Documentation - REST API - Mention dev.debug mode

[github/shaarli/Shaarli.git] / doc / md / REST-API.md

diff --git a/doc/md/REST-API.md b/doc/md/REST-API.md
index f3f0b17aa00bc441bac3ef3d240f703fa7d4ec5a..11bd1cd22f9a62a275ef3b5ce8570849545bb00e 100644 (file)
--- a/doc/md/REST-API.md
+++ b/doc/md/REST-API.md
@@ -1,6 +1,19 @@
-## Usage
+## Usage and Prerequisites
 
-See the [REST API documentation](http://shaarli.github.io/api-documentation/).
+See the [REST API documentation](http://shaarli.github.io/api-documentation/)
+for a list of available endpoints and parameters.
+
+Please ensure that your server meets the
+[requirements](Server-configuration#prerequisites) and is properly
+[configured](Server-configuration):
+
+- URL rewriting is enabled (see specific Apache and Nginx sections)
+- the server's timezone is properly defined
+- the server's clock is synchronized with
+  [NTP](https://en.wikipedia.org/wiki/Network_Time_Protocol)
+
+The host where the API client is invoked should also be synchronized with NTP,
+see [token expiration](#payload).
 
 ## Authentication
 
@@ -43,9 +56,11 @@ ewogICAgICAgICJ0eXAiOiAiSldUIiwKICAgICAgICAiYWxnIjogIkhTNTEyIgogICAgfQ==
 
 #### Payload
 
-**Validity duration**
+**Token expiration**
 
-To avoid infinite token validity, JWT tokens must include their creation date in UNIX timestamp format (timezone independant - UTC) under the key `iat` (issued at). This token will be accepted during 9 minutes.
+To avoid infinite token validity, JWT tokens must include their creation date
+in UNIX timestamp format (timezone independent - UTC) under the key `iat` (issued at).
+This token will be valid during **9 minutes**.
 
 ```json
 {
@@ -74,6 +89,11 @@ $signature = hash_hmac('sha512', $content, $secret);
 - [Android client example with Kotlin](https://gitlab.com/snippets/1665808)
   by [Braincoke](https://github.com/Braincoke)
 
+### Javascript, NodeJS
+
+- [shaarli-client](https://www.npmjs.com/package/shaarli-client)
+  ([source code](https://github.com/laBecasse/shaarli-client))
+  by [laBecasse](https://github.com/laBecasse)
 
 ### PHP
 
@@ -132,3 +152,22 @@ See the reference API client:
 
 - [Documentation](http://python-shaarli-client.readthedocs.io/en/latest/) on ReadTheDocs
 - [python-shaarli-client](https://github.com/shaarli/python-shaarli-client) on Github
+
+## Troubleshooting
+
+### Debug mode
+
+> This should never be used in a production environment.
+
+For security reasons, authentication issues will always return an `HTTP 401` error code without any detail.
+
+It is possible to enable the debug mode in `config.json.php` 
+to get the actual error message in the HTTP response body with:
+
+```json
+{
+  "dev": {
+    "debug": true
+  }
+}
+```