diff --git a/java/google/registry/config/files/default-config.yaml b/java/google/registry/config/files/default-config.yaml
index c1f505398..8cd99454b 100644
--- a/java/google/registry/config/files/default-config.yaml
+++ b/java/google/registry/config/files/default-config.yaml
@@ -132,8 +132,11 @@ oAuth:
   requiredOauthScopes:
     - https://www.googleapis.com/auth/userinfo.email
 
-  # OAuth client Ids that are allowed to authenticate and communicate with
-  # backend services, e. g. nomulus tool, EPP proxy, etc.
+  # OAuth client IDs that are allowed to authenticate and communicate with
+  # backend services, e. g. nomulus tool, EPP proxy, etc. All client_id values
+  # used in client_secret.json files for associated tooling should be included
+  # in this list. Client IDs are typically of the format
+  # numbers-alphanumerics.apps.googleusercontent.com
   allowedOauthClientIds: []
 
 icannReporting:
diff --git a/java/google/registry/config/files/nomulus-config-production-sample.yaml b/java/google/registry/config/files/nomulus-config-production-sample.yaml
index ce24579ca..4ed9c1c3f 100644
--- a/java/google/registry/config/files/nomulus-config-production-sample.yaml
+++ b/java/google/registry/config/files/nomulus-config-production-sample.yaml
@@ -39,6 +39,10 @@ icannReporting:
   icannTransactionsReportingUploadUrl: https://ry-api.icann.org/report/registrar-transactions
   icannActivityReportingUploadUrl: https://ry-api.icann.org/report/registry-functions-activity
 
+oAuth:
+  allowedOauthClientIds:
+    - placeholder.apps.googleusercontent.com
+
 rde:
   reportUrlPrefix: https://ry-api.icann.org/report/registry-escrow-report
   uploadUrl: sftp://placeholder@sftpipm2.ironmountain.com/Outbox