diff --git a/specs/notation-cli.md b/specs/notation-cli.md
index 502e052e1..c2ef3ea7e 100644
--- a/specs/notation-cli.md
+++ b/specs/notation-cli.md
@@ -67,7 +67,12 @@ COMMANDS:
    help, h     Shows a list of commands or help for one command
 
 OPTIONS:
-   --help, -h  show help (default: false)
+   --username value, -u value    Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value    Password for registry operations [$NOTATION_PASSWORD]
+   --help, -h                    show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                  Registry access via plain HTTP (default: false)
 ```
 
 ## certificate
@@ -123,7 +128,12 @@ USAGE:
    notation list [command options] <reference>
 
 OPTIONS:
-   --help, -h                  show help (default: false)
+   --username value, -u value    Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value    Password for registry operations [$NOTATION_PASSWORD]
+   --help, -h                    show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                  Registry access via plain HTTP (default: false)
 ```
 
 ## login
@@ -154,6 +164,9 @@ notation login -u <user> -p <password> registry.example.com
 
 # Login using $NOTATION_USERNAME $NOTATION_PASSWORD variables
 notation login registry.example.com
+
+NOTES
+Once login is completed, then -u -p is no longer required for any notation commands against the registry server authenticated.
 ```
 
 ## plugin
@@ -185,9 +198,14 @@ USAGE:
    notation pull [command options] <reference>
 
 OPTIONS:
+   --username value, -u value  Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value  Password for registry operations [$NOTATION_PASSWORD]
    --strict                    Pull the signature without lookup the manifest (default: false)
    --output value, -o value    Write signature to a specific path
    --help, -h                  Show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                Registry access via plain HTTP (default: false)
 ```
 
 ## push
@@ -201,8 +219,13 @@ USAGE:
    notation push [command options] <reference>
 
 OPTIONS:
+   --username value, -u value             Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value             Password for registry operations [$NOTATION_PASSWORD]
    --signature value, -s value, -f value  signature files  (accepts multiple inputs)
    --help, -h                             show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                           Registry access via plain HTTP (default: false)
 ```
 
 ## sign
@@ -227,7 +250,12 @@ OPTIONS:
    --push                       push after successful signing (default: true)
    --push-reference value       different remote to store signature
    --media-type value           specify the media type of the manifest read from file or stdin (default: "application/vnd.docker.distribution.manifest.v2+json")
+   --username value, -u value   Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value   Password for registry operations [$NOTATION_PASSWORD]
    --help, -h                   show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                 Registry access via plain HTTP (default: false)
 ```
 
 ## verify
@@ -247,5 +275,10 @@ OPTIONS:
    --pull                                 pull remote signatures before verification (default: true)
    --local, -l                            reference is a local file (default: false)
    --media-type value                     specify the media type of the manifest read from file or stdin (default: "application/vnd.docker.distribution.manifest.v2+json")
+   --username value, -u value             Username for registry operations [$NOTATION_USERNAME]
+   --password value, -p value             Password for registry operations [$NOTATION_PASSWORD]
    --help, -h                             show help (default: false)
+
+GLOBAL ARGUMENTS
+   --plain-http                           Registry access via plain HTTP (default: false)
 ```