diff --git a/README b/README
index 587cd23..4d6cc85 100644
--- a/README
+++ b/README
@@ -130,8 +130,8 @@ following fields are allowed:
  - `max-history-age`: the time, in seconds, during which chat history is
    kept (default 14400, i.e. 4 hours);
  - `allow-recording`: if true, then recording is allowed in this group;
- - `allow-tokens`: if true, then ordinary users (without the "op" privilege)
-   are allowed to create tokens;
+ - `unrestricted-tokens`: if true, then ordinary users (without the "op"
+   privilege) are allowed to create tokens;
  - `allow-anonymous`: if true, then users may connect with an empty username;
  - `allow-subgroups`: if true, then subgroups of the form `group/subgroup`
    are automatically created when first accessed;
diff --git a/group/group.go b/group/group.go
index f9a3e22..42c5763 100644
--- a/group/group.go
+++ b/group/group.go
@@ -954,7 +954,7 @@ type Description struct {
 	AllowRecording bool `json:"allow-recording,omitempty"`
 
 	// Whether creating tokens is allowed
-	AllowTokens bool `json:"allow-tokens,omitempty"`
+	UnrestrictedTokens bool `json:"unrestricted-tokens,omitempty"`
 
 	// Whether subgroups are created on the fly.
 	AllowSubgroups bool `json:"allow-subgroups,omitempty"`
@@ -1129,7 +1129,7 @@ func (g *Group) getPasswordPermission(creds ClientCredentials) ([]string, error)
 	if found, good := matchClient(creds, desc.Presenter); found {
 		if good {
 			p := []string{"present"}
-			if desc.AllowTokens {
+			if desc.UnrestrictedTokens {
 				p = append(p, "token")
 			}
 			return p, nil
@@ -1139,7 +1139,7 @@ func (g *Group) getPasswordPermission(creds ClientCredentials) ([]string, error)
 	if found, good := matchClient(creds, desc.Other); found {
 		if good {
 			p := []string{}
-			if desc.AllowTokens {
+			if desc.UnrestrictedTokens {
 				p = append(p, "token")
 			}
 			return p, nil