diff --git a/private/buf/cmd/buf/buf.go b/private/buf/cmd/buf/buf.go
index ce6be10d73..3f7a0122a6 100644
--- a/private/buf/cmd/buf/buf.go
+++ b/private/buf/cmd/buf/buf.go
@@ -322,7 +322,7 @@ func wrapError(err error) error {
 			}
 			return errors.New("Failure: you are not authenticated. Create a new entry in your netrc, " +
 				"using a Buf API Key as the password. If you already have an entry in your netrc, check " +
-				"to see that your token is not expited. For details, visit https://docs.buf.build/bsr/authentication")
+				"to see that your token is not expired. For details, visit https://docs.buf.build/bsr/authentication")
 		case connectCode == connect.CodeUnavailable:
 			msg := `Failure: the server hosted at that remote is unavailable.`
 			// If the returned error is Unavailable, then determine if this is a DNS error.  If so,