Every request should make its authentication story obvious. Even when the actual scheme changes later, readers need one place that clearly states what credentials are required and where they go.
Header format
Use a dedicated authorization header for authenticated calls:
Authorization: Bearer <token>
Keep the header casing and token prefix consistent across examples so the reference stays easy to copy.
What to document
At a minimum, this page should answer:
- how clients obtain a token
- whether tokens are scoped or environment-specific
- which routes allow anonymous access
- how expired credentials are reported
Cross-links
Authentication guidance often needs a companion guide that explains local setup or credential rotation. Keep that walkthrough in /docs, then link back here for the exact header contract.