2 files changed, 6 insertions, 2 deletions

diff --git a/docs/dashboard.md b/docs/dashboard.md
index 1a0ae86..7f64034 100644
--- a/docs/dashboard.md
+++ b/docs/dashboard.md
@@ -21,8 +21,11 @@ dashboard without one is sent to. There, a user logs in with its password
 [`access.md`](access.md), Tokens), or any other. The page keeps a session for the
 browser, a cookie no script reads and no other site's page sends, renewed while the
 dashboard is open; it ends with the token's lifetime, or with "Log out of this
-browser". The page and the login page run their own script only (a content security
-policy naming it by its hash), and no other page may frame them. The API listens on localhost unless `--bind-addr` says otherwise;
+browser" on the login page, or "log out" on the dashboard, which ends this browser's
+session only. Where the page got in by what it can't end, the browser's password or
+the proxy's, it says so beside the user's name. The page and the login page run their
+own script only (a content security policy naming it by its hash), and no other page
+may frame them. The API listens on localhost unless `--bind-addr` says otherwise;
 to look at a node on another machine, forward the port (`ssh -L 3000:localhost:3000
 <machine>`) or put a TLS proxy in front ([`operations.md`](operations.md), Behind a reverse proxy).
 
diff --git a/docs/openapi.yaml b/docs/openapi.yaml
index 13d8a65..2ebf7fc 100644
--- a/docs/openapi.yaml
+++ b/docs/openapi.yaml
@@ -1980,6 +1980,7 @@ components:
       properties:
         token: { type: string, description: '`ct1.…`: send it as `Authorization: Bearer <token>`.' }
         user: { type: string }
+        login: { type: string, description: 'How the user proved it, at the login the session began with: `htpasswd`, `header`, `key`, `token`.' }
         issuer: { type: string, description: The node that signed it. }
         expiresAt: { type: integer, description: Unix ms. }
         sessionExpiresAt: { type: integer, description: Unix ms. }