diff --git a/docs/user-guide.rst b/docs/user-guide.rst
index 3d91d08..0e7f90f 100644
--- a/docs/user-guide.rst
+++ b/docs/user-guide.rst
@@ -225,7 +225,7 @@
     http_request = google.auth.transport.requests.Request()
 
     channel = google.auth.transport.grpc.secure_authorized_channel(
-        credentials, 'pubsub.googleapis.com:443', http_request)
+        credentials, http_request, 'pubsub.googleapis.com:443')
 
 .. note:: Even though gRPC is its own transport, you still need to use one of
     the other HTTP transports with gRPC. The reason is that most credential
diff --git a/google/auth/transport/grpc.py b/google/auth/transport/grpc.py
index dfb2883..1e02b38 100644
--- a/google/auth/transport/grpc.py
+++ b/google/auth/transport/grpc.py
@@ -62,7 +62,7 @@
 
 
 def secure_authorized_channel(
-        credentials, target, request, ssl_credentials=None):
+        credentials, request, target, ssl_credentials=None):
     """Creates a secure authorized gRPC channel.
 
     This creates a channel with SSL and :class:`AuthMetadataPlugin`. This
@@ -91,11 +91,11 @@
     Args:
         credentials (google.auth.credentials.Credentials): The credentials to
             add to requests.
-        target (str): The host and port of the service.
         request (google.auth.transport.Request): A HTTP transport request
             object used to refresh credentials as needed. Even though gRPC
             is a separate transport, there's no way to refresh the credentials
             without using a standard http transport.
+        target (str): The host and port of the service.
         ssl_credentials (grpc.ChannelCredentials): Optional SSL channel
             credentials. This can be used to specify different certificates.
 
diff --git a/system_tests/test_grpc.py b/system_tests/test_grpc.py
index 0db9f1d..7d436c5 100644
--- a/system_tests/test_grpc.py
+++ b/system_tests/test_grpc.py
@@ -28,7 +28,7 @@
         publisher_api.PublisherApi.DEFAULT_SERVICE_PORT)
 
     channel = google.auth.transport.grpc.secure_authorized_channel(
-        credentials, target, http_request)
+        credentials, http_request, target)
 
     # Create a pub/sub client.
     client = publisher_api.PublisherApi(channel=channel)
diff --git a/tests/transport/test_grpc.py b/tests/transport/test_grpc.py
index 2b214a7..5faa807 100644
--- a/tests/transport/test_grpc.py
+++ b/tests/transport/test_grpc.py
@@ -82,7 +82,7 @@
     target = 'example.com:80'
 
     channel = google.auth.transport.grpc.secure_authorized_channel(
-        credentials, target, request)
+        credentials, request, target)
 
     # Check the auth plugin construction.
     auth_plugin = metadata_call_credentials.call_args[0][0]
@@ -118,7 +118,7 @@
     ssl_credentials = mock.Mock()
 
     google.auth.transport.grpc.secure_authorized_channel(
-        credentials, target, request, ssl_credentials=ssl_credentials)
+        credentials, request, target, ssl_credentials=ssl_credentials)
 
     # Check the ssl channel call.
     assert not ssl_channel_credentials.called