diff --git a/changelogs/client_server.rst b/changelogs/client_server.rst index 546bf37a..9522298a 100644 --- a/changelogs/client_server.rst +++ b/changelogs/client_server.rst @@ -95,6 +95,7 @@ - Clarify the relationship between ``username`` and ``user_id`` in the ``/register`` API (`#1032 `_). + - Add mention of ability to send Access Token via an Authorization Header. r0.2.0 ====== diff --git a/specification/client_server_api.rst b/specification/client_server_api.rst index 6e084a2e..87e90150 100644 --- a/specification/client_server_api.rst +++ b/specification/client_server_api.rst @@ -171,8 +171,8 @@ Client Authentication Most API endpoints require the user to identify themselves by presenting previously obtained credentials in the form of an ``access_token`` query -parameter. An access token is typically obtained via the `Login`_ or -`Registration`_ processes. +parameter or through an Authorization Header of ``Bearer $access_token``. +An access token is typically obtained via the `Login`_ or `Registration`_ processes. When credentials are required but missing or invalid, the HTTP call will return with a status of 401 and the error code, ``M_MISSING_TOKEN`` or