Add note about valid users

docs/api/Authentication.md

@@ -2,7 +2,14 @@
 
 The webqueue2 API uses a two stage authentication system combining Active Directory and [HTTP Token](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication) (or "bearer") authentication.
 
-All API calls require an access token. You can get an access token by making a POST request to the `/api/login` endpoint containing the JSON encoded username and password.
+All API calls require an access token. You can get an access token by making a POST request to the `/api/login` endpoint containing the JSON encoded username and password of a valid user.
+
+??? info "Who is a valid user?"
+    A valid user is a non-admin BoilerAD user who is in the `00000227-ECN-webqueue` group. Users cannot be added directly to this group. To be included in this group, a user must exist in one of the following groups:
+
+    - `00000227-ECNStaff`
+    - `00000227-ECNStuds`
+    - `00000227-ECN-webqueue-misc`
 
 === "fetch"
     ```javascript