Static bearer tokens (mode: :token), for development, CI and scripts. Use Ankusa.Admin.Auth.JWT or Ankusa.Admin.Auth.MTLS for people and for anything that must be revocable.

The configuration holds each token's SHA-256, never the token:

tokens: [
  %{id: "ci", sha256: "<hex of sha256(token)>", scopes: ["dlq:read", "tenant:*"]}
]

Generate one with openssl rand -hex 32 and hash it with printf %s "$TOKEN" | shasum -a 256. A token is as strong as its entropy: hash a random 32-byte value, not a password. The presented token is hashed and compared with every configured hash in constant time, so neither which entry matched nor how many exist shows in the response time.