@taleodor wrote in #261
Also some issues vs #258 that would need to be addressed:
It says an expired token means new versions won't be accessed and should be surfaced to users. Under #258 an expired access token is routine: 401 with error="invalid_token", fetch a new token, retry once. Only an expired API key is user-facing.
The error list omits the 401 Bearer challenge, which #258 makes the signal that authentication is required.
"Validate TLS certificates" is a SHOULD here; #258 says clients shall verify the server certificate.
The touched line "sometimes with an associated authentication token" should say API key.
@taleodor wrote in #261
Also some issues vs #258 that would need to be addressed:
It says an expired token means new versions won't be accessed and should be surfaced to users. Under #258 an expired access token is routine: 401 with error="invalid_token", fetch a new token, retry once. Only an expired API key is user-facing.
The error list omits the 401 Bearer challenge, which #258 makes the signal that authentication is required.
"Validate TLS certificates" is a SHOULD here; #258 says clients shall verify the server certificate.
The touched line "sometimes with an associated authentication token" should say API key.