Many of the example API calls in Barbican documents use the unauthorized context without explanation.
As Barbican adoption is increasing, this is leading to confusion, as users attempt to follow the examples with a deployment that includes authorization.
I think all of the API examples should be based on the authorized context, and a separate page should be added detailing how to use unauthorized context.
Here's a example:
http://docs.openstack.org/developer/barbican/api/userguide/secrets.html
curl -X POST -H 'content-type:application/json' -H 'X-Project-Id:12345' \
-d '{"payload": "my-secret-here", "payload_content_type": "text/plain"}' \
http://localhost:9311/v1/secrets
This is confusing because, without explanation, new users expect to use X-Project-Id header.
Yup, I understand the pain, was recently referring to these doc. There should be a -H 'X-Auth-Token: 12345' in every request instead of 'X-Project-ID'. Do you foresee adding one page for every API type? I think adding a note in the end of each API type should be sufficient. Thoughts?