seppo/doc/auth.msc

msc {
  c [ label = "Client" ],
  s [ label = "Server" ];

  c -> s   [ label = "GET add?url=" ] ;
  c <- s   [ label = "401 Unauthorized ; xslt -> form" ] ;
  c -> s   [ label = "GET api_token" ];
  c <- s   [ label = "303 ; Authorization: Bearer …" ];
  c -> s   [ label = "GET add?url=" ] ;
}