Auth should be documented before API clients and how to build requests.