auth

README.md

@@ -31,11 +31,11 @@ Create that file once on the server with the production values required by the
 app. The Gitea deploy step verifies that it exists, but it does not create or
 overwrite it.
 
-Protected API routes require the shared API key from `ORG_BACKEND_API_KEY`.
-Clients send it as:
+Use `/api/auth/register` to create users and `/api/auth/login` to receive a JWT.
+Protected API routes send that token as:
 
 ```text
-X-Org-Api-Key: <key>
+Authorization: Bearer <token>
 ```
 
 The live systemd unit at `/etc/systemd/system/org-backend.service` is managed