# `AshScim.Auth.StaticBearer`
[🔗](https://github.com/ash-project/ash_scim/blob/main/lib/ash_scim/auth/static_bearer.ex#L5)

Authenticates SCIM requests against one or more static bearer tokens.

## Example

    plug AshScim.Router,
      domains: [MyApp.Accounts],
      auth: {AshScim.Auth.StaticBearer, tokens: {:env, "SCIM_BEARER_TOKEN"}}

## Options

  * `:tokens` — required. A list of accepted token strings, a single
    string, or a `{:env, "VAR"}` tuple to read at request time. Reading
    from the environment lazily avoids baking tokens into compiled
    releases. Multiple tokens are useful during rotation.
  * `:actor` — optional. The Ash actor to use for actions performed by
    authenticated requests. Defaults to `nil`. For most setups you will
    want to provide a service-account user record so that policies see a
    consistent identity in audit logs.

Constant-time comparison is used to match the presented token, so this
module is safe against timing attacks even when tokens differ in length.

---

*Consult [api-reference.md](api-reference.md) for complete listing*