diff --git a/doc/api/crypto.md b/doc/api/crypto.md
index 5b84cd18359675..b777275acd4102 100644
--- a/doc/api/crypto.md
+++ b/doc/api/crypto.md
@@ -520,8 +520,9 @@ cipher text should be discarded due to failed authentication. If the tag length
 is invalid according to [NIST SP 800-38D][] or does not match the value of the
 `authTagLength` option, `decipher.setAuthTag()` will throw an error.
 
-The `decipher.setAuthTag()` method must be called before
-[`decipher.final()`][] and can only be called once.
+The `decipher.setAuthTag()` method must be called before [`decipher.update()`][]
+for `CCM` mode or before [`decipher.final()`][] for `GCM` and `OCB` modes.
+`decipher.setAuthTag()` can only be called once.
 
 ### `decipher.setAutoPadding([autoPadding])`
 <!-- YAML