# `AshScim.Auth.AshAuthenticationToken`
[🔗](https://github.com/ash-project/ash_scim/blob/main/lib/ash_scim/auth/ash_authentication_token.ex#L5)

Authenticates SCIM requests using JWTs issued by `AshAuthentication`.

The bearer token is verified against the host app's signing key, its
`purpose` claim is checked, the JTI is verified against the
`AshAuthentication.TokenResource` so revocations are honored, and the
`sub` claim is resolved into a user record. That user is returned as the
Ash actor for the request.

## Example

    plug AshScim.Router,
      domains: [MyApp.Accounts],
      auth: {AshScim.Auth.AshAuthenticationToken, otp_app: :my_app}

Revocation is handled transparently by `AshAuthentication.Jwt.verify/2`,
which checks the JTI against the resource's token resource as part of
validation. There is no separate revocation check inside this module.

## Options

  * `:otp_app` — required. The OTP application name configured by
    AshAuthentication. Used to discover the user resource(s).
  * `:purpose` — required claim value to match. Defaults to `"scim"`.
    Tokens issued for other purposes (sign-in, magic link, confirmation)
    cannot be used to access SCIM endpoints.

## Issuing tokens

Generate a SCIM token from the host app — typically from an admin UI or an
iex console — by minting a JWT with `purpose: "scim"` for a service-account
user and persisting it in the token resource. A `mix ash_scim.gen.token`
task is provided for local development convenience but should not be used
against production.

---

*Consult [api-reference.md](api-reference.md) for complete listing*