From bd8360c826b7a922eeb6226beb17853cfadb466c Mon Sep 17 00:00:00 2001
From: Tom Christie
Date: Wed, 17 Oct 2012 14:02:30 +0100
Subject: Highlight use of permissions alnog with authentication

---
 docs/api-guide/authentication.md | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'docs/api-guide/authentication.md')

diff --git a/docs/api-guide/authentication.md b/docs/api-guide/authentication.md
index 71f48163..959feaa6 100644
--- a/docs/api-guide/authentication.md
+++ b/docs/api-guide/authentication.md
@@ -16,6 +16,12 @@ The `request.user` property will typically be set to an instance of the `contrib
 
 The `request.auth` property is used for any additional authentication information, for example, it may be used to represent an authentication token that the request was signed with.
 
+---
+
+**Note:** Don't forget that authentication by itself wont allow or disallow an incoming request, it simply identifies the credentials that the request was made with.  For information on how to setup the permission polices for your API please see the [permissions documentation][permission].
+
+---
+
 ## How authentication is determined
 
 The authentication policy is always defined as a list of classes.  REST framework will attempt to authenticate with each class in the list, and will set `request.user` and `request.auth` using the return value of the first class that successfully authenticates.
-- 
cgit v1.2.3