<commit_before>FORMAT: 1A

# YOUR AWESOME API NAME

*This API blueprint is subject to change due to technology restrictions, performance optimizations or changing requirements.*

## Authentication

+ This API uses [JWT](http://jwt.io/) for authentication,
+ Every token MUST be refreshed before its expiration time,
+ Token MUST be provided in `Authorization` header,
+ Toke MUST be provided for each request that requires authentication,
+ This API issues a **long-lived access tokens** for consumers. A long-lived JWT generally SHOULD lasts about **30 days**. If no requests are made, the token MUST expire and the user MUST go through the login flow again to get a new one.

### Example Header
```
Authorization: JWT <KEY>
```

### Claims
+ `exp` - The exp ( *expiration time* ) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.
+ `iat` - The iat ( *issued at* ) claim identifies the time at which the JWT was issued.
+ `sub` - The aud ( *audience* ) claim identifies the subject of this token (for e.g. a user id).
+ `iss` - The iss ( *issuer* ) claim identifies the principal that issued the JWT.

## Consumer Identification

This API uses `User-Agent` and `Application-Id` headers to identify API consumer. `Application-Id` MUST contain an UUID that uniquely identifies a particular consumer installation.

### Example Headers
```
User-Agent: Mozilla/5.0 (Linux; Android 4.4; Nexus 5 Build/_BuildID_) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36<commit_msg>Explain JWT scheme for Authorization header<commit_after>FORMAT: 1A

# YOUR AWESOME API NAME

*This API blueprint is subject to change due to technology restrictions, performance optimizations or changing requirements.*

## Authentication

+ This API uses [JWT](http://jwt.io/) for authentication,
+ Every token MUST be refreshed before its expiration time,
+ Token MUST be provided in `Authorization` header,
+ Toke MUST be provided for each request that requires authentication,
+ This API issues a **long-lived access tokens** for consumers. A long-lived JWT generally SHOULD lasts about **30 days**. If no requests are made, the token MUST expire and the user MUST go through the login flow again to get a new one.

> A custom scheme like "JWT" seems to be more appropriate than coercing the OAuth2 Bearer scheme.

### Example Header
```
Authorization: JWT <KEY>
```

### Claims
+ `exp` - The exp ( *expiration time* ) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.
+ `iat` - The iat ( *issued at* ) claim identifies the time at which the JWT was issued.
+ `sub` - The aud ( *audience* ) claim identifies the subject of this token (for e.g. a user id).
+ `iss` - The iss ( *issuer* ) claim identifies the principal that issued the JWT.

## Consumer Identification

This API uses `User-Agent` and `Application-Id` headers to identify API consumer. `Application-Id` MUST contain an UUID that uniquely identifies a particular consumer installation.

### Example Headers
```
User-Agent: Mozilla/5.0 (Linux; Android 4.4; Nexus 5 Build/_BuildID_) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/30.0.0.0 Mobile Safari/537.36
{'fraction_non_alphanumeric': 0.0888614625115705, 'fraction_numerical': 0.01573588398642394, 'mean_word_length': 4.376451077943615, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 6, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 2, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2300392', 'n_tokens_mistral': 965, 'n_tokens_neox': 869, 'n_words': 442}