[taler-docs] 01/02: start docs for #7793

[gnunet]

This is an automated email from the git hooks/post-receive script.

grothoff pushed a commit to branch master
in repository docs.

commit ced82b398c7ce1053f0de27d5e5299970068e3b6
Author: Christian Grothoff <grothoff@gnunet.org>
AuthorDate: Tue Sep 5 15:49:50 2023 +0200

    start docs for #7793
---
 core/api-merchant.rst | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/core/api-merchant.rst b/core/api-merchant.rst
index dbda8e61..71f33b0e 100644
--- a/core/api-merchant.rst
+++ b/core/api-merchant.rst
@@ -99,12 +99,17 @@ Authentication
 Each merchant instance has separate authentication settings for the private 
API resources
 of that instance.
 
-Currently, the API supports two auth methods:
+Currently, the API supports two main authentication methods:
 
 * ``external``:  With this method, no checks are done by the merchant backend.
   Instead, a reverse proxy / API gateway must do all 
authentication/authorization checks.
 * ``token``: With this method, the client must provide a ``Authorization: 
Bearer $TOKEN``
-  header, where ``$TOKEN`` is a secret authentication token configured for the 
instance.
+  header, where ``$TOKEN`` is a secret authentication token configured for the 
instance which must begin with the RFC 8959 prefix.
+
+Additionally, clients can send a **login token** which they may obtain from
+the ``/private/login`` endpoint.  Such a login token is valid only for a
+limited period of time and can be used by clients to avoid storing the
+long-term login secrets from an authentication method.
 
 -----------------
 Configuration API
@@ -1004,6 +1009,9 @@ Setting up instances
 
     }
 
+.. http:post:: [/instances/$INSTANCE]/private/login
+
+
 .. http:patch:: /management/instances/$INSTANCE
 .. http:patch:: [/instances/$INSTANCE]/private
 

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.