# `Wardrik.Operations.Tokens`

Operations on the deployment's API tokens: creating, listing and revoking.

Only the SHA-256 of a token's secret is stored. The secret is returned once, when the token is
created. A resource that names an org, as `acme/agent/*`, must name a known org. A wildcard org,
as `*/agent/*`, covers whichever orgs exist.

# `authenticate`

```elixir
@spec authenticate(Wardrik.t(), String.t()) ::
  {:ok, Wardrik.Scope.t()} | {:error, Wardrik.Error.t()}
```

Returns the scope of the token `secret`, or an `unauthorized` error.

# `create`

```elixir
@spec create(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}
```

Creates a token that acts for the scope's principal. Returns the token and its secret.

The token can't do more than `scope`, be held to a different policy, or outlast it.

# `list`

```elixir
@spec list(Wardrik.Scope.t(), map()) :: {:ok, map()}
```

Lists tokens, oldest first, without secrets.

With `"resources"`, lists only the tokens whose resources those patterns all cover.

# `revoke`

```elixir
@spec revoke(Wardrik.Scope.t(), map()) :: {:ok, map()} | {:error, Wardrik.Error.t()}
```

Revokes a token. Returns the revoked token.

---

*Consult [api-reference.md](api-reference.md) for complete listing*