docs: changes for next release (#11708)

* docs: changes for next release

* small fixes

* fix lint error

* small fix

www/apps/resources/app/commerce-modules/auth/authentication-route/page.mdx

@@ -339,8 +339,9 @@ If the authentication is successful, the request returns a `201` response code.
 The Medusa application defines an API route at `/auth/{actor_type}/{auth_provider}/update` that accepts a token and, if valid, updates the user's password.
 
 ```bash
-curl -X POST http://localhost:9000/auth/{actor_type}/{providers}/update?token=123
+curl -X POST http://localhost:9000/auth/{actor_type}/{providers}/update
 -H 'Content-Type: application/json' \
+-H 'Authorization: Bearer {token}' \
 --data-raw '{
   "email": "Whitney_Schultz@gmail.com",
   "password": "supersecret"
@@ -360,9 +361,15 @@ Its path parameters are:
 - `{actor_type}`: the actor type of the user you're authenticating. For example, `customer`.
 - `{provider}`: the auth provider to handle the authentication. For example, `emailpass`.
 
-#### Query Parameters
+#### Pass Token in Authorization Header
 
-The route accepts a `token` query parameter, which is the token generated using the [Generate Reset Password Token route](#generate-reset-password-token-route).
+<Note>
+
+Before [Medusa v2.6](https://github.com/medusajs/medusa/releases/tag/v2.6), you passed the token as a query parameter. Now, you must pass it in the `Authorization` header.
+
+</Note>
+
+In the request's authorization header, you must pass the token generated using the [Generate Reset Password Token route](#generate-reset-password-token-route). You pass it as a bearer token.
 
 ### Request Body Parameters
 

www/apps/resources/app/storefront-development/customers/reset-password/page.mdx

@@ -167,8 +167,8 @@ export const resetPasswordFetchHighlights = [
   ["3", "email", "Receive the email from a query parameter."],
   ["9", "password", "Assuming the password is retrieved from an input field."],
   ["14", "fetch", "Send a request to update the customer's password."],
-  ["14", "token", "Pass the token as a query parameter."],
-  ["20", "body", "Pass the email and password in the request body."]
+  ["19", "token", "Pass the token in the Authorization header."],
+  ["21", "body", "Pass the email and password in the request body."]
 ]
 
   ```ts highlights={resetPasswordFetchHighlights}
@@ -185,11 +185,12 @@ export const resetPasswordFetchHighlights = [
       return
     }
 
-    fetch(`http://localhost:9000/auth/customer/emailpass/update?token=${token}`, {
+    fetch(`http://localhost:9000/auth/customer/emailpass/update`, {
       credentials: "include",
       method: "POST",
       headers: {
         "Content-Type": "application/json",
+        "Authorization": `Bearer ${token}`,
       },
       body: JSON.stringify({
         email,
@@ -210,8 +211,8 @@ export const resetPasswordHighlights = [
   ["18", "token", "Receive the token from a query parameter."],
   ["21", "email", "Receive the email from a query parameter."],
   ["35", "fetch", "Send a request to update the customer's password."],
-  ["35", "token", "Pass the token as a query parameter."],
-  ["41", "body", "Pass the email and password in the request body."]
+  ["40", "token", "Pass the token in the Authorization header."],
+  ["42", "body", "Pass the email and password in the request body."]
 ]
 
   ```tsx highlights={resetPasswordHighlights}
@@ -249,11 +250,12 @@ export const resetPasswordHighlights = [
       }
       setLoading(true)
 
-      fetch(`http://localhost:9000/auth/customer/emailpass/update?token=${token}`, {
+      fetch(`http://localhost:9000/auth/customer/emailpass/update`, {
         credentials: "include",
         method: "POST",
         headers: {
           "Content-Type": "application/json",
+          "Authorization": `Bearer ${token}`,
         },
         body: JSON.stringify({
           email,
@@ -289,4 +291,10 @@ export const resetPasswordHighlights = [
 
 In this example, you receive the `token` and `email` from the page's query parameters.
 
-Then, when the form that has the password field is submitted, you send a request to the `http://localhost:9000/auth/customer/emailpass/update` API route. You pass it the token as a query parameter, and the email and password in the request body.
+Then, when the form that has the password field is submitted, you send a request to the `http://localhost:9000/auth/customer/emailpass/update` API route. You pass it the token as in the Authorization header as a bearer token, and the email and password in the request body.
+
+<Note>
+
+Before [Medusa v2.6](https://github.com/medusajs/medusa/releases/tag/v2.6), you passed the token as a query parameter. Now, you must pass it in the `Authorization` header.
+
+</Note>