diff --git a/changelogs/client_server.rst b/changelogs/client_server.rst index 546bf37a..defe028d 100644 --- a/changelogs/client_server.rst +++ b/changelogs/client_server.rst @@ -50,6 +50,7 @@ (`#894 `_). - Add ``m.room.pinned_events`` state event for rooms. (`#1007 `_). + - Add mention of ability to send Access Token via an Authorization Header. - New endpoints: diff --git a/specification/client_server_api.rst b/specification/client_server_api.rst index 6e084a2e..87e90150 100644 --- a/specification/client_server_api.rst +++ b/specification/client_server_api.rst @@ -171,8 +171,8 @@ Client Authentication Most API endpoints require the user to identify themselves by presenting previously obtained credentials in the form of an ``access_token`` query -parameter. An access token is typically obtained via the `Login`_ or -`Registration`_ processes. +parameter or through an Authorization Header of ``Bearer $access_token``. +An access token is typically obtained via the `Login`_ or `Registration`_ processes. When credentials are required but missing or invalid, the HTTP call will return with a status of 401 and the error code, ``M_MISSING_TOKEN`` or