1 files changed, 7 insertions, 3 deletions
diff --git a/docs/api.md b/docs/api.md
index 5b4dac4..cdc722e 100644
--- a/docs/api.md
+++ b/docs/api.md
@@ -31,8 +31,9 @@ curl -u alice:secret -X POST 'localhost:3000/store/stats/visits?increment=1'  #
 * Bodies are JSON (`application/json`, the default), text (`text/plain`, stored as a
   string), or a value of a type of its own (Types); answers are JSON, or as `Accept`
   asks. Numbers in JSON are stored as integers where they fit, as floats otherwise.
-* Every request needs a user from the node's `--htpasswd` (basic authentication). Users
-  are all alike: each can read and write everything but protocol data (below).
+* Every request needs a user from the node's `--htpasswd` (basic authentication), or
+  named by a reverse proxy in front that authenticated it (`--user-header`;
+  [`operations.md`](operations.md), Behind a reverse proxy). Users are all alike: each can read and write everything but protocol data (below).
 * A key with `/` in it, or an empty key, can be written inside a value at its parent,
   but not named in a path: read it through the parent.
 
@@ -193,6 +194,9 @@ node or by sync:
 {"key":"settings/theme","deleted":true}
 ```
 
+While nothing changes, a blank line every 30 s (`--stream-heartbeat`) keeps proxies in
+front from taking the stream for dead; skip blank lines.
+
 An event carries the value as a read would return it then. Changes in quick succession
 may come as one event with the latest value: a stream tells the value, not every write.
 A change that leaves the value as it was sends nothing. The connection stays open; after
@@ -222,7 +226,7 @@ Load balancers can send requests to any ready node: `/ready` is the check.
 Every change records the node that committed it (as its Automerge author) and, for a
 write through the API, the user who wrote it (in its message, as a trailer like Git's
 `Signed-off-by:`: `User: alice`), with when (by the writer's clock). User names are
-each node's own (`--htpasswd`), so who wrote it is that user at that node: `alice` on
+each node's own (`--htpasswd`, or its proxy's), so who wrote it is that user at that node: `alice` on
 two nodes is one person only where their operators make it so, which nothing checks.
 `GET /admin/changes` lists them,
 newest first, with the paths each touched; `GET /admin/changes/settings` those that