Plugin Store · Auth
Tokens
Static bearer tokens, constant-time. Available
The Tokens module is Busbar’s default client auth: a static allowlist of bearer tokens, compared in constant time so a token check never leaks length or content through timing. It accepts the token on either carrier a client might use, and it has zero dependencies — it’s in the core binary.
A separate admin token guards the /api/v1/admin management plane, checked the same constant-time way. Between them you get a working, trusted gateway out of the box: issue tokens to callers, hold the admin token for operators.
When access needs to follow real identity — an IdP, directory groups, client certificates — swap or stack an auth plugin (OIDC and others below). Token auth stays the zero-cost default underneath.
Built into the core — the default request auth.