diff --git a/plugin/path_config_rotate_root.go b/plugin/path_config_rotate_root.go
index 5f2abc04..73a1da77 100644
--- a/plugin/path_config_rotate_root.go
+++ b/plugin/path_config_rotate_root.go
@@ -37,7 +37,9 @@ func (b *backend) pathConfigRotateRootWrite(ctx context.Context, req *logical.Re
 		return nil, fmt.Errorf("no configuration")
 	}
 	if cfg.CredentialsRaw == "" {
-		return nil, fmt.Errorf("configuration does not have credentials")
+		return nil, fmt.Errorf("configuration does not have credentials - this " +
+			"endpoint only works with user-provided JSON credentials explicitly " +
+			"provided via the config/ endpoint")
 	}
 
 	// Parse the credential JSON to extract the email (we need it for the API