diff --git a/oauth2.go b/oauth2.go
index 5f2b145..a38e6a8 100644
--- a/oauth2.go
+++ b/oauth2.go
@@ -61,6 +61,7 @@ type Config struct {
 type TokenSource interface {
 	// Token returns a token or an error.
 	// Token must be safe for concurrent use by multiple goroutines.
+	// The returned Token must not be modified.
 	Token() (*Token, error)
 }
 
diff --git a/token.go b/token.go
index 6aa0b41..b8a2938 100644
--- a/token.go
+++ b/token.go
@@ -16,7 +16,7 @@ import (
 //
 // Most users of this package should not access fields of Token
 // directly. They're exported mostly for use by related packages
-// implementing derivate OAuth2 flows.
+// implementing derivative OAuth2 flows.
 type Token struct {
 	// AccessToken is the token that authorizes and authenticates
 	// the requests.