diff --git a/clientcredentials/clientcredentials.go b/clientcredentials/clientcredentials.go
index e86346e..3ee122d 100644
--- a/clientcredentials/clientcredentials.go
+++ b/clientcredentials/clientcredentials.go
@@ -3,7 +3,7 @@
 // license that can be found in the LICENSE file.
 
 // Package clientcredentials implements the OAuth2.0 "client credentials" token flow,
-// also known as the "two-legged OAuth 2.0".
+// also known as "two-legged OAuth 2.0".
 //
 // This should be used when the client is acting on its own behalf or when the client
 // is the resource owner. It may also be used when requesting access to protected
diff --git a/google/google.go b/google/google.go
index e2eb9c9..7d1fdd3 100644
--- a/google/google.go
+++ b/google/google.go
@@ -252,7 +252,7 @@
 // Further information about retrieving access tokens from the GCE metadata
 // server can be found at https://cloud.google.com/compute/docs/authentication.
 func ComputeTokenSource(account string, scope ...string) oauth2.TokenSource {
-	// refresh 3 minutes and 45 seconds early. The shortest MDS cache is currently 4 minutes, so any
+	// Refresh 3 minutes and 45 seconds early. The shortest MDS cache is currently 4 minutes, so any
 	// refreshes earlier are a waste of compute.
 	earlyExpirySecs := 225 * time.Second
 	return computeTokenSource(account, earlyExpirySecs, scope...)
diff --git a/oauth2.go b/oauth2.go
index 3e3b630..5c527d3 100644
--- a/oauth2.go
+++ b/oauth2.go
@@ -98,7 +98,7 @@
 	// in the POST body as application/x-www-form-urlencoded parameters.
 	AuthStyleInParams AuthStyle = 1
 
-	// AuthStyleInHeader sends the client_id and client_password
+	// AuthStyleInHeader sends the client_id and client_secret
 	// using HTTP Basic Authorization. This is an optional style
 	// described in the OAuth2 RFC 6749 section 2.3.1.
 	AuthStyleInHeader AuthStyle = 2
diff --git a/pkce.go b/pkce.go
index cea8374..f99384f 100644
--- a/pkce.go
+++ b/pkce.go
@@ -51,7 +51,7 @@
 	return base64.RawURLEncoding.EncodeToString(sha[:])
 }
 
-// S256ChallengeOption derives a PKCE code challenge derived from verifier with
+// S256ChallengeOption derives a PKCE code challenge from the verifier with
 // method S256. It should be passed to [Config.AuthCodeURL] or [Config.DeviceAuth]
 // only.
 func S256ChallengeOption(verifier string) AuthCodeOption {
diff --git a/token.go b/token.go
index 239ec32..e995eeb 100644
--- a/token.go
+++ b/token.go
@@ -103,7 +103,7 @@
 }
 
 // Extra returns an extra field.
-// Extra fields are key-value pairs returned by the server as a
+// Extra fields are key-value pairs returned by the server as
 // part of the token retrieval response.
 func (t *Token) Extra(key string) any {
 	if raw, ok := t.raw.(map[string]any); ok {
diff --git a/transport.go b/transport.go
index 8bbebba..9922ec3 100644
--- a/transport.go
+++ b/transport.go
@@ -58,7 +58,7 @@
 var cancelOnce sync.Once
 
 // CancelRequest does nothing. It used to be a legacy cancellation mechanism
-// but now only it only logs on first use to warn that it's deprecated.
+// but now only logs on first use to warn that it's deprecated.
 //
 // Deprecated: use contexts for cancellation instead.
 func (t *Transport) CancelRequest(req *http.Request) {