diff --git a/NOTES.md b/NOTES.md
index be4700a..663023c 100644
--- a/NOTES.md
+++ b/NOTES.md
@@ -3,6 +3,16 @@ Issues to address
 
 If app crashes, won't sync w/ board status in database.
 
+Authentication.  Likely should attach an expiration policy to access
+tokens generated by an ssh key.  This way an ssh key can be passwordless
+for automation, and the cli could do:
+bitelab auth; bitelab reserve board; <dothings>; bitelab release board; bitelab revoke
+
+where auth fetches an access token via ssh, and revoke, revokes the token
+as it is no longer needed.  This either allows a "one time" access token where
+the user can provide a passphrase to get the token at auth time, or limited
+valid time access tokens such that if they were leaked, they would quickly
+expire.
 
 CONNECT proxy
 =============