# `Ankusa.Admin.Auth.Token`
[🔗](https://github.com/jamescarr/ankusa/blob/ankusa-v0.7.0/packages/ankusa/lib/ankusa/admin/auth/token.ex#L1)

Static bearer tokens (`mode: :token`), for development, CI and scripts. Use
`Ankusa.Admin.Auth.JWT` or `Ankusa.Admin.Auth.MTLS` for people and for
anything that must be revocable.

The configuration holds each token's SHA-256, never the token:

    tokens: [
      %{id: "ci", sha256: "<hex of sha256(token)>", scopes: ["dlq:read", "tenant:*"]}
    ]

Generate one with `openssl rand -hex 32` and hash it with
`printf %s "$TOKEN" | shasum -a 256`. A token is as strong as its entropy:
hash a random 32-byte value, not a password. The presented token is hashed
and compared with every configured hash in constant time, so neither which
entry matched nor how many exist shows in the response time.

# `hash`

```elixir
@spec hash(binary()) :: String.t()
```

The lowercase hex SHA-256 of `token`: what `sha256:` in the configuration holds.

---

*Consult [api-reference.md](api-reference.md) for complete listing*