as plain text or in
@@ -402,7 +404,7 @@ Where the following variables need to be substituted:
 
 This generates the configuration file in the specified output file.
 
-**URL-sourced credentials**
+#### URL-sourced credentials
 For URL-sourced credentials, a local server needs to host a GET endpoint to return the OIDC token.
 The response can be in plain text or JSON. Additional required request headers can also be
 specified.
@@ -437,18 +439,20 @@ You can now [use the Auth library](#using-external-identities) to call Google Cl
 resources from an OIDC provider.
 
 ### Accessing resources using X.509 certificate-sourced credentials
-For X.509 certificate-sourced credentials, the authentication library uses an X.509 certificate and private key to prove your application's identity. The certificate has a built-in expiration date and must be renewed to maintain access.
+For more information, see the [official documentation](https://cloud.google.com/iam/docs/workload-identity-federation-with-x509-certificates).
+
+For X.509 certificate-sourced credentials, the authentication library uses an X.509 certificate and private key to prove your application's identity. The certificate has a built-in expiration date, which is defined in the certificate itself, and must be renewed to maintain access.
 
-The library constructs a subject token by creating a JSON array containing the base64-encoded leaf certificate, followed by any intermediate certificates from a provided trust chain.
+#### Prerequisites: Generating Configuration Files for X.509 Federation
+To configure X.509 certificate-sourced credentials, you need to generate two separate configuration files: a primary **credential configuration file** and a **certificate configuration file**. The primary credential configuration file contains the necessary metadata for authentication, and it points to the certificate configuration file, which contains the paths to the X.509 certificate, private key, and trust chain.
 
-#### Generating Configuration Files for X.509 Federation
-To configure X.509 certificate-sourced credentials, you need to generate two separate configuration files: a primary **credential configuration file** and a **certificate configuration file**. The `gcloud iam workload-identity-pools create-cred-config` command can be used to create both.
+The [`gcloud iam workload-identity-pools create-cred-config`](https://cloud.google.com/sdk/gcloud/reference/iam/workload-identity-pools/create-cred-config) command can be used to create both.
 
 The location where the certificate configuration file is created depends on whether you use the `--credential-cert-configuration-output-file` flag.
 
 **Default Behavior (Recommended)**
 
-If you omit the `--credential-cert-configuration-output-file` flag, gcloud creates the certificate configuration file at a default, well-known location that the auth library can automatically discover. This is the simplest approach for most use cases.
+If you omit the `--credential-cert-configuration-output-file` flag, gcloud creates the certificate configuration file at a default, well-known location that the auth library can automatically discover. This is the simplest approach for most use cases. The default credential configuration file is named `config.json` and the default certificate configuration file is named `certificate_config.json`.
 
 Example Command (Default Behavior):