From c2b1b7a10efa4591364b9eee8ce5172732ebb49b Mon Sep 17 00:00:00 2001 From: Michael Telatynski <7t3chguy@gmail.com> Date: Fri, 27 Oct 2017 09:52:53 +0100 Subject: [PATCH] mention that we can send tokens via headers --- changelogs/client_server.rst | 1 + specification/client_server_api.rst | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/changelogs/client_server.rst b/changelogs/client_server.rst index 546bf37a..9522298a 100644 --- a/changelogs/client_server.rst +++ b/changelogs/client_server.rst @@ -95,6 +95,7 @@ - Clarify the relationship between ``username`` and ``user_id`` in the ``/register`` API (`#1032 `_). + - Add mention of ability to send Access Token via an Authorization Header. r0.2.0 ====== diff --git a/specification/client_server_api.rst b/specification/client_server_api.rst index 6e084a2e..87e90150 100644 --- a/specification/client_server_api.rst +++ b/specification/client_server_api.rst @@ -171,8 +171,8 @@ Client Authentication Most API endpoints require the user to identify themselves by presenting previously obtained credentials in the form of an ``access_token`` query -parameter. An access token is typically obtained via the `Login`_ or -`Registration`_ processes. +parameter or through an Authorization Header of ``Bearer $access_token``. +An access token is typically obtained via the `Login`_ or `Registration`_ processes. When credentials are required but missing or invalid, the HTTP call will return with a status of 401 and the error code, ``M_MISSING_TOKEN`` or