diff --git a/packages/ts-types/src/schemas/edge.ts b/packages/ts-types/src/schemas/edge.ts
index 6192956..daeaec8 100644
--- a/packages/ts-types/src/schemas/edge.ts
+++ b/packages/ts-types/src/schemas/edge.ts
@@ -166,7 +166,16 @@ export const EdgeClientMessageSchema = Type.Union([
     type: Type.Literal("hello"),
     gateway_id: Type.String(),
     farm_id: Type.String(),
-    token: Type.String(),
+    /*
+     * No credential here, deliberately. The edge JWT travels in an
+     * `Authorization: Bearer` header on the upgrade request and is verified
+     * before the socket exists. A `token` field used to live on this
+     * message; it was removed, because a token in the first frame means a
+     * live socket and a parsed message for a peer that has proved nothing.
+     *
+     * `farm_id` is redundant with the token's own claim, and is checked
+     * against it rather than trusted.
+     */
     /**
      * Where this gateway serves camera restreams, e.g.
      * `http://gateway.local:1984`. Omitted by a gateway with no cameras or
diff --git a/schemas/continuum/v1/edge/client_message.schema.json b/schemas/continuum/v1/edge/client_message.schema.json
index ede3d4a..a64f08a 100644
--- a/schemas/continuum/v1/edge/client_message.schema.json
+++ b/schemas/continuum/v1/edge/client_message.schema.json
@@ -7,7 +7,7 @@
     {
       "type": "object",
       "title": "Hello",
-      "description": "First message on every connection, before anything else is accepted. Carries the edge JWT minted by POST /auth/edge-token.",
+      "description": "First message on every connection, before anything else is accepted. Carries NO credential: the edge JWT minted by POST /auth/edge-token goes in an Authorization: Bearer header on the WebSocket upgrade request, and is verified before the socket exists, so an unauthenticated peer gets an HTTP 401 and no socket at all. This message used to carry a 'token' field; it was removed, because a token in the first frame means a live socket and a parsed message for a peer that has proved nothing. farm_id here is redundant with the token's own claim and is checked against it rather than trusted - a gateway naming a farm its token was not minted for is refused.",
       "properties": {
         "type": {
           "const": "hello"
@@ -18,9 +18,6 @@
         "farm_id": {
           "type": "string"
         },
-        "token": {
-          "type": "string"
-        },
         "stream_base_url": {
           "type": "string",
           "format": "uri",
@@ -30,8 +27,7 @@
       "required": [
         "type",
         "gateway_id",
-        "farm_id",
-        "token"
+        "farm_id"
       ]
     },
     {