# `AshScim.Auth`
[🔗](https://github.com/ash-project/ash_scim/blob/main/lib/ash_scim/auth.ex#L5)

Behaviour for authenticating inbound SCIM requests.

An `AshScim.Router` is configured with one auth implementation; the router
invokes `c:authenticate/2` before any resource handler runs. Returning
`{:ok, conn, actor}` allows the request to proceed (the actor is passed to
Ash actions); returning `{:error, reason}` halts with a 401 SCIM error.

Built-in implementations:

  * `AshScim.Auth.StaticBearer` — accepts one or more bearer tokens from
    configuration. Useful for development and simple deployments.

Planned: an `AshScim.Auth.AshAuthenticationToken` adapter that delegates to
the host app's `AshAuthentication.TokenResource` so SCIM bearer tokens live
alongside the existing token store and inherit its revocation semantics.

# `actor`

```elixir
@type actor() :: term() | nil
```

Optional Ash actor to use for actions performed by the request.

# `config`

```elixir
@type config() :: {module(), keyword()}
```

Implementation module + opts (the second tuple element is passed verbatim to the callbacks).

# `authenticate`

```elixir
@callback authenticate(Plug.Conn.t(), keyword()) ::
  {:ok, Plug.Conn.t(), actor()} | {:error, String.t()}
```

Authenticate `conn`. Return `{:ok, conn, actor}` to proceed (the conn may
be modified, e.g. to stash details), or `{:error, reason}` to reject.

---

*Consult [api-reference.md](api-reference.md) for complete listing*