Token Authentication diagrams are misleading
In Token Authentication there are four ways documented, where each of those ways has a diagram.
Diagram 2.3 is clearly an outlier, with a different presentation from 2.1, 2.2 and 2.3(a) in respect of how the client communicates with the Ably service once it has a live token. It should use the same two-headed 'communicates with Ably' arrow that the other diagrams have as (5) given any of the auth methods can be used for either realtime or REST operations.
Also, the words "over websockets should be removed from 2.2 and 2.3(a) as this gives the false impression that these particular auth methods only work with websockets (i.e. realtime), despite them also being valid for REST.
See discussion in Slack for more context.